1. Who we are and Data Controller
The Brand Box is an interactive visual identity and digital stationery creation platform operated by PETTERSEN LUNT DESIGN.
Legal Name: PETTERSEN LUNT DESIGN, responsible for The Brand Box
Organization Number: 932 370 956
Privacy Contact: thebrandbox@sonhodepapel.com
2. Data we collect
We collect only the data strictly necessary to provide the briefing experience and deliver your brand materials:
- Identity & Contact Data: Name/nickname and email address.
- Project & Brand Data: Brand name, business industry, visual preferences, tone of voice, colors, and selected patterns.
- Consent Records: Voluntary opt-in records for marketing communications and product news, including timestamp and consent version.
- Transaction & Purchase Data: Plan selection history (e.g., Pro, Single purchase) and Stripe payment session identifiers (we do not store credit card details on our servers).
- Technical Log Data: IP address, browser type, operating system, and system access logs for security purposes.
3. How we collect data
Data is collected directly when you fill out the initial step ("Before we start"), progress through the interactive briefing questions, and complete checkout.
4. How we use your data
- Save your project progress and allow you to resume your session later.
- Generate printable PDF templates and digital assets for your brand.
- Send essential transactional emails (your permanent project link and brand name update notices).
- Send news, useful content, and special offers from The Brand Box (only with your explicit opt-in consent).
- Prevent fraud and ensure application cybersecurity.
5. Legal basis for processing (GDPR & LGPD)
We process personal data under the following legal bases:
- Contract Performance: sending project links and providing access to your purchased files.
- Consent (GDPR Art. 6(1)(a)): sending optional newsletters and promotional offers.
- Legitimate Interests: improving platform usability and providing customer support.
- Legal Compliance: retaining security logs as required by applicable legislation.
6. How we use Artificial Intelligence
We utilize artificial intelligence models from OpenAI and Google (including Gemini and Imagen) exclusively to process your creative preferences, generate tagline suggestions, brand diagnosis, and pattern designs.
Secure Processing: Your briefing responses are processed securely via dedicated technical APIs for immediate asset generation without unauthorized data sharing.
7. Third-party services and data recipients
Data is shared exclusively with essential infrastructure providers:
- Supabase Inc.: database hosting and lead records.
- Vercel Inc.: web application hosting and edge infrastructure.
- InMotion Hosting (SMTP): transactional project email delivery.
- OpenAI & Google LLC (Gemini and Imagen): creative AI generation.
- Stripe Inc.: payment processing and secure checkout.
8. Payments and Stripe
All payment transactions are handled directly by Stripe. The Brand Box does not store or process full credit card numbers or sensitive banking details.
9. Essential emails and optional marketing
- Essential (Transactional) Emails: sent to deliver your project link and order confirmations. These do not require promotional opt-in.
- Optional Marketing: sent only if you check the box in the form. You can unsubscribe at any time via the link in any promotional email.
10. Cookies, logs and analytics
We use browser local storage (`localStorage`) to maintain your project session (`brandbox_session`). We do not use invasive third-party tracking cookies without prior notice.
11. International data transfers
Since our technology providers (Supabase, Vercel, Stripe, Google, OpenAI) operate global infrastructure, your data may be transferred and processed internationally under standard data protection safeguards.
12. Data retention periods
We retain personal data and project files for as long as necessary to fulfill the purposes outlined in this policy:
- Unfinished projects: retained for up to 12 months after the last activity.
- Purchased projects and generated assets: retained for up to 24 months after delivery.
- Tax, accounting, and payment records: retained during the applicable statutory period, typically 5 years.
- Marketing data: retained until consent is withdrawn.
* Deletion requests will be fulfilled prior to these periods when no legal retention obligation exists.
13. Data Security
We enforce SSL/TLS encryption across all connections, strict database access controls, and server-side API key protection to secure your data.
14. Your Rights (GDPR & LGPD)
You have the right to request at any time:
- Access to your personal data.
- Correction of inaccurate or incomplete data.
- Deletion of your personal data.
- Restriction or objection to processing.
- Data portability.
15. How to withdraw consent
You can withdraw marketing consent at any time by clicking "Unsubscribe" in any marketing email or contacting our privacy contact at thebrandbox@sonhodepapel.com.
16. Data erasure and portability
To request permanent erasure of your lead records, please contact thebrandbox@sonhodepapel.com.
17. Children's Privacy
Our platform is intended for users aged 18 and older. We do not knowingly collect data from children without parental consent.
18. Changes to this Privacy Policy
We reserve the right to update this policy at any time. Material changes will be posted on this page with an updated revision date.
19. Contact Us
For questions or privacy requests:
Legal Name: PETTERSEN LUNT DESIGN
Privacy Contact: thebrandbox@sonhodepapel.com
Brand: The Brand Box
20. Right to Lodge a Complaint
If you have any questions or concerns regarding the processing of your personal data, we recommend that you first contact us at thebrandbox@sonhodepapel.com so we can review and try to resolve the matter.
You also have the right to lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority, or another competent supervisory authority where applicable. More information is available on the Datatilsynet website.