Privacy policy

Who we are

Brand Labs is a sole proprietorship (eenmanszaak) of Brandon McKinney, registered in the Netherlands. We decide how the personal data described here is used. Questions or requests go to [email protected].

This policy covers this website and Bromo, the software we build and use to run Instagram accounts that we own or manage for clients, such as @augmentic.

Visiting this website

• Delivery and security. Cloudflare delivers the site and protects it from abuse. Like any web server, it sees your IP address, browser and the pages you request.
• Visit counts. We count visits with GoatCounter, running on our own server. It uses no cookies and doesn't track you across sites. It records the page, the site that sent you, your browser, screen size and country, but not your IP address.
• Contact. Our forms open your own email app, so we only receive what you choose to send us. Booking a call takes you to Calendly, which has its own privacy policy.

Instagram accounts connected to Bromo

We connect an Instagram professional account to Bromo only when we own it or its owner has asked us to manage it. Through Meta's Instagram API we then receive that account's ID, username and profile picture, its posts and captions, the comments on its posts, its post metrics (such as reach, saves and shares) and the access token Meta issues.

We use this to plan, publish and measure that account's content. Posts, captions and metrics may be processed by Claude, Anthropic's AI model, to write performance notes and content ideas for the account's team.

If you comment on or message an account that uses Bromo

Some accounts use Bromo's Comment → DM feature: comment a chosen word on a post and the account sends you a direct message with a link, for example to a free guide. If the account asks you to follow it first, Bromo checks whether you follow it after you tap the button in that message or reply to it, never before.

When you comment that word, Instagram sends us your comment. We keep:

• your Instagram-scoped user ID and username;
• your comment, the post it's on, and when you wrote it;
• the messages we send you, and your taps on their buttons or your replies;
• whether you follow the account, once you've tapped or replied;
• whether and when you opened the link we sent.

We use this to send you what you asked for, to avoid sending it twice, and to show the account's team totals such as how many people asked and how many opened the link.

Separately, Bromo keeps a short raw log of what Instagram sends it, which includes every comment on the account's posts and every message sent to the account, whether or not it contains the word. We use it only to check the automation is working.

We don't sell this data, use it for advertising, or send it to AI models. The legal basis is your request: you commented the word to get the link. Meta processes your Instagram activity under its own privacy policy.

Who else handles the data

• Hetzner hosts our server in Germany, where Bromo's data is stored.
• Cloudflare delivers this website and the links we send.
• Meta runs Instagram and its API.
• Anthropic provides Claude, which reads connected accounts' posts and metrics as described above.

Some of these providers may process data outside the European Union, under their own safeguards for international transfers.

How long we keep it

• Comment → DM records are kept while the account runs the automation they belong to, and deleted on request.
• The raw log keeps only the latest 1,000 entries; older ones are deleted automatically.
• A connected account's data and access token are kept until that account is disconnected and its owner asks us to delete them.

Your rights

Under the GDPR you can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it, or receive a copy. Email [email protected] and we'll reply within one month. To have your data deleted, see data deletion. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Security

Bromo runs on our own server. Access tokens never leave it, and only our team can reach the dashboard, over a private network.

Changes

If we change this policy, we'll update it here and change the date at the top.