Privacy Policy

1. Who we are

The Service is operated by brander.today, based in Israel. We are the controller of the personal information described here. You can reach us at support@brander.today.

2. Information we collect

Information you give us

• Account details: your email address, and your name and profile picture if you sign in with Google.
• Business information: your brand kit (business name, industry, description, website, audience, tone, colors, logo), your current-campaign brief, and business events you add.
• Files you upload: documents (PDF, Word, text) and images. We extract the text of documents so our script writer can use your real products and wording; images are re-encoded and stored as visual references.
• Payments and support: records of payments and plan changes, and anything you send us.

Information from services you connect

• Google sign-in: your Google account email, name and profile picture.
• YouTube: your channel ID and title, the videos we upload for you, and analytics for those videos (views, watch time, retention, shares).
• Calendars (Google, Outlook, iCloud): the names and dates of upcoming events on the calendar you choose.

Information collected automatically

• Security and session data: IP address, browser user agent, sign-in times and an audit log of security-relevant actions.
• Usage of the Service: the campaigns and videos you create, and the AI processing they used (for billing and limits).

3. How we use information

• To provide the Service: write scripts, generate visuals and voice-overs, render videos, and publish them to your YouTube channel when you ask us to.
• To plan campaigns around your calendar events, if you turn calendar automation on.
• To show you performance analytics and improve future scripts for your account (for example, learning which hooks keep viewers watching).
• To operate accounts, enforce plan limits, bill and keep records, provide support, and keep the Service secure and prevent abuse.
• To comply with the law.

We do not sell your personal information, and we do not use it to serve advertising.

4. Google, YouTube and Google Calendar data

The Service uses YouTube API Services. When you connect YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

What we access and why

• Sign in with Google (openid, email, profile): to create and secure your account.
• YouTube upload (youtube.upload): to upload the videos you create, only when you publish one or turn on automatic publishing.
• YouTube read-only (youtube.readonly): to identify your channel and confirm uploaded videos still exist.
• YouTube Analytics read-only (yt-analytics.readonly): to show performance for videos we uploaded for you and improve future scripts for your account.
• Google Calendar read-only (calendar.readonly): to read the names and dates of upcoming events on the one calendar you choose. We never create, change or delete calendar events.

How we store, share and protect it

• OAuth tokens are encrypted at rest and used only by our servers. We never see your Google password.
• We store your channel ID and title, the IDs of videos we uploaded, their analytics, and imported event names and dates. We re-check that we are still authorized at least every 30 days and stop collecting if access was removed.
• We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. People at brander.today do not read it, except with your permission, for security, or where the law requires.
• We share Google user data only with the service providers needed to run the Service (section 7), under confidentiality and data-protection obligations.

Limited Use. brander.today's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access

You can disconnect YouTube or Google Calendar at any time in Settings; we revoke the token immediately and delete the stored data for that connection within 7 days. You can also remove our access from your Google account's security settings at security.google.com/settings/security/permissions; we then delete the related data within 30 days.

5. Outlook and iCloud calendars

• Outlook / Microsoft 365: with your permission (Microsoft Graph Calendars.Read, User.Read) we read the names and dates of upcoming events on the calendar you choose. Remove access in Settings or in your Microsoft account.
• iCloud: Apple doesn't offer app sign-in for calendars, so you give us an Apple app-specific password. It is encrypted at rest and used only to read events (read-only CalDAV). You can delete it in Settings or revoke it at account.apple.com at any time.

6. AI processing

To make your videos, we send the relevant parts of your business information, campaign brief, document excerpts and calendar event names to the AI providers listed below. They process it to return scripts, images, video clips and voice-overs for your account. We do not allow them to use your content to train their models where their terms give us that choice, and we choose providers whose business terms limit use of API data. AI output can be inaccurate; you are responsible for reviewing videos before they are published (see the Terms).

Voice-overs are made by default with Kokoro, an open-source voice model that runs on our own servers, so your narration doesn't leave our systems. If it is unavailable, we use one of the voice providers listed in section 7 instead.

Google Gemini

We may use Google's Gemini API to record voice-overs, which means the narration lines of your ad are sent to Google. On Google's paid Gemini service, Google processes them only to return the audio. On Google's free Gemini tier, Google may use the text we send and the audio it returns to provide, improve and develop its products and machine-learning technologies, and human reviewers may read them; Google's handling is described in the Gemini API Additional Terms and the Google Privacy Policy. We use the free tier only for our own internal testing, never for customers' videos. We never send your Google account data (YouTube or Google Calendar data) to Gemini's free tier.

7. Who we share information with

We share information only as needed to run the Service, with providers acting on our instructions:

• Anthropic (script writing); OpenAI, Google (Gemini) or OpenRouter and the voice model it routes to (voice-over, when our self-hosted voice model is unavailable); Higgsfield (image and video generation).
• Google / YouTube, Microsoft, Apple: when you connect them, to upload videos and read calendars.
• Hosting, email and payment providers that operate our infrastructure, send sign-in emails and process payments.
• Authorities or others when the law requires it, to protect rights and safety, or as part of a merger or sale of the business (with notice to you).

Videos you publish to YouTube become visible according to the privacy setting you choose (private, unlisted or public).

8. Cookies and similar technologies

We use only strictly necessary cookies: a session cookie that keeps you signed in, a CSRF cookie that protects forms, and a short-lived cookie that secures sign-in with Google, YouTube or calendars. We do not use advertising or third-party analytics trackers, and no third party serves content or ads through the Service.

9. Retention and deletion

• We keep your account data while your account is open.
• You can delete your account in Settings → Privacy & data. We revoke connected Google access and delete your brand kit, files, campaigns, videos, events and connections immediately, and in any case within 7 days.
• Payment records are kept without your name or email for as long as tax and accounting law requires.
• Security logs are kept for up to 12 months.
• Videos already published to YouTube stay on your channel until you remove them there.

10. Security

We encrypt OAuth tokens and passwords for connected services at rest, use HTTPS everywhere, protect admin access with two-factor authentication, and limit access to production systems. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

11. Your rights and choices

Depending on where you live (including under Israel's Protection of Privacy Law, the GDPR and US state laws), you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. Most of this you can do yourself in the app; for anything else email support@brander.today and we will respond within 30 days. You may also complain to your local data protection authority (in Israel, the Privacy Protection Authority).

12. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

13. International transfers

Our providers may process information outside Israel, including in the United States and the European Union. Where required, we rely on appropriate safeguards such as standard contractual clauses.

14. Changes to this policy

If we change this policy, we will update the date above. If the change is material, or if we start using your data in a new way, we will ask you to review and accept the new version the next time you sign in.

15. Contact

brander.today, Israel · support@brander.today