Privacy Policy | Visual Brand Blueprint

About this policy

This Privacy Policy describes how Visual Brand Blueprint (“VBB”), at vbb.genaiunplugged.com, handles your data. It is supplemental to the GenAI Unplugged Privacy Policy (the “Master Privacy Policy”), which covers company-wide practices, your regional privacy rights (including CCPA and GDPR), and contact information for data-subject requests. In the event of a conflict, the Master Privacy Policy controls.

Data controller

GENAI UNPLUGGED LLC (Pennsylvania, USA) is the sole data controller for VBB. AI Meets Girlboss (“Pinkie”) is a marketing and brand-strategy partner and the author of the licensed brand framework behind VBB; it is not a joint controller and does not receive or process your personal data. See “Third-party processors” below for the full list of parties who do process data on our behalf.

What we collect

License-holder email and a masked license label (e.g., ls:AB12…7Z9Q) — obtained when we validate your license key against Lemon Squeezy at connect time. We never store your raw license key.
Interview answers and tool choice — what you type into the guided conversation (brand identity, tone, current visuals, the AI image tool you use, and similar), held only for the duration of your build.
Uploaded screenshots and reference images — screenshots of your Substack or website and reference images you share inside your own AI client during the conversation; processed transiently to build your Blueprint.
Image prompts — text prompts, built from your answers, sent to our image-generation providers to render your reference sheet and other visuals.
Audit log entries — for every tool call: your email, the tool name, and a timestamp. We never log your license key, your answers, or any uploaded content in the audit log.
Image-spend log entries — your email, the image model used, the cost, and a timestamp, for cost reconciliation and refund-eligibility review.
OAuth tokens — bearer access and refresh tokens issued when you connect, held by your AI client. VBB does not set any browser cookie.

How we use it

To validate your license and confirm you are entitled to use VBB (Lemon Squeezy).
To run the guided interview and generate your color system, style direction, and SUCCESS/archetype read.
To generate on-brand images server-side and return them to you inline (OpenAI, Google).
To assemble your four deliverables from your build’s data.
To maintain a security and abuse-prevention audit trail.
To reconcile image-generation cost against your purchase and investigate refund requests.
To provide customer support.

We do not use your interview answers, uploads, or generated deliverables to train any AI model, and we do not sell them.

Third-party processors

Processor	Purpose	Data sent	Retention
Cloudflare	Hosts the Worker, D1 database, KV storage, and R2 object storage — all VBB infrastructure	Interview answers, flow state, audit logs, OAuth tokens, generated brand images (stored in R2), request metadata	Per the retention periods below; Cloudflare’s own infra logs per its standard policy
Lemon Squeezy	Merchant of record: payment processing, VAT, receipts, license issuance/validation, refunds	Your email, purchase details, license key (validated server-to-server; raw key never stored by us)	Per Lemon Squeezy’s own privacy policy
OpenAI	Server-side image generation (primary model)	Image prompt text built from your answers; optional reference image data	Per OpenAI’s API data-retention terms; not persisted by us beyond the request
Google (Gemini)	Server-side image generation (fallback model)	Image prompt text; optional reference image data	Per Google’s API data-retention terms; not persisted by us beyond the request

Your own AI client (Anthropic Claude or OpenAI ChatGPT) is the tool you choose to connect VBB to. We do not engage it as a processor on your behalf: it is controlled by you and governed by its own provider’s terms and privacy policy. VBB does not see or control what your AI client does with your broader conversation outside the tool calls it makes to us.

Sessions & cookies

VBB does not set any tracking or session cookies. Authentication uses OAuth 2.0 with PKCE: your AI client holds a bearer access token (expires after about 1 hour) and a refresh token (expires after about 90 days), which it presents on each request. These tokens are not cookies, are not accessible to your browser, and are not used for cross-site tracking.

Retention

License-holder email + masked license label: retained for as long as your license/account relationship is active, and for a reasonable period afterward for support and refund/dispute records, unless you request deletion sooner.
Interview answers and derived build data (flow state): stored in Cloudflare KV with a 7-day expiry, so a build can span up to a week; after that, unfinished flow data is automatically deleted.
Uploaded screenshots and image prompts: processed transiently to build your Blueprint and to call our image providers; not persisted in a VBB database after your build.
Finished text deliverables (brand rules doc, reusable skill, Claude Design brief): assembled from your flow data and returned to you inline in your AI client. VBB does not keep a separate copy of these documents on its own servers.
Generated images (reference sheet, moodboards): stored in Cloudflare R2 object storage so you receive a durable link to your brand assets. These are retained until you request deletion; email support@genaiunplugged.com to have them removed.
Audit log (tool calls): 90 days, then purged by an automated daily job.
Image-spend log: 90 days, then purged by the same automated job.
OAuth access/refresh tokens: expire automatically per the TTLs above (access ~1 hour, refresh ~90 days).

International transfer

VBB’s infrastructure runs on Cloudflare’s network with logical data storage in the United States (Cloudflare Workers, D1, and KV). Our image-generation providers (OpenAI, Google) may process prompt data in the United States or other jurisdictions per their own terms. See the Master Privacy Policy for the company-wide international-transfer position.

Co-brand data note

AI Meets Girlboss (“Pinkie”) does not receive any customer data. Their role is limited to authoring the brand-strategy content that VBB’s tools draw on and receiving a revenue share on sales, both of which are handled without any customer personal data changing hands.

Your rights

Your data-subject rights (access, correction, deletion, and regional rights under CCPA and GDPR) are described in the Master Privacy Policy. For VBB specifically, you can:

Request deletion of your license-holder email, masked license label, and any remaining flow data by emailing support@genaiunplugged.com.
Ask us to confirm what audit or image-spend log entries exist for your email.
Disconnect the VBB connector from your AI client at any time, which stops any further tool calls and lets your access tokens expire naturally.

Conflict with Master Privacy Policy

Nothing in this product Privacy Policy expands, reduces, or overrides the Master Privacy Policy. If a provision here conflicts with the Master Privacy Policy, the Master Privacy Policy controls.

Changes

We may update this policy as the product evolves. Material changes will be reflected in the effective date at the top of this page.

Effective date

This product Privacy Policy is effective July 16, 2026.