Privacy Policy

Last updated: 2026-10-15

Encoded Brands runs the Encoder, a paid brand-interview app that takes your inputs (your domain, your documents, your answers) and produces a Brand Context Protocol: a structured definition of your brand that you and your agents can use.

This policy says what we collect, what we do with it, who else sees it, and how to make us forget you.

It is plain on purpose. If anything below is unclear, write to us at the contact address at the end.

1. Who we are

The Encoder is operated by Estuary Group LLC, doing business as Encoded Brands ("we," "us"). We are based in the United States.

2. What we collect

Account data. Your name, email address, and any OAuth identifiers from the provider you signed in with. Handled on our behalf by Clerk.

Payment data. Your card details go directly to Stripe. We never see or store them. We receive only a transaction reference and payment status.

Brand and session data. The substance of the work: the domain you submit, the URLs you point us at, the documents you upload, the answers you give during the encoding interview, the interview dialog itself, and the BCP the Encoder produces from all of it.

Usage data. Basic analytics about how the Encoder and our website are used: pages viewed, broad device and referrer information, and aggregate engagement. We use two tools. Vercel Web Analytics is cookieless and collects no personal identifiers. Google Analytics sets cookies, so it loads only if you accept them in our cookie banner (see Cookies, below).

We do not run ad pixels, session replay tools, or third-party advertising analytics. We do not buy data from third parties to enrich your profile.

Connecting an AI assistant. You can connect Claude, ChatGPT, or Grok to one brand through our own sign-in (/api/agent/oauth). We store a record of each connection: which AI client, which brand, the access you granted, the consent version and a hash of the consent text you agreed to, and the times the connection was created, last used, and set to expire. We store only hashes of the access and refresh tokens. We do not store the tokens themselves. AI tools without a direct connector use the guided Encoder instead; they do not sign in through this OAuth flow.

The connection is limited to the brand you choose. It does not cover your other brands or your billing. The access you grant is authoring, management, or both. We tell owner from editor by your current access to that brand, not from a label the AI sends.

Teammates. An owner can invite editors and viewers by email. On a free brand, the first of those invites opens 30 days in which more editors and viewers can be added, up to 10 teammates besides the owner. After that, people already on the team keep their access. New invites stop, unless we extend the window. Registry Standard uses purchased seats for teammates. The owner is included. Teammates need a seat. Registry Certified can have up to 100 teammates. Approvers can be invited only on Registry Certified.

We store the invitee's email, role, and invite status (invited, active, or removed), who invited them, and a hash of the accept link. We send the invitation by email. The accept link works for 7 days. Sending it again starts a new 7 days.

Asking a colleague. With your confirmation of that person's name and email, your connected AI can email them up to 5 focused questions about the brand in one ask. Each brand can send at most 20 asks an hour and 100 a day. We store the colleague's name and email. When your AI sends them, we also store their role, department, and region. We store the questions, any short draft excerpts attached to them, the colleague's answers, and an optional source link they add. We store a hash of the answer link, not the link itself.

The email contains the questions. The answer page shows those questions and the excerpts, and nothing else from the brand. The colleague does not get brand access. Answers come back for the owner to approve. They do not change the brand until the owner uses them.

A colleague can answer in the browser, with no account. They can also connect Claude, ChatGPT, or Grok to that invitation alone. That connection can read the questions and excerpts, and can answer or decline them. It cannot read the rest of the brand, publish, approve, or manage people. For that connection we store which AI client they used, their email, their sign-in account, the consent version, and hashes of the tokens. It ends when the invitation expires, or sooner if they disconnect it.

Publication approvals. When a connected AI asks to publish, we email the owner a review of that exact version, including the changes. We log the request. We log the approval or the denial. The denial record stores who denied it, their verified email, the version, and a hash of the files. It does not store the brand text.

Categories under California law

For California residents, the categories of personal information we collect, as defined by the CCPA, are:

We collect these to provide and improve the service, as described in Section 3. We do not collect sensitive personal information as defined by the CCPA. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

3. How we use it

To deliver the service. We run the interview, do the extraction, produce your BCP, deliver it to you, and let you come back to your work later.

To communicate with you. We send email tied to your work: a confirmation when you subscribe or publish, billing and renewal notices, and occasional reminders if you start an encoding and do not finish. You can opt out of non-essential reminders at any time using the unsubscribe link in those emails or by writing to us. Essential account, billing, and transaction messages still apply.

To run an AI connection. We use the connection record to let the AI you chose work on the one brand you chose, to show it under Settings → AI connections, and to end it when you disconnect it, when it expires, or when your access to that brand ends.

The connection lasts up to 30 days. If it is not renewed for 7 days, it ends. While your AI keeps using it, short-lived access renews on its own, and it cannot run past those 30 days. You can disconnect it from Settings → AI connections. You can also tell your AI to disconnect. Removing the connection only inside Claude, ChatGPT, or Grok may not tell us. Disconnect it in Settings if you want the access to end.

What the AI can do depends on the access you grant. It can read that brand's files and the material used to build them. With authoring access it can prepare and save brand files. With management access, an owner's AI can also invite and remove teammates, manage who can see a private brand, set publication rules, verify the domain, and read access and publication history. An editor's AI can prepare and save drafts and ask you to approve publication. It cannot publish, approve changes, manage people, or verify the domain.

Publishing, and accepting a change to a published brand, still need the owner's approval of that exact version by email. The AI cannot approve that itself. Connecting does not publish files, take payment, or hand over private source material on its own.

The AI provider receives the brand content your AI reads through the connection. That happens in your own chat, under that provider's terms. We do not control how Anthropic, OpenAI, or xAI handle it there.

If we change the consent text, that connection cannot renew. You sign in again and agree to the new text. Access already issued ends within an hour.

To run a team. We use a teammate's email and role to send the invitation, to let them in, and to take access away when the owner removes them. Removing someone revokes their access to that brand, including a connected AI.

To ask a colleague. We use the colleague's name and email to send the questions, and we may email a reminder before the link expires. We use their answers as input for the owner. We may email the owner a status note that includes the colleague's email address. Where the GDPR applies, the lawful basis for the colleague's contact details and answers is the requester's legitimate interests.

A colleague can decline the invitation from the email, or decline a single question on the answer page. Declining stops that question or invitation. It does not erase what we already stored. A colleague can ask us to delete their answers and contact details by emailing privacy@encodedbrands.ai.

The answer link stops working 7 days after the ask was sent. Asking the same person again starts a new 7 days. Their earlier answers stay on the brand.

To approve publication. We email the owner so they can approve or deny one exact version before it is published. Nothing from that review goes live until they approve it. Opening the link does not approve, deny, or publish anything. A denial does not change the draft.

To review sessions and improve the Encoder. Members of our team may read your encoding session, including your uploaded documents, the interview dialog, and the BCP the Encoder produced. We do this to see where the interview works and where it fails, to tune our prompts, scoring, and pushback, to diagnose errors, to develop new features, and to handle your support requests. Access is limited to authorized personnel under confidentiality obligations. What we generalize from review, such as patterns, counters, and refinements to our methodology, is stripped of anything that identifies you or your brand before it is reused. Your identifiable content is never shown to another customer and never used in another customer's session.

Model training. We do not use customer-identifiable content to train machine-learning models. If we ever intend to, we will ask for your separate consent first. Anonymized and aggregated signals, which carry no identifier pointing back to you, are not customer-identifiable content.

To understand usage. We use the analytics described above to understand what is working and where the Encoder is confusing.

Our lawful bases, where the GDPR applies, are performance of contract (delivering the service), legitimate interests (reviewing sessions to improve and secure the service, and, for a colleague's contact details and answers, the requester's legitimate interests), and consent where required.

4. Who we share it with

We share data only with the service providers we need to run the Encoder. None of them may use your data for their own marketing or resell it. As of the date above:

• Clerk — authentication and account management
• Stripe — payments
• Supabase — database and file storage (United States)
• Vercel — application hosting and cookieless web analytics (United States)
• Google Analytics — cookie-based web analytics, loaded only if you accept cookies in our banner (United States)
• Cloudflare — DNS, edge delivery, and Registry hosting for published BCPs
• Anthropic — language-model API calls that power the interview and compile your BCP. API traffic is governed by Anthropic's commercial terms, which prohibit using customer prompts for training. This is our own use of Anthropic. It is separate from a Claude connection you choose yourself.
• Resend — delivery of account, invitation, approval, and lifecycle email
• Airtable — stores the copy of our lifecycle emails
• Context.dev — receives a brand's website domain to read that site and its visual style
• Brave Search — search queries about your brand and its market during open-web research
• Jina — a text-only read of a page you submitted, used when that page blocks an ordinary fetch
• Managed web retrieval (Zyte or Bright Data) — used only when we have turned it on, and only after an ordinary fetch and the text-only fallback both fail. It retrieves a page you submitted, or another page our research needs to read, when that page blocks ordinary automated access.

Claude, ChatGPT, and Grok are not in that list. When you connect one, you choose the assistant and you sign in with us. The brand content your AI reads goes back to that assistant under Anthropic's, OpenAI's, or xAI's own terms. We do not control what they do with it in your chat, and we do not treat them as our subprocessors for that connection.

We do not sell your data. We do not share it with advertisers or marketing partners. If we are required to disclose data to comply with a lawful legal request, we will narrow what we hand over and tell you where the law allows.

5. How long we keep it

We retain your account and session data for as long as your account exists. We do not auto-expire it, except for the records described below. Your BCP is meant to live with you.

When you publish your BCP, it becomes a public file at your domain and in our Registry, readable by anyone or any agent that fetches it. That is by design: the protocol works by being readable. A published BCP stays public until you unpublish or delete it.

You can delete your account and its data at any time. When you do, we remove your account, sessions, uploaded files, interview dialogs, and generated BCP from the systems we control within 30 days. We also delete the AI connections you hold, including on brands you were invited to, and their refresh tokens, so a connected AI cannot renew its access.

An AI connection stops working after 30 days, after 7 days without a renewal, or as soon as you disconnect it. Ending the connection stops the AI's access. Apart from account deletion, we do not have a set period that deletes the connection record itself.

We delete colleague asks, teammate invitations and publication records 24 months after they were created, unless you delete them, or the brand, sooner.

Colleague asks. We delete a colleague's name, email, questions, excerpts, answers, any source link, and any AI connection they made for that ask 24 months after the ask was created. Asking the same person again about the same brand restarts that clock. Answers you already used in the brand stay in the brand. The answer link stops working after 7 days, and declining does not delete the record. A colleague can ask us to delete their answers and contact details sooner, at the address in Section 12.

Teammates. We keep an active teammate's email, role, and invite status while they have access. Once you remove someone, or if they never accept, we delete the record 24 months after the invitation was created. An invitation you resent in the last 24 months is kept so its link still works.

Publication records. We delete publication history, finished proposals and their votes, and approval and denial records 24 months after they were created. A denial is measured from its latest request. Open proposals, and a publish that has not finished, are kept until they are resolved. An approval can be used only for that exact version, and it expires 15 minutes after the owner approves it.

One honest carve-out: anonymized and aggregated learnings already absorbed into our methodology and internal systems (for example, a counter that says "x percent of brands ship a sans-serif heading face," or a refinement to an interview question informed by past sessions) are not individually reversible. Those learnings carry no identifier that points back to you, and they survive deletion of your account.

6. Your rights and choices

Wherever you live, you can:

• See your data. Ask and we will tell you what we have.
• Export your data. Your BCP is yours. We will deliver it in machine-readable form on request.
• Delete your data. Delete your account in the app, or write to us and we will do it for you. A colleague who was asked about a brand, and has no account, can write to us to delete their answers and contact details.
• Correct your data. Most of it you can edit in the app. For anything else, write to us.
• Manage emails. Opt out of non-essential lifecycle emails at any time.

California residents have rights under the CCPA, including the right to know, correct, and delete personal information, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, so no opt-out is required. To exercise any right, email the address below. We will verify your identity, acknowledge your request within 10 business days, and respond within 45 calendar days. You may designate an authorized agent to make a request on your behalf.

EEA and UK residents have rights under the GDPR and UK GDPR, including access, rectification, erasure, restriction, portability, and objection, including the right to object to processing based on legitimate interests. You may lodge a complaint with your supervisory authority.

7. Security

We host the Encoder on Vercel and store data on Supabase. Data is encrypted in transit (TLS) and at rest. Service-role credentials never reach the browser. Our team uses single sign-on with hardware-key second factors.

No system is perfectly secure. If we discover a breach affecting your data, we will tell you promptly and tell you what we know.

8. Cookies

Strictly necessary cookies. A session cookie from Clerk so you stay signed in, transient cookies from Stripe during checkout, and Supabase auth cookies. These are required for the service to function and are always on.

Analytics cookies. Vercel Web Analytics is cookieless and always on. Google Analytics sets cookies and loads only if you accept them in the cookie banner shown on your first visit. You can decline, and you can change your choice at any time by clearing the banner's stored preference. We do not use advertising or cross-site tracking cookies.

9. Children

The Encoder is a business product. It is not directed at children and we do not knowingly collect data from anyone under 16.

10. International users

Your data is processed in the United States. Where the GDPR or UK GDPR requires a transfer mechanism, transfers of personal data from the EEA or UK to us rely on Standard Contractual Clauses in our capacity as data importer, or on another valid transfer mechanism in effect at the time. We will sign a Data Processing Agreement, incorporating the SCCs where applicable, on request.

11. Changes to this policy

We will update this policy when our practices change. The "Last updated" date at the top will move. If a change is meaningful, such as a new category of data, a new use, or a new subprocessor that materially changes the risk picture, we will email account holders before it takes effect.

12. Contact

Privacy questions, deletion requests, DPA requests, and anything else covered above:

privacy@encodedbrands.ai

Estuary Group LLC d/b/a Encoded Brands 1005 Northgate Drive, #193 San Rafael, CA 94903