This Privacy Policy describes how GoBrandReady, a property of BrandrAI, Inc., a Delaware corporation, with offices at 5 Cowboys Way, Suite 300-48, Frisco, Texas 75034 ("GoBrandReady," "we," "us," or "our"), collects, uses, shares, and protects personal information when you use our brand-operations platform, websites (gobrandready.com, app.gobrandready.com), Managed Website Service, Federal Compliance Brand Kit, Local Compliance Checklist, and related services (collectively, the "Service").
This Privacy Policy is incorporated by reference into our Terms of Service and Refund Policy.
1. Who This Policy Applies To
This Privacy Policy applies to all visitors to gobrandready.com, account holders of the GoBrandReady platform, customers of the Federal Compliance Brand Kit and Local Compliance Checklist, and recipients of GoBrandReady marketing communications. It does not apply to information you provide to third-party sites linked from the Service.
About cannabis-vertical customers specifically: If you are an operator in the cannabis, hemp, kratom, peptide, functional mushroom, or other restricted-vertical industry, this Privacy Policy applies to all data we collect about your operations, brand, and team. We do not share customer data with state or federal regulators except when legally compelled by valid subpoena, court order, or other binding legal process.
2. Information We Collect
2.1 Information You Provide
- Account information: name, email, phone, business name, role, brand name, legal entity
- Operational data: states of operation, license numbers (kept confidentially, never published), product categories, SKU counts, dispensary distribution data, marketing channels in use
- Brand assets: logos, product photos, packaging templates, voice and tone documentation, brand-guide content, COAs, lab results, and related materials you upload to the Brand Vault
- Payment information: payment-card details collected and tokenized by our payment processor. GoBrandReady does not store full payment-card numbers. We receive only a tokenized customer ID, the last four digits of the card, and the card brand.
- Communications: emails, contact-form submissions, support tickets, demo-call recordings (with consent)
2.2 Information Collected Automatically
- Usage data: pages visited, features used, time spent on platform, login times
- Device data: IP address, browser type, operating system, device identifiers
- Cookies and similar technologies: session cookies for authentication, analytics cookies for site improvement (you can disable in your browser; some Service features may not work)
3. How We Use Your Information
| Purpose | Information Used |
|---|---|
| Provide and operate the Service | Account info, operational data, brand assets, usage data |
| Generate state-aware compliance outputs | Operational data (states, license numbers, product categories), brand assets |
| Process payments and manage subscriptions | Payment info, account info |
| Communicate about the Service | Email, account info |
| Improve the Service and develop features | De-identified usage data; aggregated, anonymized customer metadata |
| Marketing of similar services to existing customers | Email (opt-out available) |
| Comply with legal obligations | As required by applicable law, subpoena, or court order |
4. How We Share Your Information
4.1 Sub-Processors
We use third-party service providers ("Sub-Processors") to operate the Service. Current Sub-Processors include payment processing, cloud hosting (Azure, DigitalOcean), email delivery (Resend), customer support, analytics, and AI providers (Anthropic, OpenAI) for compliance-output generation. We maintain a current list of Sub-Processors that is available on request.
4.2 AI Providers — Important Note
- GoBrandReady does not permit third-party AI providers to retain customer brand content for training their models. Where contractually available, we configure providers to use enterprise/no-train data plans.
- State-aware compliance output generation may involve AI providers processing operational data (state, product categories, marketing channels) on a per-request basis without persistent storage.
4.3 Cannabis-Vertical Data Sharing
We do not share customer data with state cannabis regulators (OCM, CRC, DCC, MSDH, CCD, ADHS, OMMA, FDOH-OMMU), federal agencies (DEA, FDA), or law enforcement except when legally compelled by valid subpoena, court order, or other binding legal process. We will notify you of such requests where legally permitted to do so.
4.4 Business Transfers
If GoBrandReady or BrandrAI is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify customers of any change in ownership or control of personal information.
4.5 We Do Not Sell Your Personal Information
GoBrandReady does not sell, rent, or trade personal information to third parties for their marketing purposes.
5. Legal Bases for Processing (EEA/UK Customers)
- Performance of a contract: account provisioning, billing, Service delivery
- Legitimate interests: Service improvement, fraud prevention, security, direct marketing to existing customers
- Consent: marketing emails to new prospects, cookies for analytics (where required)
- Legal obligation: tax records, AML compliance, response to lawful requests
6. Data Retention
We retain account and operational data for the duration of your subscription plus a 90-day export window after cancellation. After the export window closes, we delete or anonymize customer data, except where retention is required by law (e.g., tax records, ongoing dispute response). Aggregated, de-identified data may be retained indefinitely for product improvement.
7. Your Rights
Depending on your jurisdiction, you may have rights to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Delete your personal information (subject to legal retention obligations)
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent (where consent is the legal basis)
- Opt out of marketing communications at any time
To exercise these rights, email privacy@gobrandready.com. We respond within 30 days.
8. Security
We use industry-standard security measures including TLS/SSL encryption in transit, encryption at rest for sensitive data, access controls, and regular security review. No system is 100% secure; we cannot guarantee absolute security.
9. Children
The Service is intended for business use by adults in licensed regulated industries. We do not knowingly collect information from children under 18. If you believe we have collected information from a child, contact privacy@gobrandready.com.
10. International Transfers
GoBrandReady operates primarily in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses (SCCs) or equivalent safeguards for international transfers from the EEA/UK.
11. California Privacy Rights (CCPA/CPRA)
California residents have specific rights under the California Consumer Privacy Act, including the right to know, the right to delete, the right to correct, the right to opt out of "sale" or "sharing" of personal information (we do not sell or share for cross-context behavioral advertising), and the right to non-discrimination. To exercise these rights, email privacy@gobrandready.com.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email to account holders at least 30 days before they take effect, except where immediate change is required by law. The "Last Updated" date at the top of this Policy reflects the most recent revision.
13. Contact
For privacy questions, requests, or complaints:
- Email: privacy@gobrandready.com
- General inquiries: partners@gobrandready.com
- Mailing address: BrandrAI, Inc. (GoBrandReady), 5 Cowboys Way, Suite 300-48, Frisco, Texas 75034