--- title: "Brandwave privacy policy" description: "How Brandwave handles data: The Ordinary Company Limited, a New Zealand company trading as Brandwave, collects account, billing, usage and support information from its users, and public information about the creators its customers track, in accordance with the New Zealand Privacy Act 2020. It does not sell personal information, does not use it to train AI models, shares it only with named service providers such as Cloudflare, Supabase, Stripe and PostHog, and honours access, correction and deletion requests from users and creators alike." canonical: "https://gobrandwave.com/privacy" updated: "2026-10-15" publisher: "Brandwave" --- # Brandwave privacy policy How Brandwave handles data: The Ordinary Company Limited, a New Zealand company trading as Brandwave, collects account, billing, usage and support information from its users, and public information about the creators its customers track, in accordance with the New Zealand Privacy Act 2020. It does not sell personal information, does not use it to train AI models, shares it only with named service providers such as Cloudflare, Supabase, Stripe and PostHog, and honours access, correction and deletion requests from users and creators alike. ## Key facts - **Operating company**: The Ordinary Company Limited, a company registered in New Zealand trading as Brandwave - **Effective date**: 30 September 2026 - **Governing privacy law**: New Zealand Privacy Act 2020 - **Payment processing**: Stripe processes payments; Brandwave does not store full card details on its systems - **Where data is stored**: Service providers store and process information in data centers outside New Zealand, including in the United States, under contractual safeguards comparable to the Privacy Act 2020 - **Public creator sources**: Instagram, YouTube, TikTok, X, LinkedIn, and Reddit, public content only - **Sale of personal information**: Brandwave does not sell personal information - **AI training**: Personal information is not used to train Brandwave or third-party AI models, and third-party AI systems are not permitted to retain it for training - **Privacy contact**: hello@gobrandwave.com ## About this policy Brandwave is operated by The Ordinary Company Limited, a company registered in New Zealand trading as Brandwave. We are committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020. This policy explains how we collect, use, and safeguard personal information, covering both information about our users and information about creators that our platform analyses. **Effective date:** 30 September 2026 ## Information We Collect From You We collect personal information that you provide directly to us, and information generated by your use of the platform, including: - Name and email address when you create an account - Organization details you provide during onboarding - Content you create within the platform, such as campaigns, creator records, costs, and notes - Billing information when you subscribe to a paid plan. Payments are processed by Stripe; we do not store your full card details on our systems. - Usage data, including pages visited, features used, interactions, performance diagnostics, and session recordings - Technical data, such as browser type, IP address, and device information - Communications you send us, such as support requests and how-did-you-hear-about-us responses ## Creator Information When a workspace tracks a creator, we collect public information about that creator from Instagram, YouTube, TikTok, X, LinkedIn and Reddit, such as: - Public account names, handles, avatars, and profile descriptions - Public posts and content metadata - Public engagement metrics such as follower counts, likes, comments, and views, together with metrics we estimate from them We use this information only to provide analytics to the workspace that tracks the creator. We do not collect private or restricted-audience content, use creator information to build advertising profiles, or sell it. If you are a creator and want to know what information a Brandwave workspace holds about you, or want it corrected or deleted, contact us using the details below and we will respond in accordance with the Privacy Act 2020. ## How We Use Information We use the information we collect to: - Provide, maintain, and improve the Brandwave platform - Authenticate your identity and manage your account - Process subscription payments and manage billing - Communicate with you about your account, updates, and support requests - Analyze usage patterns to improve our services - Detect, investigate, and prevent abuse or security incidents - Comply with legal obligations ## Google User Data If an organization owner connects Google, Brandwave can read selected Google Analytics properties, Search Console sites, and Google Ads accounts to maintain the organization’s marketing record and show delivery, investment, website activity, search evidence, and provider-attributed performance. The shared Google grant requests Analytics, Tag Manager, and Search Console read-only scopes and the Google Ads adwords scope. Google does not offer a separate read-only Ads scope; Brandwave nevertheless uses advertising reporting and read operations only. Brandwave does not create or edit ads, campaigns, bids, or budgets. Advertising imports may include account identifiers, names, currencies and timezones; campaign and delivery-unit hierarchy; creative text, asset metadata and destination URLs; spend, impressions, clicks, video metrics, and provider-reported conversions or values with attribution context. We store this evidence to preserve historical reporting and connect advertising activity to your organization’s broader marketing program. Google-attributed conversions remain distinct from Google Analytics events and Brandwave business outcomes. Brandwave’s use of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not sell Google user data, use it for advertising targeting, or allow humans to read it except with your permission, for security purposes, or to comply with law. We transfer it only as needed to provide the user-facing service, including an AI assistant you explicitly connect, subject to applicable Limited Use requirements. Disconnecting Google stops future synchronization and removes Brandwave’s stored credentials. Previously imported marketing history, notes, files and Campaign links are retained under this policy; disconnecting is not a history-deletion request. You can also revoke Brandwave’s grant in your Google account and contact us to request deletion. ## Meta Advertising Data An organization owner can authorize Brandwave to read selected Meta advertising accounts using the ads_read permission. Brandwave does not request ads_management or business_management and does not create or modify Meta advertisements. Google and Meta are independent third-party platforms; Brandwave is not their advertising-management interface. We import account, Campaign, Ad Set, Ad and creative metadata, destination URLs, dated spend and delivery, and Meta-reported action and action-value evidence for the organization’s marketing record. Meta-attributed actions are not treated as deduplicated business outcomes or merged with another provider’s conversions. OAuth credentials are encrypted and kept server-side. Disconnecting Meta removes stored credentials and stops future access; removing a selected account stops its synchronization. Previously imported advertising history and user-authored context remain until removed under our retention and deletion processes. You can revoke authorization through Meta’s account settings or contact us to request deletion. ## Cookies and Analytics We use cookies and similar technologies that are necessary to keep you signed in and operate the platform. We also use PostHog to record product events, page views, interactions, performance diagnostics, console logs, and session replays so we can understand how the platform is used and diagnose problems. Replays may include content displayed or entered in the platform, but password fields are masked. We use Sentry to capture errors, Google Tag Manager to load Google Analytics for site traffic and usage, and Microsoft Clarity for aggregated interaction and session-replay analytics. These tools may process technical identifiers such as your IP address and device information on our behalf. We use Ahrefs Web Analytics to measure traffic to our public website pages. It receives only public page addresses and processes browser, device and approximate location information. Ahrefs states that it does not use cookies or persistent identifiers for this service. We do not load it when your browser sends Do Not Track or Global Privacy Control. We also note which organization operates the network a visit comes from, to understand which kinds of businesses are interested in Brandwave. We do not store your IP address for this or use it to identify you, and we discard the result when the network belongs to an internet or mobile provider. A link we send you directly, such as in an email, may carry a reference that connects your visit to that message. It does not contain your email address, and you can remove it by deleting everything after the `?` before opening the link. ## AI Features Brandwave provides interfaces, including an MCP server, that let you connect AI assistants and agents of your choice to your workspace. Any AI assistant you connect acts on your behalf and under your control: it can access the same data your account can, and its use of that data is governed by the terms of the AI provider you choose. We do not use personal information to train our own or third-party AI models, and we do not allow third-party AI systems to retain your data for training. We do not use AI to make automated decisions that produce legal or similarly significant effects about you. ## Sharing Your Information We do not sell personal information. We share information only with service providers who process it on our behalf to run the platform, and otherwise only in the limited circumstances below. Our key service providers are: - **Cloudflare**: application hosting and content delivery - **Supabase**: database and authentication infrastructure - **Stripe**: payment processing - **Data providers**: public social media information on our behalf - **Resend**: transactional email delivery - **PostHog**: product analytics, behavioral events, and session replay - **Sentry**: error monitoring - **Google**: site analytics and, only if authorized, the Google integrations described above - **Meta**: only if authorized, the advertising-data integration described above - **Microsoft Clarity**: usage and session-replay analytics - **Ahrefs**: aggregated public website traffic analytics, as described above We may also disclose information: - When required by law or to respond to legal process - To protect the rights, property, or safety of Brandwave, our users, or others - In connection with a merger, acquisition, or sale of assets, subject to this policy - With your consent ## Overseas Storage and Disclosure Our service providers store and process information in data centers outside New Zealand, including in the United States and other jurisdictions where they operate. Where personal information is held overseas, we take reasonable steps to ensure it is subject to safeguards comparable to those under the New Zealand Privacy Act 2020, including contractual protections with each provider. For personal information transferred to us from the European Union or the United Kingdom, we rely on New Zealand’s adequacy status recognized by both EU and UK authorities. For transfers to other countries, we implement appropriate safeguards as required by law, such as standard contractual clauses, to ensure your information receives equivalent protection. ## Data Retention We retain personal information for as long as your account is active or as needed to provide our services. If you close your account, we will delete or anonymise your personal information within a reasonable period, unless we are required to retain it for legal or regulatory purposes. Creator information collected from public sources is retained while at least one workspace actively tracks the creator and is removed in accordance with our deletion processes when no longer needed. ## Your Rights Under the NZ Privacy Act 2020 Under the New Zealand Privacy Act 2020, you have the right, whether you are a Brandwave user or a creator whose public information appears in the platform: - Request access to the personal information we hold about you - Request correction of any inaccurate or misleading information - Request deletion of your personal information, subject to legal obligations - Complain to the Office of the Privacy Commissioner ([privacy.org.nz](https://privacy.org.nz)) if you believe your privacy has been interfered with To exercise any of these rights, please contact us using the details below. We will respond within the timeframes required by the Privacy Act. ## Security and Breach Notification We take reasonable steps to protect personal information from unauthorised access, use, or disclosure. This includes encryption in transit and at rest, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is completely secure. If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020. ## Children Brandwave is a business tool and is not directed at children. We do not knowingly collect account information from anyone under 18. If you believe a child has created an account, contact us and we will remove it. ## Changes to This Policy We may update this privacy policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform before the changes take effect. Your continued use of Brandwave after changes take effect constitutes acceptance of the updated policy. ## Contact Us If you have questions about this privacy policy or wish to exercise your privacy rights, please contact us at: **The Ordinary Company Limited, trading as Brandwave** Email: [hello [at] gobrandwave.com](mailto:hello@gobrandwave.com) ## Cite this page Brandwave. "Brandwave privacy policy". https://gobrandwave.com/privacy This page is also available as HTML at https://gobrandwave.com/privacy. Brandwave publishes an index of its Markdown pages at https://gobrandwave.com/llms.txt.