Privacy Policy
Brandwave is operated by The Ordinary Company Limited, a company registered in New Zealand trading as Brandwave. We are committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020. This policy explains how we collect, use, and safeguard personal information, covering both information about our users and information about creators that our platform analyses.
Effective date: 30 September 2026
Information We Collect From You
We collect personal information that you provide directly to us, and information generated by your use of the platform, including:
- Name and email address when you create an account
- Organization details you provide during onboarding
- Content you create within the platform, such as campaigns, creator records, costs, and notes
- Billing information when you subscribe to a paid plan. Payments are processed by Stripe; we do not store your full card details on our systems.
- Usage data, including pages visited, features used, interactions, performance diagnostics, and session recordings
- Technical data, such as browser type, IP address, and device information
- Communications you send us, such as support requests and how-did-you-hear-about-us responses
Creator Information
When a workspace tracks a creator, we collect public information about that creator from Instagram, YouTube, TikTok, X, LinkedIn and Reddit, such as:
- Public account names, handles, avatars, and profile descriptions
- Public posts and content metadata
- Public engagement metrics such as follower counts, likes, comments, and views, together with metrics we estimate from them
We use this information only to provide analytics to the workspace that tracks the creator. We do not collect private or restricted-audience content, use creator information to build advertising profiles, or sell it.
If you are a creator and want to know what information a Brandwave workspace holds about you, or want it corrected or deleted, contact us using the details below and we will respond in accordance with the Privacy Act 2020.
How We Use Information
We use the information we collect to:
- Provide, maintain, and improve the Brandwave platform
- Authenticate your identity and manage your account
- Process subscription payments and manage billing
- Communicate with you about your account, updates, and support requests
- Analyze usage patterns to improve our services
- Detect, investigate, and prevent abuse or security incidents
- Comply with legal obligations
Google User Data
If an organization owner connects Google, Brandwave can read selected Google Analytics properties, Search Console sites, and Google Ads accounts to maintain the organization’s marketing record and show delivery, investment, website activity, search evidence, and provider-attributed performance. The shared Google grant requests Analytics, Tag Manager, and Search Console read-only scopes and the Google Ads adwords scope. Google does not offer a separate read-only Ads scope; Brandwave nevertheless uses advertising reporting and read operations only. Brandwave does not create or edit ads, campaigns, bids, or budgets.
Advertising imports may include account identifiers, names, currencies and timezones; campaign and delivery-unit hierarchy; creative text, asset metadata and destination URLs; spend, impressions, clicks, video metrics, and provider-reported conversions or values with attribution context. We store this evidence to preserve historical reporting and connect advertising activity to your organization’s broader marketing program. Google-attributed conversions remain distinct from Google Analytics events and Brandwave business outcomes.
Brandwave’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising targeting, or allow humans to read it except with your permission, for security purposes, or to comply with law. We transfer it only as needed to provide the user-facing service, including an AI assistant you explicitly connect, subject to applicable Limited Use requirements.
Disconnecting Google stops future synchronization and removes Brandwave’s stored credentials. Previously imported marketing history, notes, files and Campaign links are retained under this policy; disconnecting is not a history-deletion request. You can also revoke Brandwave’s grant in your Google account and contact us to request deletion.
Meta Advertising Data
An organization owner can authorize Brandwave to read selected Meta advertising accounts using the ads_read permission. Brandwave does not request ads_management or business_management and does not create or modify Meta advertisements. Google and Meta are independent third-party platforms; Brandwave is not their advertising-management interface.
We import account, Campaign, Ad Set, Ad and creative metadata, destination URLs, dated spend and delivery, and Meta-reported action and action-value evidence for the organization’s marketing record. Meta-attributed actions are not treated as deduplicated business outcomes or merged with another provider’s conversions.
OAuth credentials are encrypted and kept server-side. Disconnecting Meta removes stored credentials and stops future access; removing a selected account stops its synchronization. Previously imported advertising history and user-authored context remain until removed under our retention and deletion processes. You can revoke authorization through Meta’s account settings or contact us to request deletion.
AI Features
Brandwave provides interfaces, including an MCP server, that let you connect AI assistants and agents of your choice to your workspace. Any AI assistant you connect acts on your behalf and under your control: it can access the same data your account can, and its use of that data is governed by the terms of the AI provider you choose. We do not use personal information to train our own or third-party AI models, and we do not allow third-party AI systems to retain your data for training. We do not use AI to make automated decisions that produce legal or similarly significant effects about you.
Overseas Storage and Disclosure
Our service providers store and process information in data centers outside New Zealand, including in the United States and other jurisdictions where they operate. Where personal information is held overseas, we take reasonable steps to ensure it is subject to safeguards comparable to those under the New Zealand Privacy Act 2020, including contractual protections with each provider.
For personal information transferred to us from the European Union or the United Kingdom, we rely on New Zealand’s adequacy status recognized by both EU and UK authorities. For transfers to other countries, we implement appropriate safeguards as required by law, such as standard contractual clauses, to ensure your information receives equivalent protection.
Data Retention
We retain personal information for as long as your account is active or as needed to provide our services. If you close your account, we will delete or anonymise your personal information within a reasonable period, unless we are required to retain it for legal or regulatory purposes. Creator information collected from public sources is retained while at least one workspace actively tracks the creator and is removed in accordance with our deletion processes when no longer needed.
Your Rights Under the NZ Privacy Act 2020
Under the New Zealand Privacy Act 2020, you have the right, whether you are a Brandwave user or a creator whose public information appears in the platform:
- Request access to the personal information we hold about you
- Request correction of any inaccurate or misleading information
- Request deletion of your personal information, subject to legal obligations
- Complain to the Office of the Privacy Commissioner (privacy.org.nz) if you believe your privacy has been interfered with
To exercise any of these rights, please contact us using the details below. We will respond within the timeframes required by the Privacy Act.
Security and Breach Notification
We take reasonable steps to protect personal information from unauthorised access, use, or disclosure. This includes encryption in transit and at rest, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is completely secure. If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.
Children
Brandwave is a business tool and is not directed at children. We do not knowingly collect account information from anyone under 18. If you believe a child has created an account, contact us and we will remove it.
Changes to This Policy
We may update this privacy policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform before the changes take effect. Your continued use of Brandwave after changes take effect constitutes acceptance of the updated policy.
Contact Us
If you have questions about this privacy policy or wish to exercise your privacy rights, please contact us at:
The Ordinary Company Limited, trading as Brandwave
Email: hello [at] gobrandwave.com