Terms of Service

7. Data security & confidentiality

Brandnitions is a creative services platform where clients configure orders, share project briefs, upload assets, and collaborate in dedicated workspaces. We treat the information you entrust to us as confidential business data. This section explains how we protect it. For broader privacy practices, see our Privacy Policy.

7.1 Confidentiality of client data

All non-public information you provide through the Platform is treated as confidential, including but not limited to: service configuration selections, project briefs and intake form responses, Google Drive or document links, uploaded files and PDF kits, brand guidelines, marketing strategies, internal messaging within order workspaces, company account details, and affiliate program communications. This applies from the moment you begin configuring a service through checkout, fulfillment, and any post-delivery support.

We do not use your confidential project content for marketing, portfolio display, case studies, or public testimonials without your prior written consent. Aggregated, anonymized usage statistics that cannot identify you or your business may be used to improve Platform performance.

7.2 Non-disclosure

Brandnitions personnel and authorized contractors who access your data are bound to treat it as confidential. We will not disclose your business information, creative assets, strategies, financial details, or project communications to third parties except:

• When necessary to deliver the services you ordered (e.g., assigning work to a specialist on our team);
• When you explicitly authorize sharing (e.g., inviting a team member to your company account);
• When required by applicable law, regulation, court order, or valid legal process;
• To protect the rights, property, or safety of Brandnitions, our users, or the public.

We do not sell, rent, or trade your confidential project data to data brokers, advertisers, or unrelated third parties.

7.3 Secure handling

The Platform is served over HTTPS with TLS encryption in transit. Access to administrative, company, and affiliate portals is protected by authentication and role-based permissions — company managers, viewers, and Brandnitions staff each receive only the access appropriate to their role. Session security, password requirements, and OAuth sign-in (including Google) follow industry practices designed to prevent unauthorized account access.

Production infrastructure runs in isolated containers with network segmentation. Database credentials and API secrets are stored as environment variables, not in application source code. We review access logs and apply least-privilege principles for internal administrative tools.

7.4 File & upload security

Files uploaded during service configuration, checkout, or within order workspaces are stored on secured infrastructure accessible only through authenticated Platform endpoints. Service brochure PDFs, deliverable attachments, and intake uploads are associated with your order or company account and are not exposed via public URLs unless you explicitly choose to share a link outside the Platform.

When you provide Google Drive or Google Docs links instead of direct uploads, access depends on the sharing settings you configure in Google. We recommend granting access only to the folders or documents required for your project. Brandnitions staff access such links solely to perform your ordered services.

7.5 Payment data

Checkout payments are processed by Stripe, a PCI-DSS compliant payment processor. When you click "Pay with Stripe," you are redirected to Stripe's secure hosted checkout. Brandnitions does not store, process, or have access to your full credit or debit card numbers. We receive only transaction metadata necessary to confirm payment, link the order to your account, and maintain billing records (e.g., amount paid, currency, payment status, and Stripe customer or session identifiers).

7.6 Data retention & deletion

We retain account, order, workspace, and billing data for as long as your account is active or as needed to provide services, resolve disputes, enforce agreements, and comply with legal and tax obligations. Completed order workspaces may be retained to support revision history, deliverable access, and customer support.

You may request deletion of personal data or closure of your company account by contacting privacy@brandnitions.com. We will honor valid requests subject to legal retention requirements and legitimate business needs (e.g., open orders, unpaid invoices, or fraud prevention). Deletion requests are typically acknowledged within five business days.

7.7 Third-party services

We use trusted subprocessors to operate the Platform. Each receives only the data necessary for its function:

• Stripe — payment processing; receives billing contact information and payment method details you enter on Stripe's pages.
• Google OAuth — optional sign-in; receives profile information you authorize (name, email, profile image).
• Email providers (e.g., Resend, SendGrid, or SMTP) — transactional emails such as welcome messages, order confirmations, and workspace notifications; receive recipient email and message content.
• Cloud hosting — application and database hosting on secured VPS infrastructure.

These providers are contractually or terms-bound to protect data. We do not authorize them to use your project content for their own marketing purposes.

7.8 Workspace privacy

Each order creates a private workspace visible only to authorized users: members of your company account (according to their role — managers may place orders and manage team access; viewers may have read-only access where configured), and Brandnitions staff assigned to fulfill the order. Order messages, deliverables, status updates, and revision requests within a workspace are not visible to other companies, other affiliates, or the public.

Affiliate participants can see referral and commission data related to their own program activity but cannot access client project workspaces or confidential order content unless they are also an authorized member of the client company account.

7.9 Breach notification

While we implement safeguards designed to protect your data, no system is completely immune to security incidents. If we become aware of a data breach that affects your personal information or confidential project data and is likely to result in a risk to your rights, we will investigate promptly, take steps to contain and remediate the incident, and notify affected users and relevant authorities as required by applicable law. Notifications will describe the nature of the incident, data involved where known, and steps we are taking. Report suspected security issues to security@brandnitions.com.