Privacy Policy

Yes — Brook collects and stores personal data. Specifically:

• Account data: email address, password (hashed by our auth provider), sign-in method, and account timestamps.
• Profile & brand data: your name, business name, brand voice notes, platforms, ideal-client description, brand colours, and any avatar/audience details you enter.
• Content you create: prompts, drafts, captions, keywords, post metrics you log (clicks, DMs, calls, revenue), client pipeline entries, and feedback you submit.
• Voice recordings: if you use voice input, the audio is sent for transcription and is not retained after transcription.
• Billing data: subscription status and customer/ subscription identifiers. Card numbers are handled by Stripe and never stored by Brook.
• Usage events: in-app activity events (e.g. signup, draft created) used to operate and improve the product.
• Marketing consent: whether you opted in to marketing email, recorded at signup.

We do not knowingly collect data from anyone under 18, and we do not sell your personal data.

Brook is an AI-assisted tool. Text you enter — prompts, brand voice, audience details, drafts, keywords, and compliance checks — is sent to third-party AI model providers through our AI gateway so the model can generate or analyse content. Voice input is sent to a speech-to-text model.

AI output can be wrong, outdated, or misleading. Brook's readiness scores, keyword suggestions, and FTC/compliance checks are automated signals only — they are not legal, financial, medical, or professional advice, and they are not a guarantee of performance or of legal compliance. You are responsible for reviewing everything before you publish it.

We do not use your content to train our own models. Our providers process it to return a response under their own terms.

We share data only with the processors we need to run Brook:

• Lovable Cloud (Supabase infrastructure) — application database, authentication, and hosting.
• Lovable AI Gateway and its upstream model providers (e.g. Google, OpenAI) — AI text generation, analysis, and transcription.
• Stripe — subscription billing and payment processing.
• Sender.net — marketing email delivery, only for contacts who opted in.
• Publishing/automation tools you connect yourself (e.g. Repurpose.io, Buffer, Zapier) — receive only the drafts exposed by the feed link you generate. Revoking the link stops the sharing.

We may also disclose data where legally required, or to protect our rights or someone's safety.

We keep your account data while your account is open. You can delete individual drafts, clients, and profile fields at any time from inside the app, and deletions remove the records from our database.

To delete your whole account and all associated personal data, email hello@crownandcomarketing.com (or use the request button in Settings). We action verified requests within 30 days. Backups are purged on their normal rotation, within 90 days.

Records we must keep for tax, accounting, or fraud-prevention reasons (for example billing records) are retained for as long as the law requires.

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, to withdraw marketing consent, and to object to certain processing. Email hello@crownandcomarketing.com and we will respond within 30 days. You can unsubscribe from marketing email using the link in any marketing message.

Data is encrypted in transit, access is scoped per account with row-level database rules, and API keys and secrets are stored server-side only. No system is perfectly secure; we do not guarantee that unauthorised access can never happen, and we will notify affected users of a breach as required by law.

Brook uses only the storage needed to keep you signed in and remember in-app preferences. We do not run third-party advertising trackers.

If we make a material change to this policy we will update the date above and notify account holders by email.