Privacy Policy
Effective June 8, 2026
This policy explains how BM2 handles information through its website and brand media management service. It covers website visitors, people who contact us, account holders, and information processed in media workspaces. Where an organization supplies content to BM2, that organization controls its content and instructions; contact it first about information held in its workspace.
1. Information we handle
Account and workspace information: names, email addresses, password hashes, brand and workspace details, membership roles, and session records. We store password hashes rather than readable account passwords.
Content: uploaded or connected videos, audio, images, documents, filenames, metadata, transcripts, indexed passages, search embeddings, and content or outputs created through workspace features. Depending on what your team submits, media can contain personal information about other people.
Activity and technical information: requests to the service, IP addresses, browser and connection information, security and error logs, searches, processing jobs, and information necessary to operate features. The information recorded depends on the feature and infrastructure involved.
Inquiries: the name, email, company, approximate library size, and message you provide through our contact form. Do not submit passwords, payment card details, or sensitive media through that form.
2. How information is used
We use information to provide and maintain accounts and workspaces; store and deliver media; transcribe, index, and search content; process requested AI and media features; manage permissions; respond to inquiries and support requests; investigate errors and misuse; secure the service; and meet legal obligations. An accepted order or separate agreement may describe additional processing for your organization.
3. Service providers and disclosures
Payments: PayPal processes subscription checkout and payment details. When you open billing, your browser may connect to PayPal to load its checkout tools. Payment and subscription details are handled by PayPal. PayPal’s own privacy terms apply to its processing.
Information may be processed by providers of hosting, object storage, content delivery, network security, and AI or media-processing services as needed for the features you use. The website uses Google Fonts, so your browser may connect to Google to load fonts. Network and CDN providers can receive connection information when serving the site and media.
When an AI feature is used, relevant source content, prompts, or reference material may be sent to the configured provider. Provider handling and retention can vary by service, model, account, and settings. Ask about your proposed setup before submitting sensitive information; do not assume all processing stays on BM2’s servers.
Information may also be disclosed when required by law, to address security threats or enforce service terms, to protect rights and safety, or as part of a business transfer subject to applicable obligations. Your workspace administrator and authorized colleagues can access information according to their roles.
4. Media links and sharing
Some media is served using publicly accessible CDN links. A person with such a URL may be able to access the file without signing in. Treat those URLs as shared links and avoid distributing them outside your intended audience. A restricted workspace does not guarantee that every asset URL is restricted. Copies downloaded or shared by others may remain outside BM2’s control.
5. Cookies and browser storage
BM2 uses authentication and session cookies to keep you signed in and a form-security cookie to help protect submissions against cross-site request forgery. Authentication sessions currently expire after seven days; the anonymous form-security cookie is set for one hour. Browser storage may also hold feature preferences. Infrastructure providers may use security-related technologies. Blocking necessary cookies can prevent sign-in or forms from working.
The public site does not currently include an advertising pixel or an optional analytics integration in its page templates. If optional tracking is introduced, this policy and any required choices will be updated before that use.
6. Retention and deletion
Information is retained while needed to provide the service, maintain account and business records, respond to inquiries, resolve disputes, and meet legal obligations. Media, indexes, transcripts, generated outputs, inquiry records, and operational logs do not all share a single automatic deletion period. Backup copies and legal holds may affect when data can be fully removed.
To request closure, deletion, or an explanation of retention for your account, use our contact form. Identify the relevant workspace and describe your request without attaching sensitive information. If your employer or another organization controls the workspace, we may direct the request to its administrator or require its authorization.
7. Security
BM2 uses measures including hashed passwords, session checks, workspace permissions, and form-security checks. No storage or transmission method eliminates all risk. Protect your credentials, review workspace permissions, keep independent copies of important media, and report suspected unauthorized access through our contact form. Specific certifications, data-residency commitments, or regulatory assurances apply only if expressly agreed in writing.
8. Your choices and rights
Depending on where you live and our role in processing the information, you may have rights to access, correct, delete, restrict, or receive a copy of personal information, object to certain processing, or withdraw consent where processing relies on it. Requests are subject to applicable exceptions and identity verification. You may also have the right to complain to your local data protection authority.
Send requests through the contact form, stating “Privacy request” in the message. We may need to verify your identity and your authority over a workspace before acting. Do not send identity documents unless we request an appropriate verification method.
9. International processing and children
Hosting, infrastructure, and feature providers may process information in countries other than your own. If your organization requires a specific processing location or contractual transfer safeguards, confirm those requirements before using BM2 for the affected data.
BM2 is a business service and is not directed to children under 13. Do not create accounts for children or submit children’s personal information without the permissions and legal basis required for your use. Contact us if you believe a child has supplied personal information improperly.
10. Changes and contact
We will update the effective date when this policy changes and communicate material changes through the service or another reasonable channel. For questions about this policy or BM2’s handling of information, use the contact form and describe your privacy concern.