BrandForge

GDPR overview

GDPR compliance is stated in explicit terms and documented in detail. eCommerce Services B.V. acts as data controller for its own customers and as processor for the end users of its white-label partners, under a Data Processing Agreement. Four legal bases are named with their articles: contract performance 6(1)(b), legitimate interest 6(1)(f), consent 6(1)(a) and legal obligation 6(1)(c). Eight data subject rights are listed, with a stated response time of thirty days and possible identity verification. Breaches are to be notified within seventy-two hours. The supervisory authority is named as the Dutch Autoriteit Persoonsgegevens, with its postal address. A dedicated erasure page sets out a request process with verification inside forty-eight hours and deletion within thirty days. The minimum age is sixteen. Transfers outside the EEA rely on Standard Contractual Clauses, adequacy decisions or the EU-US Data Privacy Framework.

Who owns the data?

Customers keep ownership of everything they put in — prompts, business descriptions, uploaded images and configuration choices — and grant the vendor only a limited licence to process that material in order to run the service. The brand assets the AI produces are assigned to the customer on creation, with a perpetual, worldwide, royalty-free licence covering commercial and personal use. eCommerce Services B.V. explicitly disclaims any intellectual property right over the generated logos, colour palettes and websites. What the vendor retains is the platform itself: its code, design, AI models, algorithms and trademarks. Two reservations are stated: outputs are not guaranteed to be unique, and AI-generated material may not qualify for copyright protection in every jurisdiction.

Reuse rights

Yes. Customers may use, modify, reproduce and distribute the generated brand assets for any lawful commercial or personal purpose without asking further permission, under a licence described as perpetual, worldwide and royalty-free. Assets created on a free plan carry the same ownership terms as paid ones, although the free tier may add a "Powered by BrandForge" mark that paid plans remove. Two duties stay with the customer. First, checking trademarks: the vendor runs no clearance search and places responsibility for infringement squarely on the user. Second, accepting that similar prompts from different customers may yield similar results, since the vendor neither monitors nor prevents this. Reselling access to the platform itself requires a separate Partner Agreement.

Data retention & training

Hosting summary

The vendor states that BrandForge is operated from the European Union and that its primary infrastructure runs on AWS in the eu-central-1 region in Frankfurt, Germany. Customer websites are published to Frankfurt by default, and specific workloads can be run on-premise on request. Third-party processors are disclosed with their data locations: Stripe and Mollie for payments (EU and US under Standard Contractual Clauses), Zoho CRM in its EU data centre, AWS in the EU, Anthropic and OpenAI in the US for model inference, and an EU transactional e-mail provider. Transfers outside the EEA rely on Standard Contractual Clauses, adequacy decisions or the EU-US Data Privacy Framework. Data is encrypted with TLS 1.2 or higher in transit and AES-256 at rest, with automated encrypted backups. One caveat: the domain resolves to a Cloudflare anycast address geolocated in the United States, which reflects the content delivery network and not where the application or its data are hosted.