Privacy Policy

The short version. We collect only what we need to sign you in and to show you your brand’s knowledge: your name, email address and profile picture from Google, plus the brand content you and BrandMoves put into the app. We never sell your data, never use it for advertising, and never read your Gmail, Drive, contacts or calendar.

What BrandMoves Is

BrandMoves (“the Service”) is a home for brand knowledge: each brand’s standards, specifications, approved assets and lessons, which clients, their teams and their AI tools read while they work. It includes this web app and a connector that AI assistants use to read brand knowledge. The Service is provided by Moves and Measures, LLC.

What We Collect

• Your Google account basics. When you sign in with Google, we receive your name, email address, profile picture and Google account identifier. We request only the openid, email and profile permissions.
• Your session. Signing in places a secure, HttpOnly cookie holding a random session identifier. We store only a one-way hash of it, with its expiry and when it was last used.
• Connected AI assistants. When you connect an assistant, such as Claude, we issue it an access token. We store only a one-way hash of the token, the assistant’s name, which brands it may read, and when it was last used.
• Brand knowledge. The content you or BrandMoves add for your brand, and the locations of working files. The files themselves stay in your file storage, such as Dropbox. The Service records where a file is, not the file.
• Your preferences, such as whether you asked to receive product updates.
• Technical data. Our hosting provider records standard request data (IP address, browser type, time, page requested), which we use to keep the Service secure, limit abuse and fix problems.

How We Use Your Data

Your information is used solely to operate the Service: to sign you in, to decide which brands you and your connected assistants may see, to show brand knowledge to you and those assistants, to keep the Service secure, and to contact you about your account or, if you asked, about product updates. We do not sell, share or monetize your personal data. It is never used for advertising or profiling, and neither your data nor your brand’s content is used to train AI models.

Who Can See Your Data

Each brand’s knowledge is private to that brand. People and assistants see a brand only when access to it has been granted, and one brand’s knowledge is never served to another’s. BrandMoves staff can see brands in order to provide the Service.

Google API Services: Limited Use Disclosure

BrandMoves’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access only basic profile information (name, email, profile picture) for the purpose of signing you in. We do not use this data for advertising. We do not allow humans to read it except as needed to provide or improve the Service or as required by law, and we do not share it with third parties except as necessary to provide the Service.

Data Sharing and Disclosure

We do not sell, rent or trade your data. To operate the Service, we use these providers, which process data solely on our behalf:

• Cloudflare hosts the Service and its database, and keeps the request data described above. Their privacy policy is at cloudflare.com/privacypolicy.
• Google provides sign-in. Their privacy policy is at policies.google.com/privacy.
• Dropbox holds working files, where your brand uses it. Their privacy policy is at dropbox.com/privacy.

AI assistants you connect, such as Anthropic’s Claude, receive the brand knowledge you or your team ask them to read, and handle it under their own terms and privacy policies. Beyond this, we do not disclose your data to any other party, except as required by law or to protect the safety and security of our users and the Service.

Data Protection

• All traffic between your browser or assistant and the Service is encrypted using HTTPS/TLS.
• Session identifiers and access tokens are stored only as cryptographic hashes, so a copy of our database would not let anyone sign in as you or act as your assistant.
• Every read is scoped server-side to the brands you or your assistant have been granted.
• Sessions and assistant connections can be revoked at any time.

Data Retention and Deletion

We retain your account information for as long as your account is active. Sessions expire on their own. Brand knowledge keeps its history so that past decisions can be traced, and it belongs to the brand even if you leave it. To close your account, contact daniel@brandmoves.co. We will revoke your sessions and connections and remove or anonymize your personal details within 30 days, except where the law requires us to keep a record. You can also ask for a copy of your information, or for it to be corrected.

Cookies and Local Storage

The Service sets one cookie, the session cookie described above, and uses your browser’s local storage for interface preferences such as light or dark mode. It sets no tracking or advertising cookies.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at the address associated with your account at least 14 days before the changes take effect, and post the updated policy at this URL with a new effective date.

Contact

For privacy questions or data deletion requests, contact daniel@brandmoves.co.