Privacy Policy

Brandwave is operated by The Ordinary Company Limited, a company registered in New Zealand trading as Brandwave. We are committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020. This policy explains how we collect, use, and safeguard personal information, covering both information about our users and information about creators that our platform analyses.

Effective date: 30 September 2026

Information We Collect From You

We collect personal information that you provide directly to us, and information generated by your use of the platform, including:

Name and email address when you create an account
Organization details you provide during onboarding
Content you create within the platform, such as campaigns, creator records, costs, and notes
Billing information when you subscribe to a paid plan. Payments are processed by Stripe; we do not store your full card details on our systems.
Usage data, including pages visited, features used, interactions, performance diagnostics, and session recordings
Technical data, such as browser type, IP address, and device information
Communications you send us, such as support requests and how-did-you-hear-about-us responses

Creator Information We Collect From Public Sources

Brandwave’s core function is analyzing creator marketing. To provide it, we collect information about social media creators from publicly available sources on Instagram, YouTube, TikTok, X, LinkedIn, and Reddit, using automated collection tools. This may include personal information about creators, such as:

Public account names, handles, avatars, and profile descriptions
Public posts and content metadata
Public engagement metrics such as follower counts, likes, comments, and views, together with metrics we estimate from them

We collect this information because it is publicly available, and we use it solely to provide analytics to the workspace that tracks the creator. We do not collect private or restricted-audience content, and we do not use creator information to build advertising profiles or sell it to third parties.

If you are a creator and want to know what information a Brandwave workspace holds about you, or want it corrected or deleted, contact us using the details below and we will respond in accordance with the Privacy Act 2020.

How We Use Information

We use the information we collect to:

Provide, maintain, and improve the Brandwave platform
Authenticate your identity and manage your account
Process subscription payments and manage billing
Communicate with you about your account, updates, and support requests
Analyze usage patterns to improve our services
Detect, investigate, and prevent abuse or security incidents
Comply with legal obligations

Google User Data

If an organization owner connects Google, Brandwave can read selected Google Analytics properties, Search Console sites, and Google Ads accounts to maintain the organization’s marketing record and show delivery, investment, website activity, search evidence, and provider-attributed performance. The shared Google grant requests Analytics, Tag Manager, and Search Console read-only scopes and the Google Ads adwords scope. Google does not offer a separate read-only Ads scope; Brandwave nevertheless uses advertising reporting and read operations only. Brandwave does not create or edit ads, campaigns, bids, or budgets.

Advertising imports may include account identifiers, names, currencies and timezones; campaign and delivery-unit hierarchy; creative text, asset metadata and destination URLs; spend, impressions, clicks, video metrics, and provider-reported conversions or values with attribution context. We store this evidence to preserve historical reporting and connect advertising activity to your organization’s broader marketing program. Google-attributed conversions remain distinct from Google Analytics events and Brandwave business outcomes.

Brandwave’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising targeting, or allow humans to read it except with your permission, for security purposes, or to comply with law. We transfer it only as needed to provide the user-facing service, including an AI assistant you explicitly connect, subject to applicable Limited Use requirements.

Disconnecting Google stops future synchronization and removes Brandwave’s stored credentials. Previously imported marketing history, notes, files and Campaign links are retained under this policy; disconnecting is not a history-deletion request. You can also revoke Brandwave’s grant in your Google account and contact us to request deletion.

Meta Advertising Data

An organization owner can authorize Brandwave to read selected Meta advertising accounts using the ads_read permission. Brandwave does not request ads_management or business_management and does not create or modify Meta advertisements. Google and Meta are independent third-party platforms; Brandwave is not their advertising-management interface.

We import account, Campaign, Ad Set, Ad and creative metadata, destination URLs, dated spend and delivery, and Meta-reported action and action-value evidence for the organization’s marketing record. Meta-attributed actions are not treated as deduplicated business outcomes or merged with another provider’s conversions.

OAuth credentials are encrypted and kept server-side. Disconnecting Meta removes stored credentials and stops future access; removing a selected account stops its synchronization. Previously imported advertising history and user-authored context remain until removed under our retention and deletion processes. You can revoke authorization through Meta’s account settings or contact us to request deletion.

Cookies and Analytics

We use cookies and similar technologies that are necessary to keep you signed in and operate the platform. We also use PostHog to record product events, page views, interactions, performance diagnostics, console logs, and session replays so we can understand how the platform is used and diagnose problems. Replays may include content displayed or entered in the platform, but password fields are masked. We use Sentry to capture errors, Google Tag Manager to load Google Analytics for site traffic and usage, and Microsoft Clarity for aggregated interaction and session-replay analytics. These tools may process technical identifiers such as your IP address and device information on our behalf.

We use Ahrefs Web Analytics to measure traffic to our public website pages. We run its tracker in an isolated document without access to signup forms or authenticated pages, and send only public page addresses without query strings, fragments, or referring-page addresses. Although Ahrefs supports automatic link and form events, our isolated document contains no links or forms. Ahrefs processes browser, device, screen-size, and language information, and uses your IP address to estimate city and country and calculate a visitor hash with a salt changed daily. Ahrefs states that it discards raw IP addresses and does not use cookies or persistent identifiers for this service. It may use aggregated data for research and service improvement. We do not load this tracker when your browser sends Do Not Track or Global Privacy Control, and you can also block it using your browser or an analytics blocker.

We also record the organization that operates the network your visit came from, which our hosting provider derives from your IP address at the network level. We use this only to understand which kinds of businesses are interested in Brandwave. We do not store your IP address for this purpose, we do not use it to identify you personally, and where the network belongs to an internet or mobile provider rather than an organization we discard it.

If you follow a link we sent you directly, such as in an email or message, that link may carry a reference that lets us connect your visit to our earlier correspondence with you. The reference does not contain your email address. You can remove it by deleting everything after the ? in the address before opening the link.

AI Features

Brandwave provides interfaces, including an MCP server, that let you connect AI assistants and agents of your choice to your workspace. Any AI assistant you connect acts on your behalf and under your control: it can access the same data your account can, and its use of that data is governed by the terms of the AI provider you choose. We do not use personal information to train our own or third-party AI models, and we do not allow third-party AI systems to retain your data for training. We do not use AI to make automated decisions that produce legal or similarly significant effects about you.

Overseas Storage and Disclosure

Our service providers store and process information in data centers outside New Zealand, including in the United States and other jurisdictions where they operate. Where personal information is held overseas, we take reasonable steps to ensure it is subject to safeguards comparable to those under the New Zealand Privacy Act 2020, including contractual protections with each provider.

For personal information transferred to us from the European Union or the United Kingdom, we rely on New Zealand’s adequacy status recognized by both EU and UK authorities. For transfers to other countries, we implement appropriate safeguards as required by law, such as standard contractual clauses, to ensure your information receives equivalent protection.

Data Retention

We retain personal information for as long as your account is active or as needed to provide our services. If you close your account, we will delete or anonymise your personal information within a reasonable period, unless we are required to retain it for legal or regulatory purposes. Creator information collected from public sources is retained while at least one workspace actively tracks the creator and is removed in accordance with our deletion processes when no longer needed.

Your Rights Under the NZ Privacy Act 2020

Under the New Zealand Privacy Act 2020, you have the right, whether you are a Brandwave user or a creator whose public information appears in the platform:

Request access to the personal information we hold about you
Request correction of any inaccurate or misleading information
Request deletion of your personal information, subject to legal obligations
Complain to the Office of the Privacy Commissioner (privacy.org.nz) if you believe your privacy has been interfered with

To exercise any of these rights, please contact us using the details below. We will respond within the timeframes required by the Privacy Act.

Security and Breach Notification

We take reasonable steps to protect personal information from unauthorised access, use, or disclosure. This includes encryption in transit and at rest, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is completely secure. If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

Children

Brandwave is a business tool and is not directed at children. We do not knowingly collect account information from anyone under 18. If you believe a child has created an account, contact us and we will remove it.

Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform before the changes take effect. Your continued use of Brandwave after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or wish to exercise your privacy rights, please contact us at:

The Ordinary Company Limited, trading as Brandwave
Email: hello [at] gobrandwave.com