Privacy policy

Last updated:

Mar 24, 2026

Introduction

Winfluence AB ("we", "our", or "us") operates the Brandwagon tool (https://app.brandwagon.ai/) application ("Application"). This privacy policy outlines how we collect, use, and protect the personal data of our users ("Users"). By using this Application, you consent to the collection and use of data as described.

If you have questions, you can contact us at admin@brandwagon.ai

Data Controller

Winfluence AB

Ringkragevägen 36, 218 73, Tygelsjö, Sweden

admin@brandwagon.ai

Types of Data Collected

We collect the following types of personal data:

• Trackers (cookies or similar technologies)

• Usage Data (e.g., session statistics, number of users)

• IP address and other browser-related information (via analytics services)

• Content and account data uploaded to the Service, including text, images, video, audio, metadata, and user account information

Personal data may either be provided directly by the User or collected automatically.

Mandatory Data

All data requested by the Application is mandatory unless specified otherwise. Refusing to provide such data may prevent us from delivering the Service. If unsure, contact us using the contact details provided in this Privacy Policy.

Cookies and Trackers

Cookies and similar technologies may be used for service functionality, analytics, and security purposes. Users can refer to our Cookie Policy for more details.

Detailed Information on the Processing of Personal Data

Analytics

The services contained in this section enable us to monitor and analyze usage of the Service in order to improve functionality, performance, and security.

Google Analytics 4 (Google LLC)

Google Analytics 4 is a web analysis service provided by Google LLC ("Google"). Google utilizes the Data collected to track and examine the use of this Application, to prepare reports on its activities, and share them with other Google services. Google may use the Data collected to contextualize and personalize the ads of its own advertising network.

In Google Analytics 4, IP addresses are used at collection time and then discarded before Data is logged in any data center or server. Users can learn more by consulting Google's official documentation.

Personal Data processed: number of Users; session statistics; Trackers; Usage Data.

Place of processing: Place of processing: United States and other locations where Google operates — Privacy Policy — Opt Out.

Where personal data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses are used.

PostHog (PostHog Inc.)

PostHog is an analytics service provided by PostHog Inc. It is used to understand user behavior and improve the Application.
PostHog (PostHog Inc.)

PostHog is an analytics service provided by PostHog Inc. It is used to understand user behavior and improve the Application.

Personal Data processed: Usage Data; Trackers; session statistics.

Place of processing: European Union – Privacy Policy.

Where personal data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses are used.

Platform Services and Hosting

These services are used to host and operate the Application and its core infrastructure. They enable the provision of the Service, including user authentication, storage, database management, content processing, analytics, and other functionality required to run the platform.

Some of these services may operate through geographically distributed servers, and personal data may be processed in different locations depending on the service used.

Google OAuth (Google LLC)

Google OAuth is an authentication service provided by Google LLC.

Personal Data processed: account information and authentication data.

Place of processing: United States – Privacy Policy.

Where personal data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses are used.

Supabase (Supabase Inc.)

Supabase provides backend services, including database, authentication, and storage, which are essential for the operation of this Application.

Personal Data processed: account data, uploaded content, and application data.

Place of processing: European Union (EU region) – Privacy Policy.

Tag Management

This type of service helps the Owner to manage the tags or scripts needed on this Application in a centralized fashion. This results in the Users' Data flowing through these services, potentially resulting in the retention of this Data.

Google Tag Manager (Google LLC)

Google Tag Manager is a tag management service provided by Google LLC.

Personal Data processed: Usage Data.

Place of processing: United States –Privacy Policy.

Microsoft Azure (Microsoft Corporation)

Microsoft Azure provides cloud infrastructure used to host and run the Application backend.

Personal Data processed: application data and account data.

Place of processing: European Union (EU region) – Privacy Policy.

Vercel (Vercel Inc.)

Vercel provides hosting and content delivery services used to serve the web application.

Personal Data processed: usage data and technical data.

Place of processing: Global infrastructure, including United States – Privacy Policy.

Where personal data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses are used.

OpenAI (OpenAI, L.L.C.)

OpenAI provides AI services used for content analysis, translation, and automated compliance checks.

Personal Data processed: uploaded content and metadata required for analysis.

Place of processing: United States – Privacy Policy.

Where personal data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses are used.

ElevenLabs (ElevenLabs Inc.)

ElevenLabs provides voice and audio processing features used within the Service.

Personal Data processed: audio data and related metadata.

Place of processing: United States – Privacy Policy.

Where personal data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses are used.

Data Processing and Retention

Methods of Processing

We implement appropriate technical and organizational security measures to protect personal data. Processing is carried out using secure IT systems and may involve authorized personnel and approved third-party service providers, including hosting, infrastructure, analytics, authentication, and AI processing services.

Location of Processing

Personal data is primarily processed within the European Union. Some data may be processed by approved service providers located outside the European Economic Area (EEA). In such cases, appropriate safeguards such as Standard Contractual Clauses are used in accordance with GDPR.

Data Retention

Personal data is retained only as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Data may be deleted upon request or after termination of the Service.

Purposes of Processing

We process personal data for the following purposes:

• Providing and operating the Service
• User authentication and account management
• Hosting, storage, and infrastructure services
• Analytics and usage monitoring
• Content processing, automated analysis, translation, and compliance checks
• Security, fraud prevention, and abuse detection
• Legal compliance and protection of our rights

User Rights (GDPR)

Users have the right to:

Withdraw consent at any time.
Object to data processing on grounds other than consent.
Access their data.
Verify and rectify inaccurate data.
Restrict processing of their data.
Request deletion of their data.
Receive data portability in a structured, machine-readable format.
Lodge complaints with data protection authorities.

Legal Basis for Processing

We may process personal data based on one or more of the following legal bases:

• Consent
• Performance of a contract
• Compliance with legal obligations
• Legitimate interests, such as operating, improving, and securing the Service

Data Transfers Outside the EEA

If personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms in accordance with GDPR.

Legal Action

Personal data may be used for legal purposes by the Provider in court or in the stages leading to possible legal action arising from improper use of the Service or related services.

Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time. Users are encouraged to review this page periodically for any changes. Where required by law, we will notify users of material changes.

If you have any questions about this Privacy Policy or our data processing practices, you may contact:

Winfluence AB
Ringkragevägen 36
218 73 Tygelsjö
Sweden

Email: admin@brandwagon.ai