Privacy Policy

1. Who controls your data

IssueLab Limited is the controller responsible for personal data processed through this deployment of BrightBean Studio.

2. Service covered

This policy covers BrightBean Studio at brightbean.issuelab.co, a social media management service operated by IssueLab Limited. It does not cover other BrightBean deployments operated by third parties or IssueLab products that publish their own privacy policy.

3. Data we process

• Account and organization data: name, email address, profile image, authentication records, organization and workspace memberships, roles, preferences, and support communications.
• Connected social-account data: platform account identifiers, names, handles, profile images, account health, permissions, and encrypted OAuth access and refresh tokens.
• Content and media: drafts, captions, comments, replies, media files, schedules, approval records, publishing results, and related metadata you ask us to manage.
• Engagement and analytics: posts, comments, reactions, inbox activity, audience and performance metrics made available by connected platforms.
• API and MCP data: API-key metadata, OAuth client grants, authorized tool activity, workspace and target identifiers, outcomes, timing, and redacted audit summaries. We do not intentionally retain AI-client conversation history.
• Technical data: IP address, browser and device information, request timestamps, security events, application logs, error diagnostics, and cookie or session identifiers needed to operate the service.

4. How we obtain and use data

We receive data from you, your organization administrators, your use of BrightBean Studio, and social platforms you explicitly connect through their authorization flows. We use it to:

• create and secure accounts, organizations, workspaces, roles, and API or MCP access;
• connect authorized social accounts and maintain their connection health;
• draft, review, schedule, publish, and manage content at your direction;
• retrieve supported engagement, inbox, and analytics data for private workspace reporting;
• provide support, diagnose faults, prevent abuse, and protect the service; and
• meet legal, regulatory, and contractual obligations.

5. LinkedIn data

When you connect LinkedIn, we process the profile or Company Page identifiers and details LinkedIn makes available to the permissions you grant. Depending on those permissions and the features you use, this may include posts, comments, reactions, engagement metrics, analytics, and OAuth tokens.

LinkedIn data is used only to provide the social media management functions you authorize. We do not sell LinkedIn data, use it for advertising or sales targeting, scrape LinkedIn, use it to train general-purpose artificial-intelligence models, or make it available to another customer. Actions are limited to connected accounts and Company Pages that the authenticated user is permitted to manage.

6. Lawful bases

Under UK data-protection law, we rely on performance of a contract to provide BrightBean Studio; legitimate interests to secure, maintain, and improve the service; consent where a connected platform or optional feature requires it; and legal obligation where processing is required by law. You can revoke a social platform authorization at any time through BrightBean Studio or the relevant platform.

7. Sharing and processors

We share personal data only as needed with social platforms you choose to connect and with service providers that support hosting, databases, object storage, email delivery, security, and error monitoring. Providers act under appropriate contractual and confidentiality obligations. We may also disclose information when required by law, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards. We do not sell personal data.

8. International transfers

Some social platforms or service providers may process data outside the United Kingdom. Where required, we use recognized safeguards such as adequacy regulations or approved contractual clauses and assess the protections available for the transfer.

9. Retention and deletion

We retain account and workspace data while the relevant account or organization remains active and for only as long afterward as needed for security, support, legal, accounting, or dispute purposes. Social OAuth tokens are retained only while a connection is authorized and are deleted when the connection or containing account is permanently removed. Content, media, inbox, and analytics data remain until deleted by an authorized user, the related account or workspace is removed, or retention is no longer necessary.

Security and audit records are normally retained for up to 365 days. Backups and provider logs expire on controlled operational cycles. If LinkedIn requires deletion of data obtained through its APIs, IssueLab can identify and securely delete the relevant stored data, subject only to overriding legal retention duties.

10. Security

We use measures appropriate to the data and risk, including TLS in transit, encrypted social OAuth tokens, tenant and workspace access controls, role-based permissions, restricted API credentials, confirmation and replay protection for consequential actions, audit logging, and operational monitoring. No system can be guaranteed completely secure; please contact us promptly if you suspect unauthorized access.

11. Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict, or receive your personal data, to object to certain processing, and to withdraw consent. Send requests to tech@issuelab.co. We may need to verify your identity. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

12. Children

BrightBean Studio is a business service and is not directed to children under 16. We do not knowingly collect their personal data.

13. Changes to this policy

We may update this policy as the service or legal requirements change. We will publish the revised version here, update its effective date, and provide additional notice where a change materially affects your rights.