Skip to content
● New: team templates. Start a loop from the gallery and decide round by round. See how it works →
Branddock
Book a demo (opens in a new tab)
Security & GDPR

Your brand data, taken seriously

Your database is in Frankfurt (EU). Branddock encrypts what is sensitive and is open about which services we use, and what for.

Database in Frankfurt (EU)

The application runs on Vercel in the Frankfurt region. The database runs at Neon, also in Frankfurt.

Encryption

All traffic runs over TLS (HSTS, 2 years, preload). Connected OAuth tokens (such as ad accounts) are stored encrypted with a separate key, kept apart from the database credentials.

Hardening

A strict Content Security Policy, security headers on every response, input sanitisation and file validation. Payments never touch our servers: they run entirely through Paddle, our merchant of record.

Your brand DNA stays yours

Your brand data is used to generate your content, not to train third-party models. AI requests run server-side; your browser never talks to AI providers directly.

Access and roles

Multi-tenant isolation per organisation and workspace, with four roles (owner, admin, member, viewer). Sessions and authentication through a modern, open-source auth framework.

GDPR principles

  • Branddock (a product of Better Brands (sole proprietorship, Chamber of Commerce no. 75832208)) processes personal data as a processor for your workspace data and as a controller for account and billing data and for recording consent for photos of people.
  • You can export your workspace. You can delete a workspace in the app, except your last workspace and a workspace with an active subscription; its brand data is then removed from the active database. We delete your account on request.
  • A data processing agreement (DPA) is available for business customers; get in touch at hello@branddock.app.
  • Questions, or reporting a data breach? Email hello@branddock.app.

Sub-processors and other services

Which services Branddock uses, what is sent to them and where. AI requests only contain the context needed for your generation and always run server-side.

Sub-processors

Services that process your workspace data to deliver Branddock.

  • Vercel
    What is sent:
    Every request to the app and the site.
    Purpose:
    Hosting and CDN
    Region:
    EU (Frankfurt) · global CDN
  • Neon
    What is sent:
    All your workspace data.
    Purpose:
    PostgreSQL database
    Region:
    EU (Frankfurt)
  • Cloudflare
    What is sent:
    Files you upload and images Branddock generates.
    Purpose:
    File storage (R2)
    Region:
    EU (EU jurisdiction)
  • Anthropic
    What is sent:
    The brand context and prompt needed for a generation; for agents and loops you start yourself, and for a question to the Brand Assistant about your figures, also data from your connected services, without the email addresses and phone numbers of your contacts.
    Purpose:
    AI text generation (Claude)
    Region:
    US · server-side
  • OpenAI
    What is sent:
    The brand context and prompt needed for a generation; for agents and loops you start yourself, and for the Brand Assistant, also text made from data from your connected services, without the email addresses and phone numbers of your contacts.
    Purpose:
    AI text generation, images and embeddings
    Region:
    US · server-side
  • Google
    What is sent:
    The brand context, prompt and images needed for an analysis or image; for agents and loops you start yourself, and for the Brand Assistant, also text made from data from your connected services, without the email addresses and phone numbers of your contacts.
    Purpose:
    AI analysis and images (Gemini)
    Region:
    US/EU · server-side
  • fal.ai
    What is sent:
    The image or video prompt and any reference images.
    Purpose:
    AI image and video generation
    Region:
    US · server-side
  • ElevenLabs
    What is sent:
    The text to be voiced.
    Purpose:
    Text-to-speech (brand voices)
    Region:
    US · server-side
  • Stripe
    What is sent:
    Your organisation's billing and payment details from the period up to October 2026, when payments ran through Stripe.
    Purpose:
    Payments and invoicing up to October 2026 (stored only)
    Region:
    EU entity, global
  • Emailit
    What is sent:
    Email addresses and the content of emails Branddock sends.
    Purpose:
    Transactional email
    Region:
    EU (Prague, according to Emailit)
  • Sentry
    What is sent:
    Error reports with technical context, without the content of your brand data.
    Purpose:
    Error monitoring
    Region:
    To be confirmed
  • PostHog
    What is sent:
    Usage events in the app (which page, which button, with the text of what you click), linked to your email address, name, workspace and organisation, and error reports from your browser.
    Purpose:
    Product analytics in the app
    Region:
    EU cloud
  • Exa
    What is sent:
    Search queries from agents, and from the competitor finder with your brand name, industry and product names.
    Purpose:
    Web research for agents, trends, knowledge research and landing page statistics
    Region:
    US · server-side
  • Semantic Scholar
    What is sent:
    Queries for scientific sources.
    Purpose:
    Research sources for agents
    Region:
    US · server-side
  • DiceBear
    What is sent:
    A persona's name, age, occupation and location, as the seed for an avatar (only when generating the image with AI fails).
    Purpose:
    Fallback avatar for personas
    Region:
    Germany (operator) · global CDN

Services when you visit the site

What your browser loads when you visit branddock.app or a page published through Branddock.

  • Adobe Fonts
    What is sent:
    Your IP address, when your browser loads the font.
    Purpose:
    The site font (Halyard, via Typekit)
    Region:
    To be confirmed
  • Adobe Fonts (brand fonts)
    What is sent:
    The visitor's IP address and the hostname of the page that loads the font; with a connection, also the names of your brand fonts and the name of the web project.
    Purpose:
    Showing a workspace's brand fonts, if you enter an Adobe Fonts kit ID or connect Adobe Fonts
    Region:
    To be confirmed
  • Google Analytics
    What is sent:
    Site visit data, only after your consent.
    Purpose:
    Visitor statistics
    Region:
    To be confirmed
  • PostHog
    What is sent:
    Page visits and clicks on the site, only after your consent. On pages published through Branddock always, without asking for consent.
    Purpose:
    Site analytics
    Region:
    EU cloud
  • Sentry
    What is sent:
    Error reports from your browser, whether your visit ran without errors, and load times for 10% of visits.
    Purpose:
    Error monitoring
    Region:
    To be confirmed

Seller of your subscription

Not a sub-processor of Branddock: the seller processes your buyer data itself, as a controller.

  • Paddle: As the seller (merchant of record) of your subscription and credits, Paddle processes your order, payment and invoice details under its own privacy notice. Paddle privacy notice

Connections you switch on

Services you connect yourself. You choose them and grant access; they are not Branddock's sub-processors.

  • Google Search Console, Google Analytics 4, Google Ads: Branddock reads your figures when you connect them.
  • Meta (Facebook, Instagram): Publishing and ad data, when you connect it.
  • X: Publishing to your own channel.
  • WordPress, Postiz, Resend: Publishing through your own site or account, with your own key.
  • Semrush and other SEO services (Ahrefs, AlsoAsked, SE Ranking, DataForSEO, Serpstat, Rank Tracker, SerpApi, Supermetrics, Similarweb, Bitly): Keyword, ranking, link and traffic figures, when you connect the service. Agents request them with your account or key.
  • Shopify: Your shop's public product data, when you connect the shop.
  • HubSpot: Contacts and deals, when you connect HubSpot. Agents and the Brand Assistant read only a contact's first name, company, job title and stage, and only for a task you give them. One exception: the Customer Questions Analyst also reads the text of notes, to collect your customers' questions; we remove email addresses and phone numbers from it first. We keep a copy of your contacts and deals (HubSpot) or your campaigns and flows (Klaviyo), for at most 90 days. When you disconnect the service, we delete that copy and the access.
  • Zoho CRM: Leads, contacts and deals, when you connect Zoho. Agents and the Brand Assistant read only a contact's first name, company, job title and stage, and only for a task you give them. We keep nothing from the service, except the weekly counts of a loop you start yourself. When you disconnect it, we delete the access.
  • Pipedrive: People, organisations and deals, when you connect Pipedrive. Agents and the Brand Assistant read only a person's first name and organisation, and only for a task you give them. We keep nothing from the service. When you disconnect it, we delete the access.
  • ActiveCampaign: Contacts, deals and email campaigns, when you connect ActiveCampaign. Agents and the Brand Assistant read only a contact's first name and organisation, and only for a task you give them.
  • Klaviyo: Campaigns, flows, lists and their figures, when you connect Klaviyo. Agents and the Brand Assistant do not read individual profiles, and only read for a task you give them. We keep a copy of your contacts and deals (HubSpot) or your campaigns and flows (Klaviyo), for at most 90 days. When you disconnect the service, we delete that copy and the access.
  • MailerLite: Campaigns, segments, automations and their figures, when you connect MailerLite. Agents and the Brand Assistant do not read individual subscribers, and only read for a task you give them.
  • Customer.io: Campaigns, segments and their figures, when you connect Customer.io. Agents and the Brand Assistant do not read individual people, and only read for a task you give them.
  • Intercom: Help articles and conversations with your customers, when you connect Intercom. Agents and the Brand Assistant read the title and text of your help articles, and the subject, status, dates and text of conversations, and only for a task you give them. Agents and the Brand Assistant read all conversations of the connected Intercom account. They also read internal notes on a conversation. They do not read who wrote a message or contact details; we remove email addresses, phone numbers, bank account numbers and citizen service numbers from the text, but names in the text stay. We keep no copy of what we read; what the assistant answers stays in the conversation. Intercom has no read-only access: the connector could also write, but Branddock only reads.
  • Calendly: Event types and booked meetings, when you connect Calendly. Agents and the Brand Assistant read the name, duration and description of your event types, and the times, status and name of booked meetings and how many invitees there are, and the name, time zone and rules of your availability schedules, and only for a task you give them. A meeting's name often contains an invitee's name; it stays. They do not read the list of invitees or their answers. We keep no copy of what we read; what the assistant answers stays in the conversation. Calendly has no read-only access: the connector could also write, but Branddock only reads.
  • Asana, Slack, MCP-servers: Tasks, contacts or messages, when you connect them.

Last updated: October 2026. We publish changes to this list on this page; the date above shows when the list was last updated. If you have a data processing agreement with us, we notify you of a new sub-processor by email in advance, so you can object.

Try for free Privacy statement