Skip to content
Brandwagon

Privacy Policy

Last updated: 6 October 2026

Introduction

Winfluence AB ("we", "our", or "us") operates the Brandwagon application at app.brandwagon.ai ("Application") and this website at brandwagon.ai ("Website"). This privacy policy outlines how we collect, use, and protect the personal data of our users ("Users").

If you have questions, contact us at admin@brandwagon.ai.

Data Controller

Winfluence AB Ringkragevägen 36, 218 73 Tygelsjö, Sweden admin@brandwagon.ai

Role as Controller and Processor

Winfluence AB acts as the data controller for personal data relating to users of the Brandwagon Application and visitors to this Website, including account information, usage data, and service-related interactions.

When customers use Brandwagon to upload or process content containing personal data, Winfluence AB acts as a data processor, processing that personal data on behalf of the customer, who determines the purposes and means of such processing.

Types of Data Collected

Personal data may be provided directly by the User or collected automatically.

Mandatory Data

All data requested by the Application is mandatory unless specified otherwise. Refusing to provide such data may prevent us from delivering the Service.

Cookies and Trackers

Non-essential cookies and similar technologies are used only where you have consented to them. You can change or withdraw that choice at any time using the "Cookie preferences" link in the footer of this Website. See our Cookie Policy for the detail of what is set and why.

Detailed Information on the Processing of Personal Data

Analytics

PostHog (PostHog Inc.): a product analytics service used to understand how the Application and Website are used and to improve them.

Analytics that stores information on your device runs only after you consent.

In the Application, PostHog also provides feature flags: the switches that decide which parts of the Application are turned on for your account. To work out which apply to you, it receives your account identifier, your email address and the organisations you belong to. This happens even if you have declined analytics, because without it the Application cannot show you the parts that are turned on for you. When you have declined, PostHog records nothing about how you use the Application and stores nothing on your device. We rely on our legitimate interest in operating the Service for this.

Review links

People who open a review link shared through the Application ("Reviewers") are asked for their email address before the review opens. It is shown next to their approvals and comments to whoever shared the link, so they know who reviewed. Where a customer shared the link, we process the email address on that customer's behalf, as described under Role as Controller and Processor.

Reviewers can also choose to receive product news, tips and the occasional note from our team by email, by ticking a box that is unticked to begin with. Opening a review never depends on it. Where a Reviewer agrees, we are the controller of that consent: we keep when it was given and the wording it was given to. Every such email includes a link to unsubscribe, and consent can also be withdrawn by emailing admin@brandwagon.ai. Withdrawing it does not affect the review itself or the emails about it.

Marketing and advertising measurement

Meta Pixel (Meta Platforms, Inc.): used on this Website to measure the effectiveness of our advertising. It loads only after you consent to marketing cookies, and not at all if you decline.

Platform Services and Hosting

These services host and operate the Application and Website, and provide authentication, storage, database management and content processing.

Supabase (Supabase Inc.): database, authentication and storage. Personal data processed: account data, uploaded content, application data, and contact details submitted through forms on this Website. Place of processing: European Union.

Microsoft Azure (Microsoft Corporation): cloud infrastructure running the Application backend and its video-processing workers. Personal data processed: application data and uploaded content. Place of processing: European Union.

Vercel (Vercel Inc.): hosting and content delivery for the Application and Website. Personal data processed: usage data and technical data. Place of processing: global infrastructure, including the United States.

Google OAuth (Google LLC): optional sign-in provider. Personal data processed: account information and authentication data. Place of processing: United States.

Resend (Resend, Inc.): sends the Application's email, such as invitations, submission and review notifications, and reminders. Personal data processed: recipient email addresses, and the names and content included in each message. Place of processing: European Union (Ireland) and the United States.

Automated content analysis

Google Cloud / Vertex AI (Google LLC): analyses uploaded video and related content to produce automated checks against brand guidelines, campaign briefs and our content policy, and to generate the structured results the Service is built on.

ElevenLabs (ElevenLabs Inc.): voice and audio processing features used within the Service.

Connected Ad Accounts

When you connect an advertising account, you authorise us to read advertising performance data on your behalf so we can relate it to the deliverables you manage. Access is read-only: we cannot create, edit or pay for ads, or post on your behalf. You can disconnect at any time in Settings → Integrations; see Data Deletion for details.

Meta Marketing API (Meta Platforms, Inc.)

TikTok API for Business (TikTok Technology Limited)

Where personal data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses approved by the European Commission are used.

Data Processing and Retention

Methods of Processing

We implement appropriate technical and organisational security measures to protect personal data. Processing is carried out using secure IT systems and may involve authorised personnel and approved third-party service providers.

Location of Processing

Personal data is primarily processed within the European Union. Some data is processed by approved service providers outside the European Economic Area, in which case appropriate safeguards are applied in accordance with the GDPR.

Data Retention

Personal data is retained only as long as necessary to provide the Service and fulfil the purposes described in this policy, unless a longer retention period is required by law.

Contact details submitted through forms on this Website are retained for as long as we are in contact with you about Brandwagon, and are deleted on request at any time by emailing admin@brandwagon.ai.

A Reviewer's email address is kept with the review link it was given for and deleted when that link is deleted, or earlier on request. A record of that consent, and of its withdrawal, is kept for as long as we hold the address, so that we can show what was agreed to.

Purposes of Processing

Legal Basis for Processing

User Rights (GDPR)

You have the right to withdraw consent at any time; to object to processing on grounds other than consent; to access your data; to have inaccurate data corrected; to restrict processing; to request deletion; to receive your data in a structured, machine-readable format; and to lodge a complaint with a supervisory authority. In Sweden this is Integritetsskyddsmyndigheten (IMY).

To exercise any of these rights, email admin@brandwagon.ai.

Legal Action

Personal data may be used for legal purposes in court or in the stages leading to possible legal action arising from improper use of the Service.

Changes to this Privacy Policy

We reserve the right to update this policy at any time. Where required by law, we will notify users of material changes.

Winfluence AB · Ringkragevägen 36 · 218 73 Tygelsjö · Sweden · admin@brandwagon.ai