Privacy Policy

Brand Vault (formerly Creative Hub) by Second Oak — Last updated: September 11, 2026

1. Introduction

Creative Hub ("we", "our", "us") is a creative content management platform operated by Second Oak. This Privacy Policy explains how we collect, use, and protect your personal data when you use our application at secondoak.se/creative-hub.

By using Creative Hub, you agree to the practices described in this policy.

2. Data We Collect

We collect the following categories of data:

• Account information: Email address and password (managed via Supabase Authentication).
• Project data: Brand configurations, generated images, uploaded assets, and ad content you create within the platform.
• Third-party platform tokens: When you connect external services (Meta Ads, Google Ads, Shopify), we store encrypted access tokens to manage your advertising campaigns on your behalf.
• Usage data: Basic interaction data such as login timestamps and feature usage for service improvement.

3. How We Use Your Data

We use your data exclusively to:

• Provide and operate the Creative Hub platform.
• Authenticate your identity and manage your account.
• Generate AI-powered creative content based on your project configurations.
• Create, manage, and monitor advertising campaigns on connected platforms (Meta, Google, Shopify) on your behalf.
• Store and organize your creative assets and project history.
• Improve the platform and fix issues.

4. Third-Party Services

Creative Hub integrates with the following third-party services:

• Supabase: Authentication, database, and file storage. Data is stored in Supabase-managed infrastructure. See Supabase Privacy Policy.
• Google Gemini API: AI image generation. Prompts and generated images are processed via Google's API. See Google Privacy Policy.
• Meta (Facebook) Ads API: When connected, we use Meta's Marketing API to create and manage ad campaigns. See Meta Privacy Policy.
• Google Ads API: When connected, we use Google's Ads API to read campaign performance (read-only — Brand Vault never changes anything in your Google Ads account). See Google Privacy Policy. Brand Vault's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Ads data is used only to display your own account's performance inside your workspace; it is not transferred to third parties, not used for advertising of our own, and not read by humans except for support you request, security, or legal compliance.
• Shopify API: When connected, we access order data for ad attribution. See Shopify Privacy Policy.
• Cloudflare Workers: Used as a proxy for API requests. See Cloudflare Privacy Policy.

5. Data Storage and Security

Your data is stored securely using Supabase's managed PostgreSQL database and storage services. We implement the following security measures:

• Row-Level Security (RLS) policies to ensure users can only access their own data.
• Role-based access control (admin, manager, editor, viewer) for project-level permissions.
• Encrypted access tokens for third-party platform integrations.
• HTTPS encryption for all data in transit.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. Data is only shared with the third-party services listed above as necessary to provide the platform's functionality, and only when you explicitly connect those services.

7. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us. Third-party platform tokens are stored until you disconnect the integration or delete your account.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your personal data.
• Portability: Request your data in a portable format.
• Withdrawal of consent: Disconnect third-party integrations at any time through the platform settings.

9. Cookies

Creative Hub uses only essential cookies and local storage for authentication session management. We do not use advertising or tracking cookies.

10. Children's Privacy

Creative Hub is not intended for use by individuals under the age of 16. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

hello@secondoak.se

© 2026 Second Oak. All rights reserved.