Privacy Policy

Brandwave is operated by The Ordinary Company Limited, a company registered in New Zealand trading as Brandwave. We are committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020. This policy explains how we collect, use, and safeguard personal information, covering both information about our users and information about creators that our platform analyses.

Effective date: 7 July 2026

Information We Collect From You

We collect personal information that you provide directly to us, and information generated by your use of the platform, including:

  • Name and email address when you create an account
  • Organisation details you provide during onboarding
  • Content you create within the platform, such as campaigns, creator records, costs, and notes
  • Billing information when you subscribe to a paid plan. Payments are processed by Stripe; we do not store your full card details on our systems.
  • Usage data, including pages visited and features used
  • Technical data, such as browser type, IP address, and device information
  • Communications you send us, such as support requests and how-did-you-hear-about-us responses

Creator Information We Collect From Public Sources

Brandwave’s core function is analysing creator marketing. To provide it, we collect information about social media creators from publicly available sources on Instagram, YouTube, TikTok, X, LinkedIn, and Reddit, using automated collection tools. This may include personal information about creators, such as:

  • Public account names, handles, avatars, and profile descriptions
  • Public posts and content metadata
  • Public engagement metrics such as follower counts, likes, comments, and views, together with metrics we estimate from them

We collect this information because it is publicly available, and we use it solely to provide analytics to the workspace that tracks the creator. We do not collect private or restricted-audience content, and we do not use creator information to build advertising profiles or sell it to third parties.

If you are a creator and want to know what information a Brandwave workspace holds about you, or want it corrected or deleted, contact us using the details below and we will respond in accordance with the Privacy Act 2020.

How We Use Information

We use the information we collect to:

  • Provide, maintain, and improve the Brandwave platform
  • Authenticate your identity and manage your account
  • Process subscription payments and manage billing
  • Communicate with you about your account, updates, and support requests
  • Analyse usage patterns to improve our services
  • Detect, investigate, and prevent abuse or security incidents
  • Comply with legal obligations

Google User Data

If you connect Google Analytics to Brandwave, we access your Google Analytics data with read-only scope, solely to display website analytics and attribute conversions within your workspace. Brandwave’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide the feature, do not use it for advertising, and do not allow humans to read it except with your permission, for security purposes, or to comply with law. You can disconnect the integration at any time from your settings, which revokes our access.

Cookies and Analytics

We use cookies and similar technologies that are necessary to keep you signed in and operate the platform. We also use PostHog, a product analytics tool, to understand how the platform is used, and Sentry to capture errors so we can fix them. These tools may process technical identifiers such as your IP address and device information on our behalf.

AI Features

Brandwave provides interfaces, including an MCP server, that let you connect AI assistants and agents of your choice to your workspace. Any AI assistant you connect acts on your behalf and under your control: it can access the same data your account can, and its use of that data is governed by the terms of the AI provider you choose. We do not use personal information to train our own or third-party AI models, and we do not allow third-party AI systems to retain your data for training. We do not use AI to make automated decisions that produce legal or similarly significant effects about you.

Sharing Your Information

We do not sell personal information. We share information only with service providers who process it on our behalf to run the platform, and otherwise only in the limited circumstances below. Our key service providers are:

  • Cloudflare — application hosting and content delivery
  • Supabase — database and authentication infrastructure
  • Stripe — payment processing
  • Data collection infrastructure providers — automated collection of publicly available social media data on our behalf
  • Resend — transactional email delivery
  • PostHog — product analytics
  • Sentry — error monitoring
  • Google — only if you connect Google Analytics, as described above

We may also disclose information:

  • When required by law or to respond to legal process
  • To protect the rights, property, or safety of Brandwave, our users, or others
  • In connection with a merger, acquisition, or sale of assets, subject to this policy
  • With your consent

Overseas Storage and Disclosure

Our service providers store and process information in data centres outside New Zealand, including in the United States and other jurisdictions where they operate. Where personal information is held overseas, we take reasonable steps to ensure it is subject to safeguards comparable to those under the New Zealand Privacy Act 2020, including contractual protections with each provider.

For personal information transferred to us from the European Union or the United Kingdom, we rely on New Zealand’s adequacy status recognised by both EU and UK authorities. For transfers to other countries, we implement appropriate safeguards as required by law, such as standard contractual clauses, to ensure your information receives equivalent protection.

Data Retention

We retain personal information for as long as your account is active or as needed to provide our services. If you close your account, we will delete or anonymise your personal information within a reasonable period, unless we are required to retain it for legal or regulatory purposes. Creator information collected from public sources is retained while at least one workspace actively tracks the creator and is removed in accordance with our deletion processes when no longer needed.

Your Rights Under the NZ Privacy Act 2020

Under the New Zealand Privacy Act 2020, you have the right to — whether you are a Brandwave user or a creator whose public information appears in the platform:

  • Request access to the personal information we hold about you
  • Request correction of any inaccurate or misleading information
  • Request deletion of your personal information, subject to legal obligations
  • Complain to the Office of the Privacy Commissioner (privacy.org.nz) if you believe your privacy has been interfered with

To exercise any of these rights, please contact us using the details below. We will respond within the timeframes required by the Privacy Act.

Security and Breach Notification

We take reasonable steps to protect personal information from unauthorised access, use, or disclosure. This includes encryption in transit and at rest, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is completely secure. If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

Children

Brandwave is a business tool and is not directed at children. We do not knowingly collect account information from anyone under 18. If you believe a child has created an account, contact us and we will remove it.

Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform before the changes take effect. Your continued use of Brandwave after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or wish to exercise your privacy rights, please contact us at:

The Ordinary Company Limited, trading as Brandwave
Email: hello@gobrandwave.com