LEGAL
Privacy
Last updated: July 2026
BrandKernel is a guided brand-discovery tool. This policy explains what personal data we collect when you use it, why we collect it, who else touches it, and how you stay in control of it. We have tried to write it the way we talk: plainly.
Who is responsible
The data controller for BrandKernel is the operator named in our Imprint. You can reach us at the email address listed there for any privacy question or request.
What we collect
Account details
When you create an account we store your name, email address, and a one-way hash of your password. We never store your password in readable form. These records live in our application database, hosted by Xano.
Your dialogue
BrandKernel works through a written conversation with Ava. To generate each response, the text of that conversation is sent to Anthropic, the provider of the underlying language model, for processing. Your dialogue and the structured Brand Kernel it produces are also stored in our Xano database so you can leave and return without losing your progress.
Payment
Payments are handled by Paddle, which acts as the merchant of record. Paddle collects the billing information needed to process your purchase and issue an invoice. We do not receive or store your full card details. We only see the result of a transaction (paid or not).
Analytics and tracking
We currently run no analytics, no advertising pixels, and no third-party tracking. We do not build a behavioural profile of you. If that ever changes, this policy will change with it before it takes effect.
Cookies
We set exactly one cookie of our own: an essential authToken cookie that keeps you signed in. It is HttpOnly (it cannot be read by JavaScript in your browser) and it exists purely so the app knows the requests are coming from you. During checkout, Paddle sets its own cookies needed to complete your payment securely.
Because everything we set is strictly necessary to run the service, there is no consent banner: there is nothing non-essential to consent to. We set no marketing or analytics cookies.
How long we keep it
We keep your account and dialogue data for as long as your account is active, so your Brand Kernel is there whenever you return. When you delete your account, we delete your personal data, subject to any records we are legally required to retain (for example, invoice data that tax law requires us to keep for a defined period).
Your rights
Under the GDPR you have the right to access the personal data we hold about you, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable form. You also have the right to lodge a complaint with a data protection authority.
You can delete your account and the personal data attached to it at any time from your account settings. For any other request, email us at the address in our Imprint and we will respond within the timeframe the law requires.
Who processes data for us
We rely on a small set of sub-processors to run BrandKernel. Each handles only the data it needs for its role:
- Anthropic: processes your dialogue to generate Ava’s responses.
- Xano: hosts our application database (your account, dialogue, and Brand Kernel).
- OpenAI: transcribes voice recordings to text when you use the microphone.
- Paddle: processes payments as merchant of record.
- Resend: sends account emails (verification, password reset) and processes your email address for that purpose.
- GitHub: stores encrypted, access-restricted backups of the application database.
- Vercel: hosts and serves the application.
- Upstash: provides the rate-limiting store that briefly processes your account identifier to guard against abuse.
Changes to this policy
If we make a material change to how we handle your data, we will update this page and the date above. Continued use of BrandKernel after a change means you have seen it.