Privacy Policy

Brandlio ("Brandlio," "we," "us," or "our") is a software platform developed and operated by Metrics Masters Solutions LLC, a limited liability company registered in Wyoming, United States. Brandlio provides AI-powered business intelligence, automation, and related software services, including the Brandlio app at brandlio.io, Brandlio MCP at mcp.brandlio.io, and the Brandlio agent (together, the "Service").

For the purposes of this Privacy Policy, references to "Brandlio," "we," "us," or "our" refer to Metrics Masters Solutions LLC in connection with its operation of the Brandlio platform. Metrics Masters Solutions LLC is responsible for processing personal information where it acts as the data controller.

• Privacy contact: support@brandlio.io
• Website: brandlio.io

This Policy explains what we collect, how we use and share it, and the choices you have. By using the Service, you agree to it.

Platform trademarks and independence. Brandlio is an independent product. It is not affiliated with, endorsed by, or sponsored by Google LLC, Meta Platforms, Inc., Microsoft Corporation, Amazon.com, Inc., or any other platform named in this Policy. Product names, logos, and brands belong to their owners. Each platform you connect remains subject to its own terms and privacy policy.

Information you give us

• Account information: your name, email address, organization and brand details, password (stored hashed), and preferences.
• Billing information: company name, billing address, and contact details. Card payments are processed by our payment processor, Stripe; we do not store full card numbers.
• Messages and content: messages you send to the Brandlio agent and other AI features, files you upload, information you provide about your brands, and notes the Service saves as memory for your organization.
• Support communications: messages, requests, and feedback you send us.

Information from connected platforms. When you connect a platform, we access the data needed for the features you use, as listed in section 3. We store each platform's access tokens encrypted.

Requests from AI applications you connect. When an AI application you connect to Brandlio MCP (such as Claude, ChatGPT, or Cursor) uses the Service, we record its requests — which tools it used, their inputs, and whether they succeeded — to run the Service, show your activity history, and measure plan usage.

Information collected automatically

• Log data: IP address, device and browser type, operating system, and access times.
• Usage data: features used, pages visited, and interactions with the Service.
• Technical data: error logs, performance data, and diagnostics.
• Approximate location: country or region, derived from your IP address.

We connect only the platforms you choose. We access the data below to provide the features you use, and we change a platform only when you approve the change (Terms, section 5). When you connect, we also receive your own name and email from some platforms (Google, Amazon, LinkedIn, Meta, Pinterest).

Your customers' personal information. Some platforms hold personal information about your customers — for example Shopify and WooCommerce customers, Meta lead forms, Stripe charges, Business Profile reviewers, or Calendar attendees. We process it only on your behalf and to provide the features you use. You are responsible for having a lawful basis to share it with us.

Access tokens. Each platform issues access tokens when you connect. We store them encrypted and use them only to perform the operations you authorize.

• Provide the Service: connect your accounts, show your data, and keep you signed in.
• Run AI features: analyze your data and produce answers, reports, drafts, and images (see section 5).
• Prepare and apply changes you approve: for example campaigns, budgets, bids, keywords, product listings, or files — only after you or your team confirm them, or under an auto-approval you switched on.
• Reports and alerts: scheduled reports and alerts about notable changes in your accounts.
• Billing and plan limits: process payments and measure data pulls and write actions against your plan.
• Security: verify identity, prevent fraud and abuse, and protect accounts.
• Communication: operational emails such as sign-in, verification, billing, alerts, and service updates; product news only where allowed, and you can opt out at any time.
• Support and improvement: fix problems and improve the Service using aggregated, de-identified usage data.
• Legal compliance: meet legal obligations and enforce our Terms.

We do not sell your personal information or your connected platform data. We do not use connected platform data for advertising, and we do not use it to develop, improve, or train general-purpose AI or machine learning models.

Brandlio's own AI features. When you use the Brandlio agent or another Brandlio AI feature, we send the information needed for the task — your message, files you attach, relevant brand information and memory, and the connected platform data the task needs — to one of these AI providers through their APIs:

These providers process the data only to return a result to us. Under their API terms, they do not use data sent through their paid APIs to train their models, and they may keep it for a limited period to detect abuse, as set out in each provider's terms. We have not opted in to any program that lets them use your data for training.

Brandlio MCP and your own AI application. Brandlio MCP does not send your data to an AI provider itself. It returns data to the AI application you connected — such as Claude, ChatGPT, or Cursor — when that application requests it. That application's provider then processes it under your account with them and their privacy policy. Whether that provider may use your data for training depends on your settings and plan with them, which we do not control.

No training by us. We do not use your data or your connected platform data to train general-purpose AI models.

Google API Services User Data Policy. Brandlio's use and transfer of information received from Google APIs — including Google Ads, Merchant Center, Analytics, Search Console, Tag Manager, YouTube, Business Profile, Drive, Sheets, Calendar, and BigQuery — adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve user-facing features that you request.
• We transfer it only as needed to provide those features (including to the AI providers in section 5 when you use AI features), for security, or as required by law.
• We do not use it to develop, improve, or train generalized AI or machine learning models.
• We do not use it for advertising.
• We do not allow people to read it unless you agree, it is needed for security or to comply with the law, or it is aggregated and anonymized for internal operations.

You can revoke Brandlio's access at any time at myaccount.google.com/permissions or by removing the connection in Brandlio.

Meta (Facebook and Instagram). We use Facebook Login and Meta's Marketing and Graph APIs under Meta's Platform Terms and Developer Policies. We request only the permissions needed for the features you use, use Meta data only to provide them, and do not transfer it to data brokers or advertising networks, use it for our own advertising, or use it for cross-app tracking. Customer lists you upload are hashed before they are sent to Meta. You can revoke access in Facebook under Settings & Privacy → Settings → Business Integrations.

Microsoft Advertising. We use Microsoft data only to provide the features you use, and do not sell it or use it to train generalized AI models. You can revoke access in your Microsoft account's privacy settings.

Amazon. We use data from the Amazon Ads API and the Selling Partner API under Amazon's API terms and Data Protection Policy, only to provide the features you use. We do not request buyer names, addresses, or other buyer personal information from Amazon. We do not sell Amazon data or use it for our own advertising, and we delete it as Amazon's policies require.

Shopify. We access Shopify data under Shopify's API terms, with read-only access to orders, products, and customers, and use it only to provide the features you use. You can remove Brandlio from your store's apps at any time.

Other platforms. For LinkedIn, TikTok, Reddit, Snapchat, Pinterest, ChatGPT Ads, WooCommerce, and Stripe, we follow each platform's developer terms, use their data only to provide the features you request, and never sell it or use it for our own advertising. You can revoke access in each platform's settings or by removing the connection in Brandlio.

• Service providers: companies that help us run the Service — cloud hosting and databases, the AI providers in section 5, payment processing (Stripe), email delivery (SendGrid), website crawling (Firecrawl) when you add a brand's website, analytics and error monitoring, and customer support tools. They may use the data only to provide their services to us.
• Connected platforms: to carry out actions you request or approve, we send the needed data to that platform's API.
• Your AI application: with Brandlio MCP, data goes to the AI application you connected when it requests it (section 5).
• Your organization: members of your organization can see data according to the roles and brand access you set.
• Legal requirements: when required by law, court order, or valid legal process.
• Protection of rights: to protect the rights, property, or safety of Brandlio, our users, or others, including to prevent fraud or abuse.
• Business transfers: in a merger, acquisition, or sale of assets, under the same privacy protections.
• With your consent: at your direction or with your explicit consent.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

• We keep your information from the time you sign up until 90 days after your account is deleted. We then delete it or make it anonymous, except where the law requires us to keep it longer, such as billing and tax records. If you ask us to delete your data sooner, we do so within 30 days of verifying your request.
• When you remove a connection, we delete its access tokens immediately and stop accessing that platform. Data already pulled from it — reports, synced history, and analyses — stays with your account until the account is deleted, or earlier if you ask us to delete it.
• Copies in backups are removed on the backups' normal deletion cycle.
• AI providers may keep data sent to them for a limited period under their own terms (section 5).

• Remove a connection: open the Accounts page — mcp.brandlio.io/dashboard/accounts in Brandlio MCP, or www.brandlio.io/app/accounts in the Brandlio app — and remove it. Its access tokens are deleted immediately.
• Delete data or your whole account: email support@brandlio.io from your account email with the subject "Data Deletion" and say what you want deleted. We verify your identity, then delete it. We complete the deletion within 30 days of verifying your request.
• Revoke access at the platform: you can also revoke Brandlio's access in each platform's own settings. Step-by-step instructions are on our Data Deletion page.

• Encryption: data in transit is encrypted with TLS. Access tokens for connected platforms are encrypted at rest with AES-256, and passwords are stored hashed.
• Access controls: access to personal and platform data is limited to people and service providers who need it to run and support the Service.
• Monitoring: we monitor the Service for errors, abuse, and security threats, and apply security updates.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your login details confidential. If a breach affects your personal information, we will notify you and the relevant authorities as required by applicable law. Report suspected unauthorized access to support@brandlio.io.

We use cookies and similar technologies, such as local storage, for sign-in, preferences, security, and analytics. Our sites currently use Google Analytics, loaded through Google Tag Manager. If we add advertising tags — for example from Google, Meta, or LinkedIn — to measure our own marketing, we will list them here and ask for consent where the law requires. You can control cookies in your browser settings, although some features may not work without them.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to restrict or object to its processing, and to withdraw consent. You can update your account information in the Service, remove connections at any time, and revoke access in each platform's settings. To exercise any right, email support@brandlio.io. We respond within 30 days, or as the law requires, and may first verify your identity.

• California (CCPA/CPRA): you have the right to know what personal information we collect, use, and disclose; to delete and correct it; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising.
• EEA, UK, and Switzerland (GDPR): Metrics Masters Solutions LLC is the controller of your personal information. Our legal bases are performance of our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and legal obligations. You may also lodge a complaint with your local data protection authority.

The Service is for businesses and for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, contact support@brandlio.io and we will delete it.

Metrics Masters Solutions LLC is based in the United States. We, our team, and our service providers may process information in the United States, Israel, India, and other countries where they operate, whose data protection laws may differ from yours. Where required, we use safeguards such as standard contractual clauses.

We may update this Policy. For material changes, we will notify you by email or in the Service at least 30 days before they take effect. The "Last updated" date shows the latest version. If you do not agree to an update, you can stop using the Service and ask us to delete your account.

The Service may link to websites and services we do not operate, including the platforms you connect and the AI applications you use with Brandlio MCP. This Policy does not cover them; their own privacy policies apply.