Privacy Policy

1. Who we are

Steward Brand (the "Service", "we", "us", "our") is operated as a sole proprietorship by Mário Filipe Vicente de Mineiro, acting as the data controller for the personal data described in this policy. The Service is reachable at stewardbrand.com. For any privacy-related question, contact stewardbrandofficial@gmail.com.

2. Data we collect

2.1 Account information

Name, email address, hashed password (bcrypt) or Google account identifier when you sign in with Google. Used only to authenticate you and contact you about your account.

2.2 Social platform connection data

When you connect a Facebook Page, Instagram Business / Creator account, LinkedIn personal profile, LinkedIn Company Page, TikTok account, or YouTube channel via OAuth, we receive and store: the OAuth access token (encrypted at rest with AES-256-GCM), the refresh token (where applicable), the platform-issued account or page ID, the public account name, the avatar URL, and the list of scopes you explicitly granted. We never receive or store your platform password.

2.3 Content you provide

Posts, drafts, captions, hashtags, brand documents, media assets, and any text or files you upload as input to the AI agents.

2.4 Platform metrics

Public engagement metrics returned by each platform's official API (likes, comments, views, follower counts) for posts you publish through the Service. Stored to power the Analytics dashboard.

2.5 Usage and technical data

IP address, browser user-agent, pages visited, timestamps, and error logs. Used for security, abuse prevention, and reliability debugging. Retained for 90 days then aggregated.

3. Legal basis for processing (GDPR)

• Contract (Art. 6(1)(b)) — to provide the Service you signed up for: authenticating you, publishing on your behalf, generating content, billing.
• Consent (Art. 6(1)(a)) — for connecting each social platform; you may withdraw consent at any time by disconnecting the platform from the Connections page.
• Legitimate interest (Art. 6(1)(f)) — security logging, abuse prevention, and product analytics that do not identify you individually.
• Legal obligation (Art. 6(1)(c)) — when responding to lawful requests from authorities.

4. How we use your data

• To operate the Service and authenticate you
• To publish content to your connected accounts via official platform APIs
• To generate content with AI providers using context you have explicitly supplied
• To send transactional emails (account alerts, errors, post-published notifications)
• To detect, prevent, and respond to abuse, fraud, or platform-policy violations
• To improve and debug the Service

We never sell your personal data, share it with advertising networks, or use it to train third-party AI models for general purposes.

5. Sub-processors

We rely on the following infrastructure and AI sub-processors. Each one processes data only to deliver its stated function and under its own privacy commitments:

• Vercel Inc. — application hosting and CDN (USA / EU edge)
• Neon Inc. — managed PostgreSQL database (EU region)
• Railway Corp. — background worker hosting
• Anthropic PBC — AI text generation (Claude models)
• OpenAI, L.L.C. — AI text generation (GPT / Codex models, when configured)
• Google LLC — Gemini AI models, Imagen, Veo, YouTube Data API
• Replicate Inc. — AI image and video generation
• Resend, Inc. — transactional email delivery
• Meta Platforms Ireland Ltd, LinkedIn Ireland UC, TikTok Technology Ltd, X Corp., Google Ireland Ltd (YouTube API Services) — social platform APIs you explicitly connect

6. YouTube API Services

When you connect a YouTube channel, Steward Brand uses YouTube API Services to publish to and read from that channel. By connecting a channel you are also agreeing to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

6.1 What we access, and why

We request only two YouTube scopes, and only after you authorise them on Google's own consent screen:

• youtube.upload — to upload the video file you scheduled to your own channel. We upload exactly the bytes you provided; we do not alter your video.
• youtube.readonly — to read back the public view and engagement counts for the videos you published through the Service, and to confirm which channel you authorised. The title, description, tags and privacy status you chose are sent as part of the upload itself.

We never access channels that have not authorised the integration, we do not scrape YouTube, and we do not use YouTube data to build advertising profiles or sell it to anyone.

6.2 What we store, and for how long

Your encrypted OAuth tokens, your channel ID and public channel name, the video IDs of uploads made through the Service, and periodic snapshots of those videos' public metrics, which we refresh from the YouTube API while a video is recent so your analytics stay current. We keep this data only while your account is active. Disconnecting the channel deletes the stored tokens immediately, and deleting your account removes everything else — see section 10, “Your rights under GDPR”.

6.3 Revoking our access

You can disconnect the channel at any time from the Connections page inside Steward Brand. Independently of us, you can revoke Steward Brand's access to your Google account at Google security settings. To request deletion of the YouTube data we hold, email stewardbrandofficial@gmail.com.

7. International transfers

Some sub-processors are located in the United States. Where personal data is transferred outside the European Economic Area, the transfer relies on Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or an equivalent adequacy mechanism published by each provider.

8. Retention

We keep your account data for as long as your account is active. After you delete your account, identifying personal data is removed within 30 days, except where retention is required by law (e.g. invoicing records). Aggregated, non-identifying analytics may be kept indefinitely. OAuth tokens are deleted immediately on disconnect.

9. Security

OAuth tokens and AI provider keys are encrypted at rest with AES-256-GCM. All data in transit is protected by HTTPS / TLS 1.2+. Database access is restricted to authenticated application processes. Passwords are stored as bcrypt hashes only. We follow industry best practices but cannot guarantee absolute security; we will notify affected users without undue delay if a personal-data breach occurs that is likely to result in a high risk to their rights and freedoms (GDPR Art. 34).

10. Your rights under GDPR

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with equivalent protections, you have the right to:

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate or incomplete data; you can edit most fields directly in Settings.
• Erasure / right to be forgotten (Art. 17) — request deletion of your account and personal data via the data-deletion page.
• Restriction of processing (Art. 18) — ask us to pause processing while a dispute is resolved.
• Data portability (Art. 20) — receive your data in a machine-readable JSON export.
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent at any time (Art. 7(3)) by disconnecting platforms or deleting your account.
• Revoke our access to your YouTube channel or Google account directly with Google, at Google security settings. We use the YouTube API Services; the YouTube Terms of Service and the Google Privacy Policy apply to that use.
• Lodge a complaint with your local supervisory authority. In Portugal: Comissão Nacional de Proteção de Dados (CNPD).

To exercise any of these rights, email stewardbrandofficial@gmail.com or use the in-app data-deletion page. We respond within 30 days as required by Art. 12(3).

11. Cookies

We use only first-party, strictly-necessary cookies for authentication and tenant routing. We do not use advertising or third-party tracking cookies. Full details: Cookie Policy.

12. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

13. Automated decision-making

The Service uses AI models to draft content suggestions. Suggestions are not published automatically unless you have explicitly enabled an autonomy level that allows it. You remain in control and can review, edit, approve, or reject every post.

14. Changes to this policy

We may update this Privacy Policy. Material changes will be announced by email and the effective date above will be updated. Continued use after the new effective date constitutes acceptance.

15. Contact

Mário Filipe Vicente de Mineiro (data controller) — email stewardbrandofficial@gmail.com.