Privacy Policy

We collect the following categories of information:

• Account information. When you sign in, our authentication provider (Supabase Auth) processes your email address and, if you sign in with Google, your name, profile picture, and Google account identifier.
• Content you provide. Information you submit to generate a playbook — such as your product, audience, links, and the community or engagement data you choose to connect.
• Usage data. Standard technical data such as device, browser, IP address, and interactions with the Service, used to operate and improve it.

• Provide, maintain, and improve the Service.
• Authenticate you and keep your account secure.
• Generate the playbooks and insights you request.
• Communicate with you about your account and product updates.
• Detect, prevent, and address fraud, abuse, or technical issues.

We do not sell your personal information, and we do not use the content you connect to train third-party foundation models.

We share information with vendors who process it on our behalf, under contract, only to operate the Service:

• Supabase — authentication, session management, and database hosting of your account and product data.
• Google — sign-in, when you choose to log in with Google.
• LLM providers — to generate playbooks from the inputs you provide.
• Resend — transactional email delivery.
• Postiz — publishing posts to the social accounts you connect, and storing any media you attach to a draft.
• Sentry — error and performance monitoring, which records diagnostic data about failed requests including your IP address.

We use strictly necessary cookies to keep you signed in and to operate the Service. We do not use third-party advertising cookies.

We retain your information for as long as your account is active or as needed to provide the Service. You can request deletion of your account and associated data at any time (see “Your rights” below), after which we delete or anonymize it except where retention is required by law.

We use industry-standard measures — encryption in transit, access controls, and reputable infrastructure providers — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, email us at hello@bravestep.ai.

We may process and store information in countries other than your own. Where required, we put appropriate safeguards in place for such transfers.

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

We may update this policy from time to time. Material changes will be posted on this page with an updated “Last updated” date.