Privacy Policy
BrightMinds Digital Marketing Corporation, a Philippine corporation with SEC registration number CS20200000946 and registered business address at Unit S13, 2nd Floor, Robertson Plaza, Kawit, Cavite, Philippines, operates BM-i Studio under the BM-i brand and is the personal information controller for the processing described here. In some business workspaces the customer is the controller and we act as its processor.
Information we collect
- Account and profile data: name, email, authentication records, role and organization.
- Billing and transaction data: plan, invoices, payment status, tax and fraud signals. Full payment-card details are handled by our payment partner, not stored by us.
- Customer Content: prompts, text, files, images, video, audio, logos, brand information, comments and generated assets.
- Face, likeness and voice material uploaded for presenter, character, avatar or voice features. We do not use it to identify people.
- Workspace and collaboration data: memberships, permissions, assignments, approvals and activity history.
- Connected-service data: the account details and authorization tokens needed to publish to or read from platforms you connect.
- Usage and technical data: device, log, cookie, diagnostic, approximate location and security information.
- Other: support messages, surveys, referral and affiliate data, and records the law requires us to keep.
We receive this from you, your organization's administrators, services you connect, payment and sign-in providers, referrals, and your use of the Service.
Why we use it, and our legal bases
We use information to provide accounts and the features you contract for; generate, edit, review, schedule and publish content; bill and administer subscriptions; secure and troubleshoot the Service; prevent fraud and abuse; provide support; comply with law; improve reliability and experience through protected analytics; and send service messages or, with your consent, marketing.
Depending on the context and applicable law, our legal bases are performing our contract with you, our legitimate interests in operating and securing the Service, your consent, compliance with legal obligations, and establishing or defending legal claims. Where we rely on consent you can withdraw it at any time; this does not affect earlier lawful processing.
AI processing, training and Astrid
Prompts and Customer Content are sent to the AI and infrastructure providers we contract with only to deliver and secure the features you use.
- We do not use your content to train or fine-tune AI models, whether our own or anyone else's, unless you separately opt in through a clear control.
- We are putting no-training terms in place with our providers, and we use the settings that stop training on content sent through our service wherever a provider offers them. We review this when we add or change providers.
- Astrid learns within your workspace. To make results fit your brand, the Service keeps your brand information, review feedback and, where you allow it, approved posts as references for your workspace. This stays in your workspace, is not used for other customers, is not model training, and you can view, remove or switch it off in the Brand Kit.
- We may use de-identified or aggregated operational data that does not identify a person or reveal confidential content.
Face, likeness and voice
We process uploaded face, likeness and voice material only to perform the feature you request, keep your asset library, prevent abuse and meet legal obligations. The uploader must have documented authority from every person shown or recorded. We collect separate, express consent before voice cloning, custom characters or avatars, or any other processing that legally requires it. We do not sell this material.
Sharing
We share only what is reasonably necessary with:
- service providers that process data for us, in these categories: hosting and infrastructure, AI and media generation, payments, email and communications, and storage, plus security and error monitoring;
- platforms you connect, at your direction;
- your organization's Owners and Admins, according to role permissions;
- professional advisers and transaction counterparties under confidentiality; and
- authorities or others when the law requires it, or to protect rights and safety.
We do not sell personal information and do not share it for targeted advertising. Business customers can request the full list of providers under a confidentiality agreement at privacy@bm-i-suite.com.
YouTube integration (YouTube API Services)
BM-i Studio uses YouTube API Services so you can connect your own YouTube channel and upload videos you make in the Service. If you connect a YouTube channel, Google's handling of your data is covered by the Google Privacy Policy.
Current availability. The YouTube integration is in limited availability while Google reviews our use of YouTube API Services. Until that review is complete, YouTube keeps every video uploaded through the Service as Private. We will update this policy when that changes.
What we access. Only when a workspace Owner or Admin connects a channel and approves Google's consent screen do we receive:
- the channel's ID and name, so the Service can show which channel a video will go to;
- the permissions you granted: to upload videos, and to read basic channel information. We use the read permission only to identify the connected channel. We do not read your videos, comments, subscribers or analytics; and
- authentication tokens (an access token and a refresh token) that let the Service act within those permissions.
How we use it. We use this data only to connect the channel, show which channel a video is going to, and upload videos to it. Every upload uses the title, description, visibility and made-for-kids setting that a member with scheduling permission confirmed and authorized for that video, and nothing is uploaded without that authorization. After an upload we keep the YouTube video ID with the post to show it was published. We do not use YouTube data for advertising, we do not sell it, and we share it only with Google and YouTube to perform the upload. BM-i Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
How we store it. Tokens are encrypted at rest and decrypted only to make a request you authorized. The channel ID and name are stored with your workspace's connection, and the upload details you confirm are stored with the post.
Retention and deletion. We keep the connection only while the channel stays connected. When you disconnect YouTube, we delete the stored tokens, channel ID and channel name straight away and ask Google to revoke the access you granted. If you revoke access through Google instead, we delete the stored tokens the next time the Service tries to use them. Access tokens themselves expire within an hour. Upload details and YouTube video IDs stay with the post as part of your content history and are deleted with the post, the workspace or your account as described under “How long we keep it”. Videos already uploaded remain on YouTube until you delete them there.
Revoking access. You can disconnect YouTube at any time in BM-i Studio under Settings → Social accounts, or remove BM-i Studio's access from your Google Account at myaccount.google.com/permissions.
Questions. Email support@bm-i-suite.com. Google's sign-in screens show our contact as support.bmistudio@bm-i-suite.com; both addresses reach the same support team.
Workspaces and client data
Owners and authorized Admins can access workspace content, membership, activity and audit information, so do not place personal content in an employer or client workspace. A business customer decides the purposes of processing its clients' data; requests about that data should normally go to that customer, and we will assist as our contract and the law require.
International transfers
Information may be processed outside your country where our providers operate. We use lawful safeguards suited to each transfer, such as contracts, adequacy mechanisms, transfer risk assessments and additional security measures. You can ask about them at privacy@bm-i-suite.com.
How long we keep it
We keep personal data only as long as needed for the purposes above, the customer relationship, security, dispute resolution and legal obligations. After a verified deletion request, account content is deleted or irreversibly de-identified within 30 days, and encrypted backups age out within 35 days, unless a legal hold or longer mandatory period applies. Billing, tax, fraud and consent records may be kept for their legally required or defensible period. Content already published to another platform must be removed on that platform. See the Data Deletion Policy.
Security
We use organizational, physical and technical safeguards suited to the risk, including access controls, encryption where appropriate, logging, vendor review, incident procedures and staff confidentiality. No system is perfectly secure. Please protect your credentials and set member access carefully.
Your rights
Subject to the law, you may ask to be informed about and access your data, correct it, object to or restrict processing, have it erased or blocked, receive a portable copy, withdraw consent, and have qualifying automated decisions reviewed. You may also complain and claim damages where the law allows. In the Philippines you may complain to the National Privacy Commission; residents of the EU or UK may complain to their supervisory authority. We verify identity and authority before acting and may keep data where the law permits or requires.
Cookies, marketing and children
Our Cookie Policy explains the cookies and browser storage we use. You can opt out of marketing messages and still receive service notices. The Service is not directed to anyone under 18 and we do not knowingly create their accounts. Content showing minors is subject to strict consent and safety rules.
Business transfers, legal requests and changes
Information may transfer in a financing, reorganization, corporate separation, merger, acquisition, insolvency or asset sale, including a future lawful transfer of the BM-i business to a separately incorporated company, subject to the law, confidentiality, required notice and continued protection. A proposed future BM-i company does not control personal data unless and until such a transfer takes effect. We assess government requests and disclose only when legally required. Material changes to this policy get reasonable notice and a new effective date.
Contact our Data Protection Officer
Data Protection Officer, BrightMinds Digital Marketing Corporation
Privacy requests: privacy@bm-i-suite.com
Support: support@bm-i-suite.com
Post: Unit S13, 2nd Floor, Robertson Plaza, Kawit, Cavite, Philippines
Website: bm-i-suite.com