← Brand Mirror

Privacy Policy

Last updated July 18, 2026

Brand Mirror is a diagnostic tool that shows how AI answer engines represent a brand. This policy explains what we collect when you run an analysis, why, and who processes it on our behalf. We keep it plain because the tool is simple: we collect the minimum needed to run your analysis and nothing to sell.

What we collect

  • Your email address, when you provide it, so we can associate your analyses with you and apply usage limits.
  • The inputs you enter — the brand name, competitor names, and buyer prompts you choose to run.
  • Analysis results we generate for you, so the report can be produced and shown back to you.
  • Your IP address, used only to enforce rate limits and prevent abuse. It is not used to build a profile of you.
  • Your OpenAI API key, if you provide one for the Full Audit, is held in your browser tab only and sent with each analysis request over HTTPS. Our server uses it for that request's OpenAI calls and never stores, logs, or caches it. It is gone from your browser when the tab closes, and you can remove it at any time.

How we use it

We use your inputs solely to run the analysis you requested, to display the results, and to enforce fair-use limits. We do not sell your data, we do not use it for advertising, and we do not share it except with the service providers below who help us run the tool.

Who processes it

To run an analysis, your inputs pass through these providers, each under its own terms:

  • OpenAI — runs the AI prompts and web searches that power the analysis.
  • Supabase — stores your email and analysis records.
  • Upstash — stores short-lived counters used for rate limiting.
  • Cloudflare — provides an invisible bot check on form submission.
  • Vercel — hosts the application.
  • Google Analytics 4, when enabled, measures anonymous product usage — which pages and steps are used, and whether analyses complete. It records a randomly generated analytics identifier and coarse technical details, and it does not identify you personally. We never send your brand input, buyer questions, email, API key, report links, or any personal data to analytics. Advertising personalisation is not enabled.

Retention

We keep your email and analysis records so you can return to your results and so usage limits work as intended. Rate-limit counters expire automatically. You can ask us to delete your data at any time and we will remove it promptly.

Your choices

You may request access to, correction of, or deletion of your data by emailing us. We respond to every request from a real person.

Contact

Questions or requests about your data: dheerajtibrewal@gmail.com.

If we make material changes to this policy, we will update the date above and, where appropriate, notify you by email.