This policy describes what BuildSmarter Marketing AI collects, why we collect it, who we share it with, and how to exercise your rights. We try to keep this document specific and skimmable — placeholders like “your privacy is important to us” don't help anyone.
1. What we collect
Account data: the email you sign up with, authentication metadata, organization name, and your role in the organization.
Brand Profile inputs: the answers to the onboarding wizard, voice samples you supply, files you upload, and (later) website content we ingest at your direction.
Generated content: drafts produced by our agents (Brand Brain, Content Studio, SEO Engine, CMO Reporter) and the review actions you take on them — approve, edit, reject, discard.
Operational telemetry: usage events, agent run metadata (tokens, cost, duration), and error reports. Used to keep the Service reliable and to bill correctly.
2. Why we collect it
To deliver the Service: generate marketing drafts on your brand voice, send weekly reports, bill you, support you, and improve reliability. We do not sell your data. We do not use your inputs or outputs to train our own models or anyone else's.
3. Subprocessors we share with
We run on a small set of vendors. Each receives only what is necessary for the specific function it serves.
- Anthropic — generates draft content. Inputs and outputs are transmitted via API. Anthropic does not retain prompts or completions for model training on our plan.
- Supabase — hosts our database, authentication, and file storage. Customer data sits in a multi-tenant Postgres schema with Row-Level Security enforcing tenant isolation.
- Vercel — hosts the web application and runs the scheduled cron jobs.
- Resend — sends the weekly digest emails.
- Stripe — processes payments. We do not store card numbers; Stripe handles all PCI-scope data.
- Sentry — records server errors so we can fix them. Stack traces may include the relevant inputs at the moment of failure.
- PostHog — product analytics (page views, button clicks, agent triggers). Configured to capture events, not content.
We add or remove subprocessors as the Service evolves. Material changes are announced in advance.
4. Retention
We keep your data while your account is active. After cancellation we delete it within 30 days, except where law requires longer retention (for example, billing records). Soft-deleted rows (discarded drafts, archived profiles) remain in the database for recovery and audit but are hidden from the application.
5. Security
We use Row-Level Security at the database layer so a query from one organization can never read or write another organization's rows. Every tenant-table write goes through a session-bound client tied to the authenticated user. Service-role access (admin paths, cron jobs) is limited and audited.
No system is bulletproof. If we detect a breach affecting your data, we will notify you without undue delay and in any case within 72 hours where required by law.
6. Your rights
You can access, export, correct, or delete your data from your account settings, or by emailing privacy@buildsmarter.ai. If you are in a jurisdiction with additional rights (GDPR, CCPA), we will honor those requests within the legally required window.
7. International transfers
We operate primarily in the United States. By using the Service you understand that your data will be processed in the U.S. and in any region our subprocessors operate.
8. Children
The Service is not directed at children under 16 and we do not knowingly collect their data.
9. Changes to this policy
Material changes are announced via email or in-product notice at least 30 days before they take effect.
Contact
Privacy questions and data requests: privacy@buildsmarter.ai.