Brillion Studio

Privacy Policy

Last updated July 31, 2026

Signals is an internal operations console operated by Brillion Studio for advertising agencies and the businesses they serve ("clients"). This policy explains what data Signals processes, why, and the choices you have. Signals is used by a business to view and manage its own connected accounts; we act as a data processor on that business's behalf.

Data we process

When a business connects an account to Signals, we access only the data that account authorizes, to render it back to that same business inside the app. Depending on which integrations are connected, this may include:

Instagram & Facebook messaging (via the Meta Instagram and Messenger APIs): the content of direct messages sent to or from the connected professional account, the sender's and recipient's user IDs, usernames, display names and profile pictures, and message timestamps. Used solely to present a unified inbox and let the business read and reply to its own conversations.
Account & page profile: the connected account's ID, name/username, and profile image.
Advertising insights (Meta and Google, read-only): campaign, spend, and performance metrics for the connected ad accounts.
Other connected sources a business may link (e.g. Google Analytics, Google Business Profile, payment and booking providers, email): the corresponding metrics, records, or messages, used only to display them to that business.
Authentication tokens for the above, which we store encrypted at rest and use only to make the API calls the business asked for.

Google user data

Signals can connect a Google Account so a business can work its own mail, calendar and files inside the app. Google data is handled separately from everything else on this page, and the commitments in this section are binding.

We request only the scopes the connected features actually use:

gmail.modify — read the connected mailbox and mirror its state. Signals displays your threads and messages, and applies the changes you make in the app (read/unread, archive, move to Trash, labels) back to Gmail. It does not delete mail permanently.
gmail.send — send, reply to and forward messages as you, only when you press send.
calendar.readonly and calendar.events — show your calendar alongside the pipeline, and create or update the events you book in Signals.
drive — the in-app file browser: list and search your Drive, create folders, rename, upload, move files to Trash, and import a file you choose into Signals. This is full Drive access because the browser can navigate any folder you can; Signals touches a file only when you act on it.

Google data is used only to provide these features to the person who connected the account. Specifically, Signals does not:

sell it, or transfer it to data brokers, information resellers or advertising networks;
use it for advertising, ad targeting, or building marketing profiles;
use it to develop, improve or train generalized artificial-intelligence or machine-learning models;
let Brillion Studio personnel read your Gmail, Calendar or Drive content, except where you have given specific consent (for example, you ask us to investigate a problem with a named message), where it is necessary for security or to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

Limited Use. Signals's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and revocation. Gmail messages are cached so the app can render your inbox without re-fetching everything; Calendar and Drive are read live and not warehoused. You can revoke Signals's access at any time from your Google Account permissions, or by disconnecting inside Signals (Integrations → Disconnect), which also revokes the token. On revocation we stop accessing your Google data immediately, and the cached copy is deleted on request to privacy@brillionstudio.com.

How we use it

Only to provide the Signals service to the business that connected the account: displaying its inbox, reports, pipeline, and related tooling. We do not sell personal data, we do not use it for advertising, and we do not share it with third parties except the infrastructure providers below that operate the service on our behalf.

Where it is stored

Data is stored in our database and object storage hosted by Supabase, and served through Vercel. Access is restricted to the connecting business (enforced by per-account access controls) and to Brillion Studio personnel who operate the service. Tokens are encrypted at rest.

Data retention & deletion

We retain connected data for as long as the account remains connected. You can remove it at any time:

Disconnect the integration inside Signals (Integrations → Disconnect), or remove Signals's access from the platform's own app settings. This revokes our access going forward.
Request deletion of the data we already hold. If you remove our app from Instagram or Facebook, Meta notifies us and we automatically delete the message data associated with your account. You can also request deletion directly at privacy@brillionstudio.com, and check status via our data deletion endpoint.

Meta data deletion callback: /data-deletion

Your choices

You control which accounts are connected and can disconnect or request deletion at any time. If you are an end user who messaged a business that uses Signals and want your data removed, contact that business, or email us at privacy@brillionstudio.com and we will act on verified requests.

Government and law enforcement requests

We may receive requests from public authorities (courts, regulators or law enforcement) for personal data we hold. Brillion Studio applies the following to every such request:

Legality review. We review each request to confirm it is lawful, properly issued and binding on us before disclosing anything. We do not disclose data on an informal or voluntary basis.
Challenging unlawful requests. Where a request appears unlawful, overbroad or defective, we push back, seek to narrow it, or challenge it through the appropriate channel, and seek legal advice where warranted.
Data minimisation. We disclose only the minimum information necessary to satisfy a valid request, never a broader export of an account or conversation than the request requires.
Documentation. We keep a record of each request, our response, the legal reasoning applied and the people involved in the decision.

Where we are legally permitted to do so, we will notify the affected business or person before disclosing their data.

Changes

We may update this policy; material changes will be reflected by the "last updated" date above.

Contact

Brillion Studio · privacy@brillionstudio.com

This policy covers Signals's use of the Meta Platform (Instagram & Messenger APIs), Google APIs, and other connected integrations, consistent with the Meta Platform Terms and Developer Policies and the Google API Services User Data Policy.