BrandPurl is operated by Yunuo Fang Cultural Creative Limited (予諾舫文創有限公司), registered at Room D3, 11/F, Luk Hop Industrial Building, 8 Luk Hop Street, San Po Kong, Kowloon, Hong Kong. This notice explains our handling of personal information. Reading this notice or accepting the Terms does not replace any separate consent required by law.
1. Information we process
Account information includes your email, profile details, authentication identifiers, and any phone number provided for an enabled login method. Workspace information includes brand profiles, product URLs, documents, prompts, reference images, uploaded media, generated output, and publishing instructions. Do not include another person’s information without a lawful basis.
Social connections involve platform profile identifiers, connection status, permissions, and publishing results. Upload-Post and the relevant platform manage authorization for supported connections. We do not ask for your social-platform password. Credentials and authorization records may be processed as needed for the selected connection method.
Security and support records may include IP address, device or browser details, request timestamps, errors, service usage, consent records, and communications with us. Stripe processes payment details; we receive order, subscription, invoice, payment-status information and limited card details where supplied, not your full card number.
2. Purposes and legal grounds
We use information to provide requested generation, storage and publishing, maintain accounts, bill and reconcile usage, prevent fraud and abuse, handle support and rights requests, and meet legal obligations. We do not sell or rent personal information.
The legal ground depends on the activity and applicable law: necessary contract performance, consent, legal obligations, or another legally available ground. We rely on legitimate interests only where that ground is recognized and the required balancing supports the processing. This is not a blanket lawful basis under China’s PIPL. Where separate consent is required, it must be obtained for that activity.
3. Service providers and disclosures
Our service uses Supabase for authentication and database services; Cloudflare R2 for media storage; Stripe for payments; Upload-Post for social connections and publishing; and Resend for transactional email. Depending on the feature, infrastructure and configured integrations may also use Upstash, Firecrawl, and Jina for rate limiting or retrieving public source pages.
AI processing may use Sanzhou as an API intermediary and providers or models from OpenAI, MiniMax, and Volcengine/ARK, depending on the selected feature and configuration. A model’s name alone does not identify every organization handling a request. Relevant prompts, source material, and media may be sent through the configured processing chain to produce the requested output.
We share information needed for these services, professional advice, legally required disclosures, or investigating unlawful activity. A provider may also process information under its own legal obligations and policies. Contact us for information about the recipients relevant to your use; provider availability and routing can change, subject to required notices and consent.
4. Connected platforms and disconnection
Connecting a platform authorizes the requested account-management and publishing operations, subject to the permissions shown in its authorization flow. Public posts are also governed by the platform’s terms and privacy policy. BrandPurl is an independent service and does not represent the connected social platforms.
You may request disconnection in the workspace and revoke app access directly in the social platform’s settings. BrandPurl submits supported disconnection requests to Upload-Post or the platform. Completion, token invalidation, and deletion at the provider depend on its processing; disconnection does not itself delete previously published posts, billing records, or all backups. Contact us if the connection remains active.
5. International processing
BrandPurl is operated from Hong Kong and uses infrastructure and providers in multiple jurisdictions. Your account information, prompts, source material, and media may be processed outside your location, including outside mainland China. Actual locations depend on the provider and request; we do not represent that all data stays in one country.
Applicable transfer requirements must be satisfied before a transfer proceeds. Where PIPL or another law requires recipient details, safeguards, a transfer mechanism, or separate consent, these must be provided or obtained for the relevant transfer. General acceptance of these Terms or continued use is not separate consent. Contact us about recipients, processing purposes, information categories, and exercising rights or withdrawing consent; withdrawal does not invalidate prior lawful processing and may prevent the affected feature from operating.
6. AI data use
BrandPurl does not use your private prompts or workspace content to train its own public generative-AI models. External providers’ retention and model-improvement practices depend on the terms and settings of the actual integration. We do not promise that every intermediary offers zero retention or identical training restrictions. Do not submit confidential or sensitive information unless the relevant processing arrangements meet your requirements.
7. Retention and deletion
Workspace access becomes read-only after trial or paid-plan expiry. Workspace content may be permanently removed after the 15-day retention period described in the Terms. A new or shorter rule requires the notice and any consent applicable to existing users; it does not authorize unannounced retrospective deletion. Keep independent copies before expiry.
Login accounts, consent evidence, payment and subscription records, and credit ledgers are not included in workspace cleanup. They may be retained for continuing account services, legal recordkeeping, fraud prevention, and resolving claims. Financial records are kept for the applicable statutory period.
Retention is based on the information’s purpose, security needs, unresolved disputes, and legal obligations, rather than indefinite storage by default. Deletion from live systems and expiry from backups or provider systems may occur at different times. We do not promise immediate erasure from every copy. Contact us for the applicable period or criteria and the status of a deletion request. Earlier specific commitments remain subject to the terms applicable when made and any lawful change process.
8. Your choices and rights
Depending on applicable law, you may request access, correction, a copy or export, deletion, restriction, objection, or withdrawal of consent, and complain to a competent regulator. Send requests to our contact email. We may request proportionate identity verification, explain a lawful retention exception or refusal, and respond within applicable legal deadlines.
Withdrawing optional consent does not require closing your entire account. If processing is necessary for a requested feature and no other lawful basis applies, withdrawal may make that feature unavailable. Account closure does not automatically erase records that must lawfully be retained.
9. Cookies and similar storage
With your permission, we use Google Analytics to understand website visits, traffic sources, and page usage. Google processes analytics cookies, browser and device information, and interaction data under its privacy policy. Analytics is optional: we load the Google tag only after you allow analytics. You can decline or withdraw your choice below without affecting your account or purchases. Withdrawal stops future collection in this browser; it does not erase data already sent to Google. We do not enable advertising personalization in this integration.
We use browser cookies or local storage for sign-in sessions, security, and preferences such as language or theme. Payment providers may use their own storage during checkout. Whether prior consent is required depends on the purpose and applicable law; strictly necessary storage may be exempt. This notice is not consent for advertising or other non-essential tracking. Any such use requiring consent must wait for that consent.
Browser controls can remove or block stored information, which may sign you out or prevent requested features from working. You can change supported language and theme preferences inside BrandPurl.
10. Security, children, and updates
We use measures such as encrypted transport, access controls, and restricted server credentials. No system eliminates every security risk. Where a personal-data breach requires notification, we will notify the relevant authority or affected people within the applicable legal deadlines. The service is not intended for anyone under 18; contact us if a minor has provided information.
We may revise this notice to reflect actual services and legal requirements. Material changes will receive appropriate advance notice and, where required, fresh consent. Changes do not retrospectively make earlier unlawful processing lawful. Our data protection contact is Jonce at the contact email and postal address stated on this page.
Contact: fufuxia3@gmail.com