BrandForge
Legal — Privacy Policy

BrandForge AI Privacy Policy

Effective date: 1 October 2026

Who we are: Oliver Schuetz, trading as AUTONYX, ABN 91 707 693 060, Cairns, Queensland, Australia ("AUTONYX", "we", "us"). We operate BrandForge AI at getbrandforge.ai.

This policy explains what personal information we collect, why, who we share it with, where it goes, how long we keep it, and how you can access, correct or delete it. It follows the structure of the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. Does the Privacy Act apply to us?

Small businesses with annual turnover of AUD 3 million or less are generally not covered by the Privacy Act unless an exception applies. We are currently under that threshold and no exception applies to how we run BrandForge AI. We have chosen to follow the Australian Privacy Principles anyway, because it is the right way to treat your information and because we expect to be covered as we grow.

2. What we collect

  • Email address and password. Where it comes from: You, at sign-up. The password is stored by our login provider Clerk as a hash. We never see the plain password.. Why we need it: To create and secure your account and to contact you about the service..
  • Logo image(s) you upload. Where it comes from: You. Why we need it: To generate your brand book..
  • Questionnaire answers: brand name, industry, colours, fonts, contact details and any other text you type. Where it comes from: You. Why we need it: To generate your brand book..
  • Generated brand books and share-link settings (including any password you set on a link). Where it comes from: Created by the service from your inputs. Why we need it: So you can view, download, regenerate and share your brand book..
  • Stripe customer ID, plan, payment status and receipts. Where it comes from: Stripe, when you pay. Why we need it: To manage your subscription and refunds, and to meet tax and record-keeping obligations. We do not receive or store your full card number..
  • Technical data: IP address, browser type, request logs, login session. Where it comes from: Automatically, when you use the service. Why we need it: To keep the service secure, apply rate limits, and fix problems..
  • Support emails. Where it comes from: You, when you contact us. Why we need it: To answer you and keep a record of the request..

We only ask for what we need to run BrandForge AI. You can use a business email rather than a personal one. The contact details you put in the questionnaire are whatever you choose to type; please do not type other people's personal details unless you have their permission.

We do not collect sensitive information (such as health, religion or biometric data) and ask you not to upload it.

3. Why we use your information

We use your information to:

  • provide BrandForge AI to you, including generating brand books;
  • process payments and refunds;
  • send you service emails (receipts, security notices, changes to terms, responses to your requests);
  • keep the service secure and prevent abuse;
  • comply with legal obligations (tax, record-keeping, responding to lawful requests);
  • send you marketing emails only if you have opted in (section 11).

We do not sell your personal information. We do not use your logo or brand book to promote BrandForge AI unless you separately agree.

4. AI processing

To generate a brand book we send your logo, your questionnaire answers and related instructions to Anthropic, our AI model provider in the United States. Anthropic processes that data to return the generated text. Under Anthropic's commercial API terms, our inputs and the generated output are not used to train Anthropic's models. Anthropic may retain API data for a limited period to detect misuse, after which it is deleted.

5. Who we share your information with

We share personal information only with providers we need to run the service, and only to the extent needed:

  • Clerk. What they do for us: Login and account security. Data they handle: Email, password hash, session data. Where: United States.
  • Supabase. What they do for us: Database and file storage. Data they handle: Account data, logos, questionnaire answers, brand books. Where: Sydney, Australia (AWS ap-southeast-2).
  • Stripe. What they do for us: Payments and subscriptions. Data they handle: Email, payment details, billing records. Where: United States (and Stripe's global infrastructure).
  • Anthropic. What they do for us: AI generation. Data they handle: Logo, questionnaire answers, generated text. Where: United States.
  • Upstash. What they do for us: Rate limiting. Data they handle: IP address or account identifier, request counts. Where: Sydney, Australia (AWS ap-southeast-2).
  • Vercel. What they do for us: Website hosting. Data they handle: Request logs including IP address. Where: United States (and Vercel's global edge network).

We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer or successor of the BrandForge AI business (in which case this policy will continue to apply to your information).

We do not share your information with advertisers or data brokers.

6. Overseas disclosure

Most of our providers are in the United States, so your information will be stored or processed there and possibly in other countries where those providers operate. Before we use an overseas provider we take reasonable steps to make sure it protects personal information to a standard comparable to Australian law, including choosing providers that offer contractual data-protection commitments and security certifications. Laws in those countries may differ from Australian law, and by using BrandForge AI you acknowledge this.

7. Security

We take reasonable steps to protect your information: encrypted connections (HTTPS), hashed passwords held by Clerk, access controls on our database, optional password protection on share links, and rate limiting. No internet service is perfectly secure. Choose a strong password and be careful who you share links with.

8. How long we keep your information

  • Account, logos, questionnaire answers and brand books: for as long as your account is open. After you delete your account (or ask us to), we delete this data within 30 days, except for backups that are overwritten in the normal course.
  • Payment records: we keep the records we need for tax and accounting purposes for the period the law requires (generally several years), even after your account is closed.
  • Support emails: 2 years.
  • Technical logs: up to 30 days.

9. Cookies and analytics

We use only the cookies our login provider Clerk needs to keep you signed in and keep your session secure. We do not use advertising cookies, tracking pixels or third-party analytics. If this changes, we will update this policy and, where required, ask for your consent first.

10. Share links

If you create a share link, anyone with the link (and the password, if you set one) can view that brand book, including any contact details you typed into the questionnaire. Only share links with people you trust. You can disable a link at any time from your account.

11. Marketing emails

We will only send you marketing emails if you have expressly opted in. Every marketing email will identify us and include a working unsubscribe link. We action unsubscribe requests within 5 business days. Service emails (receipts, security notices, changes to terms) are not marketing and you will receive them while you have an account.

12. Access, correction and deletion

You can:

  • update your email and password in your account settings;
  • view, download and delete your brand books in your account;
  • ask us for a copy of the personal information we hold about you;
  • ask us to correct information that is inaccurate or out of date;
  • ask us to delete your account and your data.

Email support@getbrandforge.ai from the address on your account. We will respond within 3 business days and usually complete requests within 30 days. We will not charge you for a reasonable request. If we cannot do what you ask (for example, because we must keep payment records), we will tell you why.

13. If something goes wrong (data breaches)

If we become aware of a data breach that is likely to cause serious harm to you, we will tell you and, where required, the Office of the Australian Information Commissioner (OAIC) as soon as practicable, with what happened and what you can do about it.

14. Complaints

If you think we have mishandled your information, email support@getbrandforge.ai. We will acknowledge within 3 business days and aim to resolve the complaint within 30 days. If you are not satisfied, you can contact the OAIC at www.oaic.gov.au.

15. Visitors outside Australia

BrandForge AI is operated from Australia and your information is handled under Australian law as described above. If you live elsewhere you may have additional rights under your local law. In particular:

  • If you are in the European Economic Area, the United Kingdom or Switzerland: we handle your information because it is necessary to provide the service you asked for (our contract with you), to meet legal obligations, or for our legitimate interest in running a secure service. You may have the right to access, correct, delete, restrict or object to our use of your information, to receive a copy in a portable format, and to complain to your local data protection authority. Your information is transferred to Australia and the United States as described in sections 5 and 6. Where required, we rely on the transfer being necessary to perform our contract with you.
  • If you are in California or another US state with a privacy law: we do not sell or share your personal information for advertising. You may have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights.

To exercise any of these rights, email support@getbrandforge.ai. We treat all requests the same way regardless of where you live.

16. Children

BrandForge AI is for adults and businesses. We do not knowingly collect information from anyone under 18. If you think we have, email support@getbrandforge.ai and we will delete it.

17. Changes to this policy

We may update this policy. We will post the new version with a new date and, for material changes, email account holders before the change takes effect.

18. Contact

Oliver Schuetz trading as AUTONYX ABN 91 707 693 060 Cairns, Queensland, Australia, Cairns QLD, Australia Email: support@getbrandforge.ai