Privacy Policy

1. Information We Collect

We collect the following categories of personal and non-personal data:

• Account Information: Name, email address, password (hashed), company name, phone number, and role — collected during registration.
• Profile Information: Company details, tagline, headquarters, founding year, industry, sector, key contact details, leadership information, product/service descriptions, logos, and cover images — provided by you during profile creation.
• Social Media Links: LinkedIn, Twitter/X, Instagram, YouTube, and website URLs — provided voluntarily for display on your profile.
• Video Content: Videos recorded through BrandStage (Quick Bites, leadership interviews, testimonials), including associated metadata (recording date, duration, resolution).
• Testimonial Data: Guest testimonials collected via your profile's booth link, including the guest's name, organisation, consent record (timestamp, IP address), and video content.
• Payment & Subscription Data: Subscription plan, billing period, payment status, invoice records, and coupon usage. Payment card details are processed securely by Razorpay and are never stored on BrandStage servers.
• Consent Records: Explicit consent captured at sign-up, before video recording, at checkout, and for marketing communications — including timestamp, IP address, and consent type.
• Event & Invitation Data: Event details, guest lists, RSVP responses, and invitation delivery status for events created through the platform.
• Usage & Analytics Data: Pages visited, features used, profile view counts, time spent on pages, device type, browser, IP address, and referral sources.
• Communication Data: Emails sent via the platform (invoice emails, renewal reminders, event invitations) and their delivery/open status.

2. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Consent: For marketing communications, analytics cookies, testimonial collection, and video recording. You may withdraw consent at any time.
• Contractual Necessity: To provide the services you have subscribed to — including profile hosting, video processing, email signature generation, and subscription management.
• Legitimate Interest: To improve our services, prevent fraud, ensure platform security, and communicate service-related updates (e.g. renewal reminders).
• Legal Obligation: To comply with tax, accounting, and regulatory requirements, including maintaining invoice records and responding to lawful data requests.

3. How We Use Your Information

We use the data we collect for the following purposes:

• Service Delivery: Creating, hosting, and managing your company profile; processing and branding videos; generating email signatures, QR codes, and downloadable resources.
• Subscription Management: Processing payments, generating invoices, managing plan renewals and upgrades, and applying promotional coupons.
• Communication: Sending transactional emails (invoice receipts, renewal reminders), event invitations, and marketing communications (with your consent).
• AI-Powered Features: Generating profile descriptions, translating content into multiple languages, and calculating readiness scores using third-party AI services. Your data is processed by AI solely for the purpose you requested and is not used to train AI models.
• Analytics & Improvement: Understanding how our services are used, identifying areas for improvement, and measuring engagement with profiles and features.
• Security & Fraud Prevention: Protecting accounts, detecting suspicious activity, enforcing our Terms of Service, and preventing abuse.

4. Profile Privacy & Link-Only Access

BrandStage profiles are private by design. This is a core principle of our platform:

• Profiles are not indexed by search engines (Google, Bing, etc.) and are not listed in any public directory.
• Only individuals who have your unique profile link can view your profile page.
• You control who receives your profile link. BrandStage does not distribute profile links without your authorisation.
• Profile analytics (view counts, engagement data) are visible only to the profile owner and platform administrators.
• You may unpublish your profile at any time, making it immediately inaccessible to anyone with the link.

5. Video Content, Testimonials & Consent

• Your Videos: Videos you record or upload are stored securely on Cloudinary. Processed videos may include BrandStage branding (intros, outros, lower thirds) and are delivered to your registered email and displayed on your profile.
• Guest Testimonials: When guests record testimonials via your booth link, we capture explicit consent (timestamp, IP address, consent text) before recording begins. This consent record is stored in compliance with DPDP and GDPR requirements.
• Video Deletion: You may request deletion of any video at any time. We will remove the video from our platform and cloud storage within 30 days of the request.
• No Sale of Content: We do not sell, license, or share your video content with third parties. Your content is used solely for the purposes you have authorised.

6. Subscription & Payment Data

• All payments are processed through Razorpay, a PCI-DSS compliant payment gateway. BrandStage does not store credit/debit card numbers, CVVs, or other sensitive payment credentials.
• We retain subscription records (plan type, start/end dates, payment amounts, invoice numbers) for accounting and tax compliance purposes.
• Automated PDF invoices are generated for each transaction and may be sent to your registered email and to platform administrators.
• Coupon and promotional code usage is recorded for analytics and fraud prevention.

7. AI-Powered Features & Data Processing

BrandStage uses third-party AI services to power certain features:

• Profile Content Generation: Company descriptions and taglines generated using AI based on information you provide.
• Multi-Language Translations: Profile content translated into multiple languages using AI translation services.
• Readiness Scoring: Digital readiness assessments generated based on your profile completeness and content quality.

Data sent to AI services is limited to the specific content required for the feature. We do not share your full profile or account data with AI providers. AI-generated content is provided as a suggestion — you review and approve all content before it appears on your profile.

8. Data Storage & Security

We implement robust security measures to protect your data:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
• Secure Cloud Infrastructure: Data is stored on secure cloud servers with role-based access controls, automated backups, and monitoring.
• Password Security: User passwords are hashed using industry-standard algorithms (bcrypt). We never store passwords in plain text.
• Access Controls: Employee and administrator access to personal data is restricted on a need-to-know basis and protected by authentication.
• Incident Response: We maintain an incident response plan and will notify affected users and relevant authorities within 72 hours in the event of a data breach, as required by GDPR and DPDP.

9. Data Sharing & Third-Party Processors

We share data only as necessary to provide our services and with appropriate safeguards:

• Razorpay (Payment Processing) — Subscription payments, refunds, and invoice generation. Razorpay Privacy Policy
• Cloudinary (Media Storage & Delivery) — Video and image hosting, processing, and CDN delivery. Servers in US/EU.
• MongoDB Atlas (Database) — Application data storage. Servers in multiple regions with encryption at rest.
• Resend (Email Delivery) — Transactional and marketing emails. US-based.
• AI Service Providers — Content generation and translation. Data is processed per-request and not retained by providers for training.
• Google reCAPTCHA — Bot detection and abuse prevention during form submissions.

We do not sell your personal data to any third party. We may disclose data when required by law, court order, or to protect the safety, rights, or property of BrandStage, our users, or the public.

10. Your Rights

Depending on your location and applicable law (DPDP Act 2023, GDPR), you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Deletion: Request deletion of your personal data and account. We will comply within 30 days, except where retention is required by law.
• Right to Data Portability: Request your data in a structured, machine-readable format for transfer to another service.
• Right to Withdraw Consent: Withdraw consent for marketing, analytics, or any processing based on consent, at any time without affecting prior processing.
• Right to Restrict Processing: Request that we limit how we use your data while a complaint or correction request is being resolved.
• Right to Object: Object to processing based on legitimate interest, including profiling and direct marketing.
• Right to Complain: Lodge a complaint with the Data Protection Board of India (under DPDP) or your local supervisory authority (under GDPR).

To exercise any of these rights, contact us at operations@brandstage-media.com or write to our Grievance Officer (see Section 16). We will respond within 30 days.

11. Cookies & Tracking Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, understand usage patterns, and improve your experience. We use a cookie consent banner that allows you to accept or reject non-essential cookies.

For full details on the types of cookies we use, how to manage them, and third-party cookies, please refer to our Cookie Policy.

12. Data Retention

• Active Accounts: Data is retained for as long as your account is active and your subscription is valid.
• Inactive Accounts: If your subscription expires and is not renewed, your profile is unpublished but your data is retained for 12 months to allow reactivation.
• Deleted Accounts: Upon account deletion request, personal data is permanently erased within 30 days. Anonymised analytics data may be retained.
• Legal Retention: Invoice records, payment data, and consent records are retained for up to 7 years as required by Indian tax and accounting regulations.
• Video Content: Videos are deleted from cloud storage within 30 days of a deletion request or account closure.

13. International Data Transfers

Your data may be transferred to and processed in countries outside India:

• Cloud Storage (Cloudinary): Videos and images — servers in US/EU.
• Database (MongoDB Atlas): Application data — servers in multiple regions with encryption at rest.
• Email Services (Resend): Email delivery — US-based.
• Payment Processing (Razorpay): Payment data — India-based with international processing capabilities.

For transfers outside India and the EU, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where applicable, to protect your data in accordance with DPDP and GDPR requirements.

14. Children's Data

BrandStage is a business-to-business platform designed for professionals and organisations. Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a minor, we will delete it promptly.

15. Automated Decision-Making

BrandStage uses automated processing for the following purposes:

• Readiness Scoring: An automated assessment of your profile's completeness and digital presence. This score is informational only and does not restrict access to any service.
• AI Content Generation: Automated generation of profile descriptions and translations. All AI-generated content requires your review and approval before publication.
• Renewal Reminders: Automated emails triggered by subscription expiry dates.

No automated decision has a legal or similarly significant effect on you. You may request human review of any automated output by contacting us.

16. Grievance Officer (India DPDP Act 2023)

In accordance with the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address any concerns or complaints regarding data processing:

17. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, data practices, or legal requirements. When we make material changes, we will notify you via email or a prominent notice on the platform at least 14 days before the changes take effect. The "Last updated" date at the top indicates when the policy was last revised.

18. Contact Us

For privacy-related questions, data access requests, or to exercise any of your rights, contact us: