Privacy Policy

1. Who we are

1.1 Lordsway Energy Limited, a private company limited by shares registered in Nigeria, of 8 Venia Place, Lekki Phase 1, Lagos, Nigeria, is the data controller for the personal data described in this policy.

1.2 This policy covers Brandosse at brandosse.com and its related services (the “Service”). Terms defined in our Terms of Service have the same meaning here.

1.3 We have not appointed a Data Protection Officer. Our privacy contact, privacy@brandosse.com, is responsible for handling all data protection enquiries and requests.

2. What we collect

2.1 What you give us

2.2 Generated for you

Captions, images, videos, content plans, schedules, scores and analyses produced by the Service, plus the generation history and credit ledger showing what ran and what it cost.

2.3 Connected social accounts

When you connect a social account we store the access and refresh tokens, the account identifier and handle, the platform, and the connection status. We store tokens to act on your instruction and hold them only while the connection is live.

2.4 Collected automatically

2.5 Payment data

Card details go directly to our payment processor and are never stored on our systems. We keep the transaction record: amount, currency, status, timestamp, package purchased, and the processor’s customer and transaction identifiers.

2.6 Cached Source Material

If you paste a link, the media retrieved from it is stored in a private cache bucket while your job runs and for 24 hours after the job reaches a final state. That media may contain personal data of people appearing in it — see section 2.7.

2.7 Personal data of other people

Your Content may contain personal data about others — clients, staff, people in photos, followers. Where it does, you are the controller and we act on your instruction. You are responsible for having a lawful basis, giving those people notice, and obtaining any consent or release required. If you use Brandosse to manage social accounts on behalf of your own clients, a Data Processing Agreement is available on request from privacy@brandosse.com.

3. How we use it, and our legal basis

Where we rely on legitimate interests, we have weighed them against your rights and will explain the assessment on request.

4. Who we share it with

4.1 We share personal data only with the processors named in our Subprocessors list, which forms part of this policy. That list names each provider, what it receives, and what it is used for. The categories are:

• Infrastructure — application hosting, database, file storage, video processing.
• AI model providers — receive your prompts, brand kit text, and reference or source images and video needed to generate Output.
• Publishing provider — receives the post content, media and connected account authorisation needed to publish.
• Email provider — receives your email address and the message content.
• Error monitoring — receives technical diagnostics, which may incidentally include identifiers.
• Payment processor — receives payment and billing details directly.

4.2 We also disclose data where legally required, to enforce our Terms, to protect rights and safety, and to a successor in a merger or acquisition — we will tell you first.

4.3 We do not sell personal data and we do not share it for cross-context behavioural advertising.

4.4 Who can see and delete your content

Two categories of person can reach your content beyond you, and you should know about both.

Brandosse staff. A small number of our administrators can access user accounts and content through an internal admin console, and can delete content — including content generated through the Service. We do this only to operate the Service: to investigate a fault you have reported, to respond to a legal request, to enforce the Acceptable Use Policy, or to action a deletion you asked for. Access is limited to staff who need it, and we do not browse user content for any other reason.

Your workspace administrators. If you belong to an organisation workspace, the administrators of that workspace can see and delete content created inside it by any member, including content you created. If your employer or client owns the workspace, they — not you — control that content. If you are unsure who administers your workspace, ask them before putting personal material into it.

5. AI processing — read this one

5.1 To generate content, the Service transmits to third-party model providers your prompt text, relevant brand kit content, and any reference image, uploaded media or retrieved Source Material the request needs.

5.2 We do not train any model on your content, prompts or Output, and we do not sell, license or otherwise make them available to anyone for training.

5.3 Your content is transmitted to the AI providers named in our Subprocessors list solely to generate your Output. We can only pass on what those providers commit to, so we state each position rather than making a single blanket promise. Positions verified against their published terms on 25 August 2026:

• Anthropic — contractually undertakes not to train on commercial API inputs or outputs, and deletes them within 30 days.
• Groq — contractually prohibited from using inputs or outputs for training or fine-tuning; does not retain inference inputs and outputs by default.
• fal.ai — its published privacy policy does not address model training, and we have not obtained written confirmation. Until we have, you should not assume any training restriction applies to material sent to image, video, editing or upscaling features. Generated media is held on fal.ai’s CDN for a minimum of 7 days.

5.4 We will update this section, and the Subprocessors list, if any of these positions changes. Model providers apply their own retention; where a provider offers zero- or limited-retention terms we use them, and where it does not, we say so in the Subprocessors list.

6. International transfers

6.1 We are established in Nigeria and our infrastructure runs in Europe. Where your data physically sits depends on which part of the Service you use:

6.2 The United Kingdom is not part of the European Union. If you are in the EEA, your video source material is therefore transferred to a third country. The UK holds a European Commission adequacy decision, and that is the basis we rely on for that transfer.

6.3 For transfers to Nigeria and to providers outside the EEA and UK, we rely on Standard Contractual Clauses and on the transfer mechanisms available under the Nigeria Data Protection Act 2023, and we require every processor to apply appropriate safeguards under contract.

7. How long we keep it

8. Your rights

8.1 Depending on where you live you may have the right to access your data; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent; and not be subject to solely automated decisions with legal or similarly significant effects.

8.2 How to exercise them. Use Settings → Data and Privacy in the Service to request an export or account deletion, or email privacy@brandosse.com.

8.3 How the request is handled. Stated plainly: export and deletion are currently request-based and fulfilled manually by our team, not automated. When you submit a request we record it, acknowledge it within 72 hours, and complete it within 30 days. We will confirm by email when it is done.

8.4 Complaints. If you are in Nigeria, you may complain to the Nigeria Data Protection Commission (NDPC). If you are in the EEA or UK, you may complain to your local supervisory authority. You may always complain to us first at privacy@brandosse.com.

9. Security

9.1 We use encryption in transit, hashed credentials, row-level access control that isolates each workspace, scoped API keys held server-side, signed webhooks, and private storage buckets.

9.2 No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the relevant authority as the law requires.

9.3 Report a vulnerability to security@brandosse.com.

10. Cookies

We set only what the Service needs to function:

We currently run no analytics, advertising or third-party tracking cookies — verified against the codebase on 25 August 2026. If that changes, we will update this policy and ask for consent where required before setting them.

11. Children

The Service is not for anyone under 18. We do not knowingly collect their data. If you believe a child has given us data, contact privacy@brandosse.com and we will delete it.

12. Changes to this policy

We will post updates here with a new effective date, and give notice by email or in-product notice for material changes.

13. Contact