Privacy Policy

Last updated: 26 October 2026

This policy explains how Brandlyft (“we”, “us”) processes personal data when you visit this website and when you use the Brandlyft service. A German version is available as Datenschutzerklärung.

1. Controller

Kjell Kuttler, Brandlyft, Richard-Zanders-Straße 53, 51469 Bergisch Gladbach, Germany. E-mail: hello@brandlyft.app.

2. Visiting this website

This website uses no cookies, no tracking and no analytics tools, and loads no fonts or scripts from third parties. It is hosted by GitHub Pages (GitHub, Inc., USA, a subsidiary of Microsoft). When you visit the site, the hosting provider processes technical data such as your IP address and the time of the request to deliver the page and protect against abuse (Art. 6(1)(f) GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework and standard contractual clauses.

3. Contacting us

If you write to us by e-mail, we process your message and contact details to answer your request (Art. 6(1)(b) and (f) GDPR) and delete them when they are no longer needed, unless statutory retention periods apply.

4. Using the Brandlyft service

Brandlyft creates and publishes social media content for businesses. To provide the service we process:

• Account data: name, business name, e-mail address, billing information.
• Website and product data of the business: publicly available content of the website you provide, such as product names, prices, images and texts.
• Connected social media accounts: when you connect Instagram, Facebook or TikTok through the official login of the platform, we receive an access token and the data covered by the permissions you grant (see section 5).
• Content we create for you (texts, images, videos) and its performance data.

Legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Where we process personal data on behalf of our business customers, we act as a processor under a data processing agreement (Art. 28 GDPR).

5. Data from Meta (Instagram, Facebook) and TikTok

We only request the permissions needed for the features you use and use the data only to provide those features to you:

• Basic account information (account ID, name, profile picture) to show which account is connected.
• Publishing permissions to upload and publish the posts, reels, stories and videos you create or approve in Brandlyft.
• Insights and video statistics (for example views, reach, likes, shares, saves, watch time) of the content published by your account, to report results to you and to improve future content for your account.
• Comments on your own posts, if you enable comment replies, to show them to you and to reply as your brand.

We do not sell this data, do not use it for advertising profiles and do not share it with third parties except the service providers listed in section 6. Access tokens are stored encrypted. You can disconnect an account at any time in Brandlyft or in the settings of the platform; we then delete the token and stop processing data of that account. Data from TikTok is used in accordance with the TikTok Developer Terms of Service, data from Meta in accordance with the Meta Platform Terms.

6. Service providers

• Google Cloud (Google Ireland Ltd. / Google LLC): AI models (Vertex AI) for creating images, videos and texts, and storage of media files, in EU regions where available.
• Anthropic (Anthropic PBC, USA): AI models for planning and writing texts.
• GitHub (GitHub, Inc., USA): hosting of this website and of automated processes.
• Meta Platforms Ireland Ltd. and TikTok Technology Ltd. (Ireland): publishing and statistics through their official APIs.
• STRATO AG (Germany): domain and e-mail.

Transfers to countries outside the EU are based on adequacy decisions (EU-US Data Privacy Framework) or standard contractual clauses.

7. Retention

We keep account and content data for as long as your account exists. After you close your account we delete your data within 30 days, unless statutory retention obligations (for example for invoices) apply. Media files used for publishing are deleted automatically after 30 days.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and to withdraw consent at any time. You can also lodge a complaint with a supervisory authority, for example the data protection authority of North Rhine-Westphalia (LDI NRW). To exercise your rights, write to hello@brandlyft.app.

9. Data deletion requests

To delete all data Brandlyft holds about you or your connected accounts, send an e-mail with the subject “Delete my data” to hello@brandlyft.app. We confirm the deletion within 30 days.