Security & Data Practices

BrandGen is built for marketing teams handling brand IP. The default posture is: we hold the minimum data we need to generate your images, and we never reuse that data to train models.

What we store

• Uploaded references are stored only within your active session and are not persisted long-term.
• Generated outputs are stored on Supabase storage so you can revisit and re-download them.
• Account metadata (email, OAuth identity) is stored via better-auth for sign-in.

What we do NOT do

• We do not train on your uploads or outputs. Your brand references and generated images are never added to any model training set.
• We do not sell, license, or share your brand assets with third parties.

Compliance

GDPR-aligned data subject rights are honored on request. Email support@getbrandgen.com to request export or deletion of your account data. A Data Processing Addendum (DPA) is available on request for paid customers once the paid tier launches.

Reporting a vulnerability

Disclose suspected security issues privately to support@getbrandgen.com. Please do not exploit issues against production data; we'll respond within one business day.