Privacy policy

Who we are

brands.menu is operated by Almas Ousadas Unipessoal LDA, Lisbon, Portugal. For anything about your data, email lauri.enckell@gmail.com (contact person: Lauri Enckell). We are the controller for your account data and act on your instructions for the brand content you put on a canvas.

What we collect

Your account

• Your name, email address and profile picture from Google when you sign in. We do not get your Google password or access to your Gmail, Drive or contacts.
• Which brands you belong to and your role on each (owner, editor, viewer), and invitations you send.
• If you buy credits or a plan: your Stripe customer id, plan and credit balance. Card details stay with Stripe and never reach us.
• Basic usage analytics (pages visited, clicks) to improve the product, and server logs kept for security.

Brand content

• Everything on a canvas: pages, emails, ads, images, versions, comments, approvals, projects and the brand identity (colors, fonts, voice).
• Drafts that you, your team or your AI (Claude, ChatGPT or another MCP client) push to the canvas.

Connected apps (read only)

You choose what to connect, and you can disconnect at any time. brands.menu never changes anything in these apps.

• Website: copies of your public store pages (home, products, collections, about, FAQ). If your store is password protected and you give us the storefront password, we store it encrypted to open the store.
• Shopify: with the scopes read_products, read_content, read_themes, read_online_store_pages and read_files we read product titles and handles, online store pages, theme names and status, the images and files your store uses, and we copy the storefront pages customers see, including unpublished theme previews. We do not request or read customers, orders or payments. Shopify tells us when products or themes change so the canvas stays current.
• Klaviyo: with read access to accounts, campaigns, flows, templates and lists we read your account name, flows and their emails, campaigns from the last 90 days, subject lines, preview text and the email designs. We do not read subscriber profiles, events or metrics.
• Meta: with ads_read, business_management, pages_read_engagement and pages_show_list we read the names of your ad accounts, your ads and their creatives (images, video thumbnails, primary text, headline, call to action, link and placements) and the name and picture of the Facebook page that runs them. We do not read insights about people, audiences, messages or anything outside the ad accounts you pick.
• AI connectors: when you connect Claude or ChatGPT, they reach brands.menu with a token limited to the brands you picked. We store what the AI sends to the canvas. We do not receive your conversations.

How we use it

• To show your brand on the canvas, keep synced items current, and let your team review and approve drafts.
• To give your AI the brand context you approved (identity, live items, comments) through the brands.menu connector.
• To run billing, prevent abuse and keep the service secure.

We do not sell personal data, we do not use it for advertising, and we do not use your brand content or data from Shopify, Klaviyo, Meta or Google to train AI models. Data from Google sign in is used only to identify you. Data from connected platforms is used only to show it to you and the people you invite.

Storage and security

• Access tokens, API keys and storefront passwords are encrypted at rest with AES 256 GCM and are never shown again after you save them.
• Data is stored in a PostgreSQL database run by our hosting provider and travels over HTTPS.
• Brand content is visible only to members of that brand. The public demo brand is the only exception.

Who else processes data

• Replit (hosting and database), Google (sign in), Stripe (payments), PostHog (product analytics).
• Shopify, Klaviyo and Meta, only when you connect them, as the sources of the data described above.
• Anthropic or OpenAI, only when you connect Claude or ChatGPT, receive the brand content your AI asks for.

Some of these providers process data outside the EU. They do so under the European Commission standard contractual clauses or an equivalent safeguard.

How long we keep it

• Brand content is kept while the brand exists. We keep the last 50 saved states of a canvas as an undo history; they are deleted with the brand.
• Disconnecting an app deletes its tokens and settings immediately. Items already on the canvas stay until you delete them or the brand.
• If you uninstall the Shopify app, Shopify notifies us and we stop syncing at once and delete the connection when Shopify asks us to erase shop data.
• Account data is kept until you ask us to delete your account. Billing records are kept as long as tax law requires.

Deleting your data

• One app: open Connected apps and click Disconnect.
• One brand: open Settings, Delete brand. This removes the canvas, every version, comment and image, the connected apps and the team.
• Your whole account: delete your brands, then email lauri.enckell@gmail.com from the address you sign in with. We confirm within 30 days.
• Meta data deletion: remove brands.menu in Facebook, Settings and privacy, Settings, Business integrations, then disconnect Meta in Connected apps or email us. We delete everything we got from Meta within 30 days.
• Shopify: uninstall brands.menu in your Shopify admin, Settings, Apps. We have no customer data from your store, so customer data requests and erasure requests from Shopify need no further action.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to its use, and take it elsewhere. Email lauri.enckell@gmail.com. You can also complain to the Portuguese data protection authority (CNPD) or the authority where you live. We rely on our contract with you to run the service, on your consent for connected apps, and on legitimate interest for security and analytics.

Children

brands.menu is a business tool and is not meant for anyone under 16.

Changes

If we change this policy in a way that matters, we update the date above and tell signed in users in the product.