Privacy and Data Trust

One standard for everyone

PersonalBrandOS is run from South Africa, so South Africa's Protection of Personal Information Act (POPIA) governs how we handle your information. We apply it the same way to every user, wherever you live. If the law in your country gives you more rights than this page describes, you have those too.

Where your information goes

Your account and everything you save are stored in a database in London, United Kingdom, run by Supabase. The app itself runs on Vercel. When you use an AI feature, the text that feature needs is sent through OpenRouter to the AI model provider for that task. Emails are sent through Resend, background jobs run on Inngest, and payments go through PayFast in South Africa. Several of these providers are based in the United States, so your information is handled outside your own country and outside South Africa.

Your rights, wherever you are

You can export or delete everything from Settings, and correct anything on the page where you entered it. The rights listed on this page apply to you whether you live in South Africa, Botswana, Kenya or anywhere else.

If something is wrong

Email us first and we will put it right. If you are not satisfied, you can complain to South Africa's Information Regulator, or to the data protection authority in your own country.

You sent an enquiry through a freelancer's page, a speaking invitation through a creator's speaker page or a partnership proposal through a business's partner page; a freelancer or a business owner keeps you in their client, customer, investor or partner list; or a creator tracks a talk, podcast or panel you invited them to or they pitched to you

What we hold:

If you used the form on their page: the name, email address and message you typed (and, for a speaking invitation, the event and its date; for a partnership proposal, your company), and when you sent it. No IP address or device details are kept with it. If they added you themselves: what they typed, such as your name or your event's name, what the work or talk is, a link or email, notes, a value or fee, an event date and follow-up dates, and any proposal they write for you.

Why:

So they can reply and keep track of the work or the talk. It appears in their private Clients, Customers, Investors, Partners or Speaking list.

Who sees it:

Only that freelancer. It is never shown on a public page. If they turned on follow-up reminders, your name and a short summary of the work can appear in a reminder email we send them through our email provider (Resend).

AI:

Only when the freelancer or business writes a proposal for you, or a customer story about finished work: the details they see and can edit before sending (what the work is, what you needed, what was done and the result, with you described rather than named) are sent to the AI provider to draft it. Your name, email address and link are never sent. Nothing else about you is sent to any AI provider.

Kept:

Until the freelancer deletes it, resets their data, or closes their account.

Your choice:

Ask the freelancer to delete it, or email us and we will deal with the request.

You wrote a testimonial for a user

What we hold:

Your name, job title and company, the words you wrote, a contact detail if you gave one, the places you agreed it may appear, and when you agreed. If the user copied in a recommendation you wrote on LinkedIn, it is kept unused, shown nowhere and never sent to an AI provider, until you confirm it through the link they send you; if you ignore the link, it stays unused until they delete it.

Why:

So the user can show your words in the places you agreed to: their profile and CV, their LinkedIn posts, or their public page.

Who sees it:

The user who asked you. In public, only the places you ticked, shown with your name, title and company. Your contact detail is never shown publicly.

AI:

Only if you ticked LinkedIn posts. Then, when the user drafts content, bios or positioning with AI, your words and your name and role can be included as evidence in what is sent to the AI provider. If you ticked only a CV or a public page, your words are never sent to an AI provider.

Kept:

Until you withdraw it or the user deletes it. Withdrawing erases your words and details and keeps only a record that a testimonial was withdrawn.

Your choice:

Reply to the message that asked you for it, or email us, to have it withdrawn.

A user added you to their Target List, the people whose posts they plan to comment on

What we hold:

Your name and a link to your profile, which the user either typed or captured with our browser extension while viewing your LinkedIn profile, plus a one-line note on why you matter to them and the dates they logged engaging with your posts or messaging you. The extension takes only your name and profile link, and only when the user clicks it. Nothing else is collected from LinkedIn or anywhere else, and nothing is collected automatically.

Why:

Reminding the user to engage with your public posts, and suggesting when to send you a message.

Who sees it:

Only that user. It is never shown on a public page.

AI:

If the user asks for help writing a message to you, your first name, their note about you and anything they type about your posts are sent to the AI provider to draft it. Your full name and profile link are not.

Kept:

Until the user deletes you from the list, resets their data, or closes their account.

Your choice:

Ask the user to remove you, or email us.

A user saved one of your public posts

What we hold:

The text of the post and the link to it, as the user saved it. No separate author details are stored.

Why:

So the user can come back to a post that inspired them.

Who sees it:

Only that user.

AI:

Never used as facts about the user. The text is sent to the AI provider only if the user chooses to write their own post based on it.

Kept:

Until the user deletes it or closes their account.

Your choice:

Ask the user to delete it, or email us.

You visited a user's public page or speaker one-sheet

What we hold:

A daily count of visits and of clicks on each button or link on that page. No name, IP address, cookie or device detail is stored with a count. Your IP address is used for a moment in our server's memory to stop abuse, and is not saved.

Why:

So the page owner can tell whether their page is working, for example whether anyone clicks their main button.

Who sees it:

The page owner sees the totals.

AI:

Never sent to AI.

Kept:

While the page owner's account exists.

Your choice:

Nothing identifies you, so there is nothing to remove. These pages set no tracking cookies and load no analytics or advertising scripts.