Privacy Policy
Our privacy policy and how we use your data
Last updated: 14 November 2026
This policy explains how Brainium Labs Pty Ltd (ABN 44 621 469 298) (“Brainium Labs”, “we”, “us”) collects, uses and shares personal information when you use Flow Bucket: our website at flowbucket.ai, the Flow Bucket web app and its client approval pages. Flow Bucket is an AI marketing agent: it learns a brand from its website, researches competitors, plans campaigns, makes posts and videos with AI and routes them through approval. We’re an Australian company bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If the EU or UK General Data Protection Regulation (GDPR) applies to you, this policy also explains your rights under it.
1. Our role
- Information about you as a user or visitor (your account, billing, support requests and website visits): we decide how it’s used, and we’re responsible for it (under the GDPR, we’re the controller).
- Information inside a customer’s projects (for example, people named in brand material, reviews kept as proof, uploaded photos and videos, or the names clients enter on an approval link): we handle it on behalf of the customer who owns the account, under our Terms of Service. The customer’s own privacy policy applies to it. If you want to access or correct that information, contact the customer; we’ll help them respond.
2. Information we collect
| Type | What it includes |
|---|---|
| Account | Your name, email address, password (stored only as a one-way hash), profile picture, preferences, two-factor settings, passkeys (a public key and the name you give it) and how you last signed in. If you sign in with Google, we receive your name, email address, profile picture and Google account ID, and store Google’s sign-in tokens encrypted. |
| Getting started | The answers you give when you set up a project: your first name, your role, who you sell to, your goals and whether you run ads. |
| Account and team | The account’s name, its members and their roles, which projects each member can open, and the email addresses of people you invite. |
| Billing and credits | Your plan, subscription status and Stripe customer ID, and a record of every credit grant, purchase and spend: the project, the person and the item it was for. Stripe collects your card and billing details; we never store full card numbers. |
| Brand and project content | Website and app store addresses you give us; the brand profile (identity, products, personas, positioning, tone of voice, rules, and proof such as reviews and figures); competitors, campaigns, posts and captions; files you upload (images, video, audio and documents); generated media; and the links and results you record for posts you publish yourself. |
| Websites and research | Content read from your website or app store page, and from public pages about competitors, with each item’s source address and the date it was read. These pages may include personal information that their owners published. |
| AI use | Your chats with the agent and its proposals; for each generated item, its format, model, prompt, inputs and cost; and a record of each model call and what it cost. |
| Client approval | The name a client enters when they open an approval link, and their decisions, comments and the time of each. |
| Activity log | A record of what was created, changed, approved, scheduled, spent or set in the account, with who did it (a member, the agent, a client through a link, or the system) and when. |
| Support | Emails you send us and our replies. |
| Technical | IP address, browser and device type, sign-in sessions, rate-limit and security records (which include IP addresses), and server and error logs (which can include your email address, IP address and the page you were on). |
We collect most of this from you directly. We also get information from your account’s owner or admins (when they invite you), from Google (if you sign in with Google), from Stripe (about payments), from your browser (through cookies and logs), and from the websites and public pages Flow Bucket reads for your projects.
You don’t have to give us personal information, but without an email address we can’t create an account for you. You can browse our website without an account, and a client can review posts through an approval link under any name they choose.
3. How we use it
| Purpose | GDPR legal basis |
|---|---|
| Providing Flow Bucket: accounts, sign-in, projects, brand profiles, research, campaigns, posts, approval links, the calendar and exports | Performing our contract with you |
| Running AI features when you or your team use them | Performing our contract with you |
| Billing, subscriptions and credits | Performing our contract; legal obligation (tax records) |
| Sending service emails: email confirmation, sign-in links, invitations, client decisions, failed posts, low credits, trial ending, failed payments and reminders when a post you publish yourself is due | Performing our contract with you |
| Answering support requests | Legitimate interests (helping you) |
| Keeping Flow Bucket secure: preventing abuse and fraud, allowing one free trial per brand, rate limiting and checking uploaded files | Legitimate interests (security) |
| Meeting legal obligations and enforcing our terms | Legal obligation; legitimate interests |
If we send marketing emails, we’ll only send them as the Spam Act 2003 (Cth) and other applicable laws allow, and every one will have an unsubscribe link.
4. AI features
Flow Bucket sends content to AI providers when someone in your account uses a feature that needs it:
- Anthropic’s Claude models plan campaigns, write captions and copy, answer chat, read websites and documents, and check content against your brand rules and proof.
- fal runs the models that generate images, video and voice.
Requests include the project context the task needs, such as the brand profile, the campaign, and uploads used as inputs. The providers’ own terms govern how they handle what we send them.
- Text read from websites, competitor pages and uploads is treated as data, and never followed as instructions.
- The agent can read a project and propose changes. It can’t publish, spend credits, connect accounts or change billing: a person in your account decides each of those. Every agent action is logged with its reason.
- The AI creators in Flow Bucket’s videos are synthetic. We don’t create a character based on a real person without a consent record.
5. Social media platforms
In the beta, Flow Bucket doesn’t connect to your social media accounts. You download a post with its caption and a checklist of the labels to switch on, publish it yourself, and can record its address and results in Flow Bucket. Before we add publishing to connected accounts, we’ll update this policy to explain what we receive from each platform.
Flow Bucket never likes, follows, comments or sends messages on anyone’s behalf.
6. Who we share it with
We use the service providers below to run Flow Bucket. They may only use personal information to provide their services to us.
| Provider | What they do |
|---|---|
| DigitalOcean | Hosts our servers, database and file storage (region: Sydney, Australia) |
| Anthropic | Language models (see section 4) |
| fal | Image, video and voice generation (see section 4) |
| Stripe | Subscription billing: checkout, payment details, invoices and the billing portal |
| SendGrid | Sending email from Flow Bucket |
| Google sign-in, if you use it | |
| Cloudflare | Turnstile checks that tell people and bots apart on our sign-up, sign-in and password-reset forms |
| Sentry | Error monitoring |
We also share personal information:
- Within your account: other members can see your name, email address, profile picture and activity in the projects you share.
- Through approval links: anyone with a link can see the posts in its batch, with their captions, planned dates and AI labels.
- With our professional advisers (such as lawyers and accountants), where needed.
- When the law requires it, or to protect the rights, safety or property of our users, the public or us.
- In a business sale: if we sell or transfer our business or Flow Bucket, personal information may transfer to the buyer, who must protect it as this policy describes.
A small number of our staff can access personal information when needed for support, security or to fix problems, including by temporarily signing in as a user to investigate an issue.
7. Cookies
We use only the cookies Flow Bucket needs to sign you in, keep it secure and remember your settings. We don’t use analytics or advertising cookies. Our Cookie Policy lists them.
8. Overseas disclosure
Some of our providers store or access personal information outside Australia, including in the United States. We take reasonable steps to make sure our providers protect personal information consistently with the Australian Privacy Principles, including through contracts. Where the GDPR applies, we rely on adequacy decisions or standard contractual clauses for transfers outside the EU or UK.
9. How we protect it
- Connections to Flow Bucket are encrypted with HTTPS.
- Passwords are stored only as hashes. Approval link codes are random and stored only as hashes. Sign-in and platform tokens are encrypted at rest, and never sent to your browser or written to logs.
- Project media is kept in private storage and opened through short-lived signed links. Files upload straight to storage and are checked after upload. Profile pictures and account logos are stored separately, at public addresses.
- Every request is limited to the account it belongs to, and our automated tests check that one account can’t read another’s data.
- You can protect your sign-in with an authenticator app or a passkey.
No system is perfectly secure. If a data breach is likely to cause serious harm, we’ll notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires, and other regulators where the law requires.
10. How long we keep it
- Projects: while the project exists. When the account owner deletes a project, it disappears at once, and its content and files are removed from our live systems within 30 days. Its activity log and credit records stay with the account until the account is deleted.
- Accounts: while the account is open. When the owner deletes it (after cancelling any subscription), its projects, members, activity log, credit records and files are removed from our live systems within 30 days.
- Your profile: when you delete your own profile, we remove it, but your name stays on the activity log and on approvals in accounts you belonged to, so those records stay accurate, until each account is deleted.
- Approval links: a link expires after 14 days unless the member who creates it chooses otherwise, and can be revoked at any time. Client decisions and comments stay with the project.
- Unfinished uploads: deleted within a day.
- Backups: we back up our database daily. Deleted data stays in backups until they expire, within 7 days.
- Billing records: for as long as tax law requires (in Australia, generally five years). Stripe keeps payment records under its own policy.
11. Your rights
You can ask to access the personal information we hold about you, or to correct it. You can update most account details yourself in your profile settings. You can export your posts with their captions at any time, and ask us for a copy of your account’s data.
If the GDPR applies to you, you can also ask us to erase your information, restrict or object to how we use it, or give you a copy in a portable format.
To make a request, email [email protected]. We may need to confirm your identity first. We’ll respond within the time the law requires and won’t charge you for a reasonable request. If we refuse, we’ll tell you why. For information inside a customer’s projects, contact that customer (see section 1).
12. Children
Flow Bucket is for businesses and isn’t intended for anyone under 18. We don’t knowingly collect personal information from children. If you think a child has given us personal information, contact us and we’ll delete it.
13. Complaints
If you have a concern about how we’ve handled your personal information, please contact us at [email protected]. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (1300 363 992). If you’re in the EU or UK, you can also complain to your local data protection authority.
14. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If we make significant changes, we’ll tell you by email or in Flow Bucket before they take effect.
15. Contact us
Brainium Labs Pty Ltd (ABN 44 621 469 298)
flowbucket.ai
[email protected]