Privacy Policy.

This Privacy Policy explains how Brantuit, LLC, a Wyoming limited liability company doing business as Brandtuit ("Brandtuit," "we," "us" or "our"), collects, uses, discloses and protects personal information. It also explains the choices and rights you have.

1. Who we are and what this policy covers

Brandtuit makes Zena, an AI brand manager for consumer packaged goods brands, and related products, including Brand Sentinel, Category Sentinel, Ask Zena, Burst Alerts, Monthly Reports and Decision Briefs (together, the "Services").

This policy covers personal information we collect through:

• our website at brandtuit.com (the "Site");
• our client portal at studio.brandtuit.com and the Services; and
• our emails, calls, meetings and other business communications.

Customers with signed agreements. If your organization has a signed agreement with us that includes a data processing addendum, that agreement governs how we process your organization's data, and we process that data as your organization's service provider. If this policy conflicts with a signed agreement, the signed agreement controls.

United States only. The Site and Services are intended for businesses in the United States. We do not direct them to individuals in the European Economic Area, the United Kingdom or Switzerland.

2. Information we collect

2.1 Information you provide

• Account information. Your name, work email address, company name, job title and the colleagues you invite to your workspace. We sign you in with a one-time code sent to your email, so we do not collect or store a password.
• Workspace information. The brands, competitors, categories, retailers and business objectives you brief Zena on.
• Payment information. Purchases are processed by our payment processor, Stripe. Stripe collects your card details directly. We receive only limited information, such as the card type, the last four digits and billing details, and we never receive or store full card numbers.
• Communications. Messages, meeting notes, support requests, survey responses and other information you share when you contact us.

2.2 Subscriber Data

"Subscriber Data" means the documents and data you upload to your Brand Repository, the questions and instructions you give Zena, and your feedback on Zena's outputs, including status updates in your Recommendation Ledger.

2.3 Information collected automatically

When you use the Site or the Services, we automatically collect device and browser information, IP address, approximate location derived from IP address, referring pages, pages viewed, features used, and the dates and times of your activity. We use cookies and similar technologies for this purpose (see Section 7), including product analytics and session recording provided by PostHog, and error monitoring provided by Sentry. Session recordings are configured to mask the text you type into input fields and chat.

2.4 Public market information

To deliver the Services, we collect and analyze publicly available information about brands, products, categories, retailers and markets. Sources include news articles, retailer product listings, public reviews, regulatory filings, company websites and public social media content. Some of this information includes names, usernames or content that individuals have chosen to post publicly.

We use public market information to understand what is happening in markets and categories, and what consumers as a group are saying and buying. We do not use it to build profiles of individual people, we do not contact individuals based on it, and we do not sell it. When Services outputs describe consumer conversation, they summarize themes rather than identify individual posters.

2.5 Information from other sources

We may receive business contact information, such as name, title, employer and work email address, from referral partners, professional networking sites and other public sources. We use it to contact people about our Services in a business capacity.

2.6 Sensitive personal information

We do not ask for or intentionally collect sensitive personal information, such as government identification numbers, financial account credentials, precise geolocation, or health, biometric or genetic information. Please do not upload documents to the Services that contain this kind of information about individuals.

3. How we use information

We use personal information to:

• provide, operate, maintain and support the Services, including setting up your workspace and delivering reports and alerts;
• tailor Zena's outputs to your brands, objectives and prior work, as described in Section 4;
• process payments, manage subscriptions and send transactional and service notices;
• respond to your requests and communicate with you;
• secure the Site and Services, and detect, prevent and respond to fraud, abuse and security incidents;
• understand how the Site and Services are used, fix errors, and develop and improve our products;
• send business communications about our Services, which you can opt out of at any time; and
• comply with legal obligations, enforce our agreements and protect our rights.

4. AI and your Subscriber Data

Zena learns your brand inside your workspace. Your uploaded documents, prior reports, Recommendation Ledger and feedback remain in your workspace, and they shape Zena's future outputs for you. That is what we mean when we say Zena gets better over time.

Your Subscriber Data is not used for anyone else. We do not use your Subscriber Data to train artificial intelligence models, and we do not use it to generate outputs for any other customer.

AI model providers. We use third-party AI model providers to generate outputs. They process Subscriber Data only to provide their services to us, under contract terms that prohibit them from using it to train their models.

Aggregated usage information. We may use aggregated or de-identified information about how the Services are used, such as which features are used and how long responses take, to improve the Services generally. This information does not identify you, your organization or your brands. We maintain de-identified information in de-identified form and do not attempt to re-identify it, except as permitted by law to test our de-⁠identification processes.

Human access. Authorized members of our team, and contractors bound by written confidentiality obligations, may access Subscriber Data and outputs to deliver and review reports, respond to support requests and maintain quality. Access is limited to what each person needs for that work.

5. How we disclose information

We disclose personal information only as follows:

• Service providers. To companies that host, process, analyze or support the Site and Services on our behalf, such as cloud hosting, AI model, analytics, error monitoring, payment and email providers. They are contractually required to protect the information and to use it only to provide services to us. A current list of our sub-processors is available on request at privacy@brandtuit.com.
• Your workspace. Content in a workspace is visible to the users your organization authorizes.
• Professional advisors. To our lawyers, accountants, auditors and insurers, under confidentiality obligations.
• Legal and safety. When we believe disclosure is required by law, regulation or legal process, or is needed to protect the rights, property or safety of Brandtuit, our customers or others.
• Business transfers. To a buyer, successor or financing source in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business, subject to confidentiality protections. We will require any successor to honor this policy for information it receives.
• With your direction or consent.

No sale and no targeted advertising. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under state privacy laws. We have not done so in the past 12 months. We do not disclose personal information to third parties for their own direct marketing purposes.

6. Summary of information we collect

The table below summarizes the categories of personal information we collect, where it comes from, why we use it and to whom we disclose it. Section 8 explains how long we keep it.

We do not collect sensitive personal information for the purpose of inferring characteristics about you.

7. Cookies, analytics and your browser signals

We use two kinds of cookies and similar technologies:

• Necessary, to operate the Site and Services, such as keeping you signed in and protecting against abuse; and
• Analytics, to understand how the Site and Services are used and to find and fix problems.

We do not use advertising cookies or allow third parties to place advertising technologies on the Site.

You can block or delete cookies through your browser settings. Some features may not work without necessary cookies.

Global Privacy Control. We treat a Global Privacy Control signal from your browser as a valid request to opt out of any sale or sharing of personal information.

Do Not Track. Because there is no common industry standard for "Do Not Track" browser signals, we do not respond to them. We honor Global Privacy Control as described above.

8. How long we keep information

We keep personal information only for as long as needed for the purposes described in this policy, using these criteria:

• Account information: while your account is active, and afterward for as long as needed to comply with legal, tax and accounting obligations, resolve disputes and enforce our agreements.
• Subscriber Data: while your subscription is active, and for a limited wind-down period after it ends, during which you may request an export. We then delete it, except where we need to keep it to comply with law, prevent fraud, protect security, preserve evidence of a dispute or maintain financial records. You may also ask us to delete individual documents or your workspace sooner. Deleted Subscriber Data is removed from backups on their standard retention schedules.
• Analytics data and session recordings: for no longer than twelve (12) months.
• Public market information: for as long as it is useful for analyzing trends over time.
• Business contact information: until you ask us to stop contacting you, after which we keep only what we need to honor that request.

9. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption of data in transit, access controls that limit access to people who need it, and activity logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you as required by law.

10. Your choices and rights

10.1 For everyone

You may ask us to access, correct or delete your personal information by emailing privacy@brandtuit.com. You can opt out of marketing emails at any time using the unsubscribe link in any marketing email. We will still send transactional and service messages about your account.

10.2 Additional rights under applicable law

Depending on where you live and the laws that apply to us, you may have additional rights regarding your personal information, such as the right to receive a copy of it in a portable format, to opt out of certain processing, or to appeal a decision about your request. We honor the rights that apply to us under law, and we will not discriminate against you for exercising them. Whether or not a law applies, any user may request access, correction or deletion as described in Section 10.1.

We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling in furtherance of decisions that produce legal or similarly significant effects.

10.3 How to make a request

Email privacy@brandtuit.com with the subject line "Privacy Request." To protect your information, we will verify your request by matching information you provide to information in our records, such as by confirming a code sent to your email address. We will respond within forty-five (45) days, and we may extend that period once by an additional forty-five (45) days where permitted, with notice to you.

You may use an authorized agent to make a request. We may require the agent to provide proof of your written permission and may ask you to verify your identity directly.

Subscriber Data. If your organization is our customer and your request concerns Subscriber Data that your organization controls, we may refer your request to your organization and assist it in responding.

10.4 Appeals

If we decline your request, you may ask us to reconsider by replying to our decision with "Appeal" in the subject line. We will respond in writing and explain our decision. Where applicable law provides a right to appeal, we will respond within the time that law requires, and you may contact your state attorney general if your appeal is denied.

10.5 California "Shine the Light"

California residents may ask whether we disclose personal information to third parties for their own direct marketing purposes. We do not.

11. Where we process information

Brandtuit and most of our service providers process information in the United States. Some service providers may process information in other countries. When they do, we require them to protect it in line with this policy and applicable law.

12. Children

The Site and Services are for business use and are not directed to anyone under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, contact privacy@brandtuit.com and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the "Last updated" date above. If we make a material change to how we use Subscriber Data or personal information, we will notify account holders by email before the change takes effect.

14. Contact us

Brantuit, LLC d/b/a Brandtuit
10 West Road #1050
Newtown, PA 18940
privacy@brandtuit.com