This Privacy Policy describes how BroadcastFlow AI(“BroadcastFlow”, “we”, “us”) collects, uses, shares, and protects personal information when you use our website, applications, and related services (the “Service”).
1. Information We Collect
1.1 Information you provide
- Account data: name, email address, station name, role, time-zone, and password (hashed). If you sign in via Google, we receive your name, email, and profile picture from Google.
- Billing data: handled by Stripe. We store only a customer reference, plan, subscription status, and last-4 of payment method — we never see your full card number.
- BYOK credentials: the API keys you connect for third-party providers (OpenAI, Google AI, Anthropic, ElevenLabs, Stability, Epidemic Sound, etc.). These are encrypted at rest in our database and decrypted only at request time to call the provider.
- Content you upload: audio files, scripts, brand kits, logos, generated images and video, blog posts, social posts, RSS feeds, podcast episodes, schedules, and similar broadcast content.
- Communications: support requests, feedback, and any information you share when you contact us.
1.2 Information we collect automatically
- Usage data: pages viewed, features used, button clicks, session length, and error logs — used to operate, secure, and improve the Service.
- Device data: IP address, browser type, operating system, time-zone, and approximate location (city-level) derived from your IP.
- Cookies: session and preference cookies necessary to keep you signed in and remember your settings. We do not use third-party advertising cookies.
1.3 Information from third parties
When you connect a social platform (e.g. Meta, X, TikTok, YouTube, LinkedIn, WhatsApp Business, Spotify, Apple Podcasts), we receive only the scopes you authorise — typically the ability to post on your behalf, read your channel metadata, and retrieve basic profile info. We do not read private messages or personal data from your followers.
2. How We Use Information
We process personal information to:
- Operate, secure, and improve the Service;
- Generate AI output you request (text, voice, image, video, captions, translations);
- Publish, schedule, or syndicate content to the platforms you connect;
- Process payments, manage subscriptions, and prevent fraud;
- Send transactional and service emails (e.g. provider-down alerts, password resets);
- Provide support and respond to your enquiries;
- Comply with legal obligations and enforce our Terms.
We do not sell your personal information. We do not use Your Content or AI Output to train our own AI models.
3. AI Providers and Your Prompts
When you use AI features, your prompt and any associated content are sent to the provider you selected (OpenAI, Anthropic, Google, ElevenLabs, etc.) in order to generate a response. Those providers process the data under their own terms and privacy policies. Some providers offer “no training” modes when used via API — we use those defaults wherever supported. We recommend reviewing the privacy policies of any provider you enable.
4. Sharing of Information
We share personal information only with:
- Service providers who operate parts of our infrastructure (cloud hosting, MongoDB Atlas, email delivery via Resend, payment processing via Stripe, error monitoring). These vendors are bound by confidentiality and data-protection agreements.
- AI & integration providers you have explicitly connected, only to fulfil the requests you initiate.
- Authorities when required by law, valid legal process, or to protect rights, safety, or property.
- Successors as part of a merger, acquisition, or sale of assets, subject to standard confidentiality safeguards.
5. International Transfers
BroadcastFlow operates globally. Your information may be processed and stored in countries other than the one in which you live. We use appropriate safeguards (such as standard contractual clauses) for transfers of personal data from the European Economic Area, the United Kingdom, and Switzerland.
6. Retention
We retain personal information while your account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. You may delete content at any time from the dashboard; some data (e.g. invoices) may be retained longer where legally required.
7. Security
We protect your data with TLS in transit, encryption at rest for sensitive fields (including BYOK keys), role-based access control, least-privilege production access, application-level rate limiting, and audit logging. No system is perfectly secure; you are responsible for keeping your credentials safe and notifying us of any suspected breach of your account.
8. Your Rights
Depending on where you live, you may have the right to access, correct, port, restrict the processing of, or delete your personal information; to object to certain processing; and to withdraw consent at any time. To exercise these rights, write to privacy@broadcastflow.ai. We will respond within the time required by applicable law.
If you are in the European Economic Area, United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority.
9. Children
The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
10. Cookies & Tracking
We use a small number of strictly-necessary cookies (e.g. your session cookie) and lightweight first-party analytics to understand product usage. We do not use third-party advertising or cross-site tracking cookies. You can control cookies through your browser settings, but disabling them may prevent the Service from working.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, for material changes, notify you by email or via the Service before the change takes effect.
12. Contact
Questions, requests, or concerns about this policy? Write to privacy@broadcastflow.ai.
This Privacy Policy is provided as a starting point and has not been reviewed by legal counsel. You should consult a qualified lawyer in your jurisdiction (and, if you handle EU personal data, a DPO or GDPR specialist) before relying on it in production.