Skip to content

Privacy Policy

Last updated: May 18, 2026

1. Data Controller

BrandSuite is a product of DIBS SRL (Company: DIBS SRL — Registered office: Via Romagnosi 6, 50134 Florence, Italy — VAT/Tax ID: 07181170486). DIBS SRL is the Data Controller for personal data collected through the BrandSuite platform (hereinafter "BrandSuite" or "the Platform"). This policy describes the intended processing and applicable rights under Regulation (EU) 2016/679 (GDPR) and applicable Italian law. Configurations, providers and measures may evolve before launch and this policy will be updated when they are actually adopted.

2. Data we collect

We only collect data strictly necessary to deliver the service:

  • Registration data: first name, last name, email, password (securely hashed via Supabase Auth)
  • Billing data: company name, address, VAT/Tax ID, provided directly or via Stripe
  • Usage data: projects created, credits consumed, generated artifacts, session logs
  • Technical security data: IP address, browser and device type, processed in technical logs according to providers’ effective configurations
  • Aggregate public measurement: page, selected language, country code, device class and referrer category, counted daily without cookies, identifiers, URL queries or individual profiles. IP addresses are not stored in analytics data
  • User-provided content: briefs, project descriptions, prompts sent to AI models, uploaded assets
  • Cookies and similar technologies: see the dedicated section

3. Purposes of processing

We use data exclusively to:

  • Deliver BrandSuite features (deliverable generation, exports, team collaboration)
  • Manage accounts, authentication and security (including audit logs and fraud prevention)
  • Process payments and billing via Stripe
  • Send service communications (confirmations, system notifications, billing reminders)
  • Measure traffic through aggregate daily counts and, only with consent, improve the platform through detailed analytics
  • Comply with legal, tax and information-security obligations

4. Sharing with third parties

We do not use personal data as a product for sale. We may share necessary data with technical providers and competent authorities in the circumstances described below. Each provider's privacy role, legal basis, agreements and transfers depend on the processing and configuration actually adopted; details can be requested at dev@brandsuite.io:

  • Supabase (database, authentication and storage) — according to the region and terms configured for the service
  • Stripe (payments and billing) — according to the provider terms
  • AI providers (OpenAI, Anthropic, Google) — for selected processing, according to provider configuration and terms
  • Resend / transactional email provider — for service notifications
  • Competent authorities, only if legally required

5. Your rights

Under GDPR you have the right to:

  • Access your personal data (Art. 15)
  • Rectify inaccurate data (Art. 16)
  • Erasure / right to be forgotten (Art. 17)
  • Restrict processing (Art. 18)
  • Data portability in a structured format (Art. 20)
  • Object to processing (Art. 21)
  • Withdraw consent at any time (Art. 7)
  • Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)

To exercise your rights, email dev@brandsuite.io. We will respond without undue delay and normally within one month, subject to extensions allowed by law.

6. Data retention

We retain data for as long as needed for the stated purposes and applicable legal obligations. Effective periods for accounts, backups, billing, logs and content are under operational verification and are not presented here as final. You can request information or deletion at dev@brandsuite.io; legal, security, fraud, billing or dispute obligations may require exceptions.

7. Security

We apply proportionate technical and organizational measures, including authentication and access controls; the data model uses Row-Level Security policies where configured. Provider encryption, backups, audit coverage, 2FA and incident-response details depend on the effective configuration and are not presented here as certifications. Contact dev@brandsuite.io for a specific verification.

🇪🇺 GDPR rights (EU)

DIBS SRL processes personal data subject to Regulation (EU) 2016/679 and recognizes the rights described in this policy. Contact the privacy lead for information about legal bases, transfers or applied measures.

  • Receive information about the legal basis applicable to processing
  • Receive information about extra-EU transfers and applicable safeguards
  • Exercise access, rectification, erasure, restriction, portability and objection rights
  • Withdraw consent when processing is based on consent
  • Lodge a complaint with the competent supervisory authority

Privacy contact: DIBS SRL — Via Romagnosi 6, 50134 Florence, Italy — dev@brandsuite.io

🇺🇸 California privacy requests

If California privacy law applies to your circumstances, you may have specific rights. Whether the CCPA or CPRA applies depends on statutory requirements and is not presented here as a general certification. Requests may include:

  • Know which categories of personal data we collect
  • Request deletion of your data
  • Opt out of data sharing
  • Be free from discrimination for exercising your rights
  • Correct inaccurate data

We do not use personal data as a product for sale. For information about any applicable legal definition of sale or sharing, email dev@brandsuite.io.

8. Cookies

For basic public measurement we record only daily aggregate counts by page, selected language, country code, device class and referrer category, without cookies or identifiers. Country is resolved server-side and IP addresses are not stored in analytics data. Detailed analytics tools and cookies are activated only with consent. You can manage preferences at any time via the "Cookie preferences" button at the bottom of any page.

Technical (always active)

Session, authentication, security. Required for the site to function.

Analytics (opt-in)

Aggregated anonymized usage statistics.

Preferences (opt-in)

Store language, theme and other UX preferences.

You can disable non-technical cookies via Cookie preferences without losing access to the service.

9. Changes to this policy

We may update this policy to reflect regulatory changes, effective configurations or service evolution. We will show the update date and, where required by law or appropriate for the change, provide notice by reasonable means before or when it takes effect.

10. Contact

For any question about this policy or the processing of your personal data, contact the Data Controller DIBS SRL — Via Romagnosi 6, 50134 Florence, Italy (VAT 07181170486).
Email: dev@brandsuite.io