Privacy Policy

1. Who we are

BrandForge is an AI-powered brand creation platform operated by CMY.NL B.V., a company registered in the Netherlands.

When we say "BrandForge", "we", "us", or "our" in this policy, we mean CMY.NL B.V. When we say "you" or "your", we mean you — the person or organisation using our platform.

CMY.NL B.V. is the data controller for the personal data processed through BrandForge. For data processed on behalf of our white-label partners, we act as a data processor under the terms of our Data Processing Agreement (DPA).

2. What data we collect

We collect different types of data depending on how you interact with BrandForge. Here's a plain-language breakdown:

Account information

When you create an account or sign up as a partner, we collect your name, email address, company name, and password. If you sign up through a white-label partner, the partner may share this information with us to provision your account.

Billing information

If you subscribe to a paid plan, we collect your billing address and payment method. Payment card details are processed and stored by our payment provider (Stripe or Mollie) — we never see or store your full card number.

Brand creation data

When you use BrandForge to create a brand, we collect the information you provide in the prompt and any subsequent inputs — such as your business name, description, industry, target audience, and style preferences. We also store the AI-generated outputs (logos, colour palettes, websites, etc.) associated with your account.

Usage data

We automatically collect technical information about how you use the platform, including your IP address, browser type, device information, pages visited, features used, and timestamps. This helps us improve the product and diagnose issues.

Communication data

If you contact us via email, our contact form, or live chat, we store the content of those communications along with your name and email address.

Cookie data

We use cookies and similar technologies to remember your preferences, keep you logged in, and understand how you use our platform. See Section 5 for details.

3. Why we collect it

We use your data for the following purposes:

4. Legal basis for processing

Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

5. Cookies and tracking

We use cookies and similar technologies on brandforge.com. Here's what we use and why:

Essential cookies

Required for the platform to function. These keep you logged in, remember your preferences, and ensure security. You cannot opt out of these.

Analytics cookies

We use privacy-friendly analytics to understand how people use our platform — which pages are popular, where users drop off, and how we can improve the experience. We do not use Google Analytics. Our analytics provider processes data within the EU.

Marketing cookies

If you consent, we may use cookies to measure the effectiveness of our advertising campaigns. These are only set after you explicitly opt in via our cookie banner.

You can manage your cookie preferences at any time by clicking the cookie settings link in our website footer or by adjusting your browser settings.

6. Third-party services

We use a limited number of third-party services to operate BrandForge. Each provider is selected for their privacy and security standards, and where possible, we use EU-based providers.

We have Data Processing Agreements (DPAs) in place with all third-party processors. Where data is transferred outside the EU, appropriate safeguards (Standard Contractual Clauses or adequacy decisions) are in place.

7. AI-generated content and data

BrandForge uses artificial intelligence to generate brand identities, logos, websites, and other creative assets. Here's how your data is handled in this process:

What data is sent to AI models

When you create a brand, the text prompts and preferences you provide are sent to AI model providers (such as Anthropic or OpenAI) for processing. This includes your business description, target audience, and style preferences. It does not include your name, email address, billing information, or account credentials.

How AI providers handle your data

We use API-based access to AI models. Under our agreements with these providers, your prompts and generated outputs are not used to train their models. Data sent via API is processed for inference only and is not retained beyond the technical minimum required to generate a response.

Ownership of generated content

You own the brand assets generated through BrandForge. We do not claim intellectual property rights over AI-generated logos, colour palettes, websites, or other outputs created for your account. Our Terms of Service contain the full details on content ownership and licensing.

AI model improvement

We may use aggregated and anonymised usage patterns (e.g. "what types of prompts lead to better results") to improve the BrandForge platform. We do not use your individual brand data to train AI models.

8. How long we keep your data

When you delete your account, we remove your personal data and brand assets within 30 days. Anonymised, aggregated data that cannot be linked back to you may be retained indefinitely for analytics purposes.

9. International data transfers

BrandForge is operated from the European Union, and our primary hosting infrastructure is located in the EU (AWS eu-central-1, Frankfurt). However, some of our service providers are based outside the EU.

When personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) — approved by the European Commission, included in our agreements with US-based providers.
• EU-US Data Privacy Framework — where applicable and where the provider is certified.
• Adequacy decisions — where the European Commission has determined that a country provides adequate data protection.

You can request a copy of the specific safeguards in place by contacting us at privacy@brandforge.com.

10. Your rights under GDPR

If you're in the European Economic Area (EEA), you have the following rights regarding your personal data:

To exercise any of these rights, email us at privacy@brandforge.com. We'll respond within 30 days. We may ask you to verify your identity before processing your request.

11. How we protect your data

We take data security seriously and implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest — personal data and brand assets are encrypted at rest using AES-256.
• Access controls — internal access to personal data is restricted to team members who need it to perform their duties, with role-based permissions and audit logging.
• Infrastructure security — we host on AWS (EU region) with automated security patching, network isolation, and DDoS protection.
• Regular backups — automated encrypted backups with tested recovery procedures.
• Incident response — we have a documented incident response plan and will notify affected users and the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, as required by GDPR.

12. Children's privacy

BrandForge is not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete it promptly.

If you believe a child has provided us with personal data, please contact us at privacy@brandforge.com.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via email if the changes significantly affect how we process your personal data.
• Post a notice on our platform for at least 30 days before changes take effect.

We encourage you to review this page periodically. Continued use of BrandForge after changes are posted constitutes your acceptance of the updated policy.

14. How to contact us

If you have any questions about this privacy policy, your personal data, or want to exercise your rights, you can reach us at:

If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority: