Privacy Policy
What we collect, why we collect it, who else sees it, and how to get it back or get rid of it.
Last updated: 18 August 2026
1. Who is responsible for your data
Muplex Technologies Ltd. (UIC 204266947, VAT BG204266947), [[registered address — street, city, postcode]], Bulgaria, is the data controller for personal data processed through BrandReco. For anything in this policy, write to contact@brandreco.com.
We have not appointed a Data Protection Officer, as we are not required to. Your requests go to the address above and are handled by us directly.
2. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, first and last name, password (stored only as a salted hash — we never see it), the plan you are on, and whether you finished onboarding. | You, when you register |
| Workspace and brand data | Workspace names, brand names, domains, descriptions, notes, and the competitors you track. | You, in the product |
| Crawled website content | Public pages, robots.txt, sitemaps and llms.txt from the domains you nominate, plus facts extracted from them. | Our crawler, from public web pages |
| Prompt and result data | The prompts you track, the exact text sent to each AI model, the answers returned, visibility scores, sentiment, timings and token counts. | You, and the AI providers' responses |
| Free report requests | The domain you asked about, the email address you gave, the resulting report, and a one-way hash of your IP address used only for rate limiting — we do not store the raw IP. | You, on the free report page |
| Support and email | Messages you send us and the account emails we send you (verification, password reset). | You, and our mail system |
| Technical data | Server logs with request metadata and a request ID, used to run and debug the service. | Automatically, when you use the site |
| Analytics | Pages viewed and referrer, via our own self-hosted Umami instance — only if you allow analytics. When you are signed in, this is linked to your email address. | Your browser, with consent |
3. Do you have to give us this?
Your email address and a password are required — without them we cannot create an account or sign you in, so the service cannot be provided. Confirming your email is required before the account works. A brand name and domain are required for any analysis to run, because they are what gets analysed.
Everything else is optional. Your name, brand descriptions and notes only improve the output; leaving them out costs you accuracy, not access. Analytics is entirely optional and refusing it changes nothing about the service you receive.
4. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account, signing you in, and providing the service you asked for — crawling, prompt runs, insights and daily actions. | Performance of a contract (Art. 6(1)(b)) |
| Sending service email: email verification, password resets, and notices about changes that affect you. | Performance of a contract (Art. 6(1)(b)) |
| Taking payment for a paid plan and keeping the accounting records that go with it. | Contract, and legal obligation (Art. 6(1)(b) and (c)) |
| Producing a free visibility report for a domain you submit, and rate-limiting that form with a hashed IP so it isn't abused. | Consent, and our legitimate interest in preventing abuse (Art. 6(1)(a) and (f)) |
| Keeping the service secure and available: logs, error tracking, abuse prevention. | Legitimate interests (Art. 6(1)(f)) |
| Understanding which pages are used, via self-hosted analytics. | Consent (Art. 6(1)(a)) — you can withdraw it at any time |
| Improving the product: fixing what breaks, and deciding what to build from aggregated usage. | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights and concluded they don't override yours. You can object — see your rights — and we will stop unless we have compelling grounds not to.
5. What we send to AI providers
To measure how assistants describe your brand, we must actually ask them. That means the prompt text, your brand and competitor names and domains, and relevant public page content are sent to the AI providers you have enabled for your workspace. Your email address, password and payment details are never sent to them.
Some analyses run on a language model we host ourselves, in which case nothing leaves our infrastructure. The AI Policy sets out which is which, and what the providers may do with what they receive.
7. International transfers
The AI providers listed above are based in the United States, so running your prompts involves transferring data outside the EEA. Those transfers rely on the European Commission's Standard Contractual Clauses, or on the EU–US Data Privacy Framework where the provider is certified under it. Email us and we will send you a copy of the safeguards that apply to a given provider, and tell you which mechanism it relies on.
If you would rather no data left the EEA, you can restrict your workspace to self-hosted models — contact us and we will help you set that up.
8. How long we keep things
- Account data: while your account exists, and up to 30 days after you delete it (backups may lag slightly behind).
- Workspace, brand, prompt and run history: while your account exists, so you can see trends over time. Delete a brand or prompt and its history goes with it.
- Free report requests: 12 months from the request, then deleted or anonymised.
- Invoices and accounting records: as long as Bulgarian tax law requires, typically 10 years — this overrides a deletion request for those records.
- Server logs: normally 30 days.
- Analytics: aggregated, and retained no longer than 24 months.
9. Your rights
If you are in the EEA or UK, you have the right to:
- access the personal data we hold about you, and get a copy;
- have inaccurate data corrected;
- have your data deleted, where we have no overriding reason to keep it;
- restrict how we process it while a dispute is resolved;
- receive the data you gave us in a portable, machine-readable format;
- object to processing we base on legitimate interests, including any profiling;
- withdraw consent at any time — for analytics, use the Cookie Settings page; withdrawal doesn't affect what we did before.
Email contact@brandreco.com and we will respond within one month. We may ask you to confirm your identity first, so we don't hand your data to someone else.
You also have the right to complain to a supervisory authority. Ours is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria — www.cpdp.bg. You may also complain to the authority where you live.
10. How we protect it
- Traffic to the site is encrypted with TLS; the certificate is renewed automatically.
- Passwords are stored only as salted hashes, using Django's password hashing — nobody at our end can read them.
- Sessions use signed, HTTP-only cookies with CSRF protection on every state-changing request.
- Your data is scoped to your account: every request is filtered by the signed-in user, and data belonging to someone else returns 'not found' rather than leaking its existence.
- Access to production systems is limited to people who need it.
No system is perfectly secure. If we become aware of a breach that puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you where the law requires it.
11. Automated decisions
BrandReco scores and prioritises findings automatically, and generates recommendations with AI models. These affect what the product suggests to you — they do not produce legal effects or similarly significant effects on you, and no decision about you is made solely by automated means. You are always free to ignore a recommendation.
12. Children
BrandReco is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, tell us and we will delete it.
13. Changes to this policy
We will update this page when our processing changes, and revise the "last updated" date at the top. If a change materially affects you, we will tell you by email or in the product.