Privacy Policy

BranStory — a product of Brandmerce, LLC

Effective Date: April 2026 Last Updated: April 2026

Brandmerce, LLC (“Brandmerce,” “BranStory,” “we,” “our,” or “us”) is committed to protecting the privacy of everyone who uses the BranStory platform — operators who license the platform, members of operator networks, and visitors to branstory.com.

This Privacy Policy explains what information we collect, how we use it, how we share it, and the rights you have over it.

1. Scope

This policy applies to:

• The branstory.com website
• The BranStory web application and APIs
• BranStory iOS and Android applications
• Community networks operated directly by BranStory under its own brand names

A note for members of operator-run networks: If you are a member of a community network powered by BranStory but operated by a third-party operator (e.g., a chamber of commerce, business association, or master-planned community that licenses BranStory), that operator is the data controller for your personal data. Brandmerce processes your data as a data processor on their behalf. That operator’s own privacy policy governs your relationship with them. This policy governs Brandmerce’s own data practices.

2. Information We Collect

Information You Provide

• Account registration: Name, email address, and password (hashed — never stored in plain text)
• Operator profile: Organization name, contact information, billing address, and business details
• Member profile: Neighborhood or location, profile photo, bio, and preferences
• Business profile: Business name, address, hours, photos, service descriptions, team member names, and contact information
• Verification documents: For businesses undergoing KYC (Know Your Customer) verification — business license, tax identification documents, and proof of address. These are stored in a private, access-controlled storage environment.
• Payment information: Billing is processed entirely by Stripe, Inc. We store transaction records (amount, date, plan, status) but never store credit card numbers, bank account details, or other payment credentials.
• Communications: Emails, support requests, and demo inquiries you send to us
• User-generated content: Reviews, event RSVPs, deal redemptions, job postings, and any other content you submit to the Platform

Information Collected Automatically

• Device and browser data: Device type, operating system, browser type, and IP address
• Usage data: Pages visited, features used, session duration, clicks, and interaction patterns
• Performance data: Page load times, error logs, and technical diagnostics used to maintain Platform stability
• Push notification tokens: If you opt into push notifications, a device token is stored server-side (associated with your account) to enable delivery
• Cookies and similar technologies: See our Cookie Policy for full details

Information From Third Parties

• If you authenticate via a third-party provider (e.g., Google OAuth), we receive basic profile data as authorized by you at the time of authentication
• Business profile data may be pre-populated using publicly available information from Google Places during the business onboarding process
• Stripe provides transaction confirmation data and subscription status updates to our systems

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Platform
• Process operator and member billing and subscriptions
• Send transactional communications — account confirmation, password reset, billing receipts, verification status updates, event reminders, and deal notifications
• Send marketing and product communications to operators and prospects (opt-out available in every email)
• Personalize the member experience within operator networks, including the social discovery feed
• Administer business verification document reviews
• Provide customer support and respond to inquiries
• Enforce our Terms of Service, Acceptable Use Policy, and Trust & Safety Policy
• Analyze usage patterns to improve platform features and performance
• Comply with applicable legal obligations
• Protect the security and integrity of the Platform

We do not use your data to serve third-party advertising. We do not sell personal data to any third party, ever.

4. How We Share Your Information

With Operators

If you are a member of an operator’s network, that operator has access to your profile data and activity within their network as part of operating that community. Their privacy policy governs how they use that data.

Within Operator Networks

Certain member profile information is visible to other members by design — this is core to how local community networks function. This includes your name, profile photo, neighborhood, public reviews you post, and business profiles. Operators control additional visibility settings within their networks.

With Service Providers (Sub-Processors)

We share data with trusted third-party service providers who process it on our behalf under written data processing agreements:

For Legal Compliance

We may disclose information when required by applicable law, court order, regulatory request, or to protect the rights, property, or safety of Brandmerce, our operators, members, or the public.

Business Transfers

In the event of a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify operators of any material change and their options.

We do not share personal data with advertisers, data brokers, or unaffiliated third parties for their own marketing purposes.

5. Operator Data Responsibilities

Operators are independent data controllers for their members’ personal data under applicable privacy law (including GDPR and CCPA where applicable). Brandmerce acts as a data processor on operators’ behalf. Operators are responsible for:

• Having a lawful basis for collecting and processing member data
• Publishing their own privacy policy to their members
• Responding to member data rights requests
• Ensuring their use of member data complies with all applicable laws

Operators and Brandmerce enter into a Data Processing Agreement (DPA) as part of the Operator Agreement. The DPA governs the specifics of Brandmerce’s data processing obligations on behalf of each operator.

6. Data Retention

We retain personal information for as long as an account is active or as needed to provide services.

• Account deletion: Personal data is deleted or anonymized within 30 days of account closure
• Transaction records: Retained for 7 years for legal and accounting purposes
• Verification documents: Retained for the minimum period required by applicable KYC compliance standards, then securely deleted
• Anonymized analytics data: May be retained indefinitely in aggregate, non-identifiable form

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention obligations)
• Portability: Request your data in a machine-readable, portable format
• Objection / Restriction: Object to or request restriction of certain types of processing
• Withdrawal of consent: Where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise your rights: Email privacy@brandmerce.com. We will respond within 30 days or the timeframe required by applicable law.

Marketing opt-out: Every marketing email contains an unsubscribe link. You can also update communication preferences in your account settings at any time.

Push notification opt-out: Disable push notifications via your device settings or within the app’s notification preferences at any time.

Florida Residents: Florida privacy law may provide additional rights. Contact us at privacy@brandmerce.com for more information.

EEA / UK Residents: If you are located in the European Economic Area or United Kingdom, you have rights under the General Data Protection Regulation (GDPR) or UK GDPR. Brandmerce’s lawful bases for processing include contract performance, legitimate interests, and, where required, your consent. You have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.

8. Security

We implement industry-standard technical and organizational measures to protect personal data, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encryption at rest for stored data in our database infrastructure
• Role-based access controls limiting internal staff access to personal data
• Private, access-controlled storage for business verification documents
• Regular security reviews and infrastructure audits

No system is completely secure. In the event of a data breach affecting personal data, we will notify affected parties as required by applicable law and within the timeframes required by those laws.

9. Children’s Privacy

The Platform is intended for users 18 years of age and older. We do not knowingly collect personal information from individuals under 13. If you believe we have inadvertently collected such information, contact us immediately at privacy@brandmerce.com and we will delete it promptly.

10. International Data Transfers

Brandmerce, LLC is based in the United States. If you access the Platform from outside the United States, your data may be transferred to and processed in the United States and other countries where our service providers operate. We implement appropriate safeguards for international transfers as required by applicable law, including standard contractual clauses where required.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify operators via email with at least 30 days’ advance notice. The “Last Updated” date at the top of this page always reflects the most recent revision. The current version is always available at branstory.com/privacy-policy.

12. Contact

For privacy questions, requests to exercise your rights, or data-related concerns:

Privacy Officer: privacy@brandmerce.com Brandmerce, LLC · Nocatee, Florida

BranStory is a product of Brandmerce, LLC. © 2026 Brandmerce, LLC. All Rights Reserved.