Privacy Policy

This policy explains how BF Marketing ("we", "us") handles information on this website and in the Show & Tell reporting workspace.

Client advertising data. When we report on a client's advertising accounts, we act on that client's instructions under our agreement with them. Questions about that data are best raised with the business concerned; we will help them answer.

• Account details: your name, work email address and password (stored only in scrambled form), or the details shared by Google or Lovable if you sign in with them.
• Access records: which businesses you may view, your role, invitations, and when access was granted or removed.
• Advertising performance data: campaign, ad set and ad names, creative details, spend, results and similar figures read from the advertising accounts a client authorises. These are business figures, not lists of the client's customers.
• Connection credentials: access keys a client issues to us, stored encrypted and never shown back in full.
• Messages: anything you send us by email.
• Visit information: described in section 5.

• To run the workspace: sign you in, show you only the businesses you may see, and refresh reports.
• To prepare reports and next-step recommendations for each client.
• To keep the service secure, investigate misuse and fix errors.
• To reply to you and meet legal obligations.

We do not sell information. We share it only with:

• Service providers who host the website, database and sign-in, deliver email, and load our fonts (Google Fonts).
• Advertising platforms such as Meta, only to read the accounts a client has connected.
• An AI writing service, reached through Lovable, which receives campaign names and performance figures to word recommendations. It does not receive your sign-in details.
• Authorities or advisers when the law requires it, or to protect rights and safety.
• A successor if our business is reorganised or sold, under the same protections.

Our site uses Lovable's visitor analytics. It uses no cookies, stores nothing on your device, doesn't keep IP addresses and doesn't identify visitors. Lovable collects this data for us. Lovable's privacy policy explains how it handles it.

It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links are clicked. This is recorded for every visitor. Detailed data is kept for 90 days and daily summaries for a year.

If you sign in, the sign-in service keeps a small record in your browser so you stay signed in. Google Fonts receives your IP address when your browser loads our typefaces. Signing in with Google or Lovable is subject to their own policies.

We keep account and access records while you have access and for a limited period afterwards for security. Client reporting data is kept for the length of the client relationship and removed or returned when it ends, unless the law requires longer.

We use encryption, per-business access controls, verified sign-in and restricted administrator roles. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authorities as the law requires.

Our providers may process information outside your country, including in the United States. Where the law requires, we rely on recognised safeguards such as Standard Contractual Clauses.

You can ask us to show you, correct, export or delete your information, or to stop using it. Email brisa@brisafreitas.com. We may need to confirm your identity first. You can also stop using the service at any time.

For workspace accounts and this website, BF Marketing is the controller. For client advertising data we act as processor for that client.

We rely on these legal bases: contract (to provide the workspace), legitimate interests (security, improving the service, measuring site use), legal obligation, and consent where we ask for it, which you may withdraw at any time.

Under the GDPR and UK GDPR you may request access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You may also complain to your local data protection authority.

We will post updates here and change the date at the top. Significant changes will be communicated to account holders.

BF Marketing — brisa@brisafreitas.com