This policy explains what personal data we collect when you use The Brand Game, why we collect it, who else touches it, and what you can ask us to do with it.
The controller of your personal data is:
"We", "us" and "our" mean this company. "You" means the person using the service.
It covers The Brand Game, our online brand self-assessment for small-business owners, and the website it runs on. The service is at diananikitinabranding.com. This policy applies at both addresses.
In short, the service works like this: you buy access, you answer about 38 questions, and a language model turns your answers into a brand book — a written brand-strategy document that follows Diāna Ņikitina's methodology.
You can create an account with an email address and a password, or with "Continue with Google". If you use Google, Google acts as an identity provider and we receive the email address, the name and the profile picture URL of that Google account. Passwords are never stored by us in readable form; our database provider stores them hashed.
The questionnaire collects text answers, multiple-choice answers, colour picks, font picks, picture picks, and any files you choose to upload, such as your logo or reference images. You decide what goes into the free-text boxes. They may contain personal data about you — including your own name, if your brand is a personal brand — and they may mention other people. Please only include what you are comfortable sharing.
The document produced from your answers, and any personal review of it bought separately, are stored with your account.
Payment is taken by card through Stripe. Your card details go to Stripe and never reach our systems. We receive from Stripe what we need to run the account and to account for the sale: whether a payment succeeded or failed, the plan bought, the amount, the currency, the date, and a Stripe customer and payment reference. Invoices contain the billing details you give at checkout.
Our hosting and content-delivery providers process technical data needed to serve and protect the site, such as IP address, browser type and the time of a request. We use this to keep the service running and to prevent abuse. We do not use it to build profiles of you.
If you email us, we keep the message and our reply so we can deal with the matter and keep a record of it.
| What we do | Legal basis (GDPR Article 6) |
|---|---|
| Create and run your account; let you sign in | Performance of a contract with you (Art. 6(1)(b)) |
| Store your answers and uploads, produce the brand book, deliver it, and — if you buy it — deliver the personal review | Performance of a contract with you (Art. 6(1)(b)) |
| Send your free-text answers and picks to a language-model provider outside the European Union | Your consent (Art. 6(1)(a), and Art. 49(1)(a) for the transfer). You can withdraw it at any time; see section 5 |
| Take payment and keep invoices and accounting records | Performance of a contract with you, and our legal obligations under Latvian tax and accounting law (Art. 6(1)(b) and (c)) |
| Send service emails about your account — confirmation links, the finished book, changes that affect you | Performance of a contract with you, and our legitimate interest in keeping you informed about the service you bought (Art. 6(1)(b) and (f)) |
| Send you news about the service and Diāna Ņikitina's work — only if you opt in | Your consent (Art. 6(1)(a)); every email has an unsubscribe link, and withdrawing changes nothing else about your account |
| Keep the service secure, prevent and investigate fraud and abuse | Our legitimate interest in protecting the service and our customers (Art. 6(1)(f)) |
| Review a submission inside the app to check the methodology | Our legitimate interest in the quality of the service (Art. 6(1)(f)); see section 7 |
| Bring or defend legal claims | Our legitimate interest in protecting our rights (Art. 6(1)(f)) |
We do not send marketing email unless you ask for it.
The brand book is written by a language model. To produce it, your free-text answers and your picks are sent to Anthropic PBC in the United States.
Your account name and your email address are not sent. That separation is enforced in our code: the part of the system that talks to the model never receives them.
What we cannot remove is personal data you type into the answers yourself. If you write your own name, a client's name or a phone number into a free-text box, that text goes with the rest.
So we ask for your consent at signup, with a checkbox. We record that you ticked it, when you ticked it, and the version of the wording you agreed to. The current wording is:
"I agree that my free-text answers are sent to a language model outside the European Union in order to produce the brand book. Those answers may contain personal data I type into them myself — including my own name, if the brand is a personal one. My account name and email address are not sent."
You can withdraw this consent at any time by writing to hello@diananikitinabranding.com. Withdrawing it does not undo a transfer that has already happened, and it means we can no longer produce a brand book for you, because there is no other way to produce one. The rest of your account is unaffected.
Anthropic processes the text on our instructions and returns the brand book. Under the commercial terms Anthropic publishes for its API, inputs and outputs may be retained by Anthropic for up to 30 days for trust-and-safety and abuse-monitoring purposes. That is Anthropic's own term, not ours, and Anthropic may change it; we do not assume that zero data retention applies to our account.
We use a small number of service providers. They act on our instructions under a data-processing agreement, except where they are named below as acting for themselves.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Accounts and sign-in, the database holding your answers, and the storage holding your uploads | European Union — AWS eu-west-1, Ireland |
| Anthropic PBC | The language model that writes the brand book | United States |
| Stripe (Stripe Payments Europe Ltd for EU merchants) | Card payments, invoices and subscription billing. Stripe is also a controller in its own right for fraud prevention and its own legal duties | European Union, with group companies in the United States |
| Resend | Transactional email — confirmation links and the finished book — sent from m.diananikitinabranding.com | European Union region |
| Our own server | The app itself runs on a computer we operate in Latvia; it is reached only through Cloudflare | Latvia (EU) |
| Cloudflare | Content delivery and protection of the site | Global network |
| Identity provider, only if you choose "Continue with Google". Google handles your Google account under its own privacy policy | Global |
We may also share personal data with our accountants, and with public authorities or courts where we are required to. We do not sell your personal data and we do not give it to advertisers.
Access is limited to the people who need it to run the service. Diāna Ņikitina, as staff of the company, has a reviewer role in the app: she can open a client's submission to review how the methodology is working, and to write the personal review when a client has bought one.
Your account, your answers and your uploads are stored in the European Union. Personal data leaves the EU/EEA in two situations: the transfer of your free-text answers and picks to Anthropic in the United States (section 5), and the use of providers with United States parents or global networks, namely Cloudflare, Stripe's group companies and Google.
For those transfers we rely on:
You can ask us for a copy of the safeguards that apply to a particular transfer. Write to hello@diananikitinabranding.com and we will send them, with commercially confidential parts removed.
We may keep data longer if we need it for a legal claim, and then only for as long as that claim lasts.
We use strictly necessary cookies only:
We do not use advertising trackers. We do not use analytics cookies at present. If that ever changes, we will update this policy and ask for your consent before setting anything that is not strictly necessary.
Data is held with providers who encrypt it in transit and at rest. Passwords are stored hashed. Access inside the company is limited to the people who need it. Card details never reach our systems. No service can promise perfect security, but we take the protection of your answers seriously, and we will tell you and the regulator if a breach requires it.
The brand book is generated by a language model from the answers you give. It is a document for you to read and judge. It does not produce a decision about you that has legal effects or anything similarly significant. We do not use your data for automated decision-making of that kind, and we do not profile you for advertising.
If the GDPR applies to you, you have the right to:
To use any of these rights, write to hello@diananikitinabranding.com from the address on your account. We answer within one month. If the request is complicated we may extend that by two months, and we will tell you why. We do not charge for this, unless a request is clearly excessive or repetitive.
You can also complain to a supervisory authority. Ours is:
You may instead complain to the supervisory authority in the EU/EEA country where you live or work, or where you think the problem happened.
This section applies if you are a resident of California, or of another US state with a comprehensive privacy law — Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others. It sits alongside the rest of this policy.
We collect these from you directly, from Google if you sign in that way, and from Stripe in connection with payment. We use them for the purposes set out in section 4 and keep them for the periods in section 9. We do not ask for sensitive personal information, and we do not use or disclose it in any way that would give you a right to limit its use.
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use it for targeted advertising, and we do not profile you in a way that produces legal or similarly significant effects. We have not sold or shared personal information in the preceding twelve months, including the personal information of anyone under 16.
Depending on your state, you may have the right to know what we collect and why, to get a copy of it, to correct it, to delete it, to opt out of sale, sharing, targeted advertising and certain profiling — none of which we do — and to limit the use of sensitive personal information, which we do not collect.
To make a request, email hello@diananikitinabranding.com from the address on your account. We verify a request by matching it to the account email; before we release a copy of your data we may ask you to confirm the request from that address a second time. An authorised agent may act for you if you give them written permission and we can verify it.
If we refuse a request, we will tell you why. You may appeal by replying to our answer with the word "appeal". We will review it and respond within the time your state's law allows. If you are still unsatisfied, you may contact your state Attorney General.
We will not deny you the service, charge you a different price, or give you a lower quality of service because you used a privacy right.
The service is for people aged 18 or over, using it for business purposes. It is not for children, and we do not knowingly collect their data. If you believe a child has given us data, write to hello@diananikitinabranding.com and we will delete it.
If we change this policy we will change the effective date at the top and, where the change matters to you, tell you by email before it takes effect. If a change needs your consent, we will ask for it rather than assume it.
Questions, requests and complaints: hello@diananikitinabranding.com, or write to Darling I'm home, SIA, Iecavas iela 1 – 32, Rīga, LV-1083, Latvia.