Brillion Studio

Privacy Policy

Last updated July 31, 2026

Signals is an internal operations console operated by Brillion Studio for advertising agencies and the businesses they serve ("clients"). This policy explains what data Signals processes, why, and the choices you have. Signals is used by a business to view and manage its own connected accounts; we act as a data processor on that business's behalf.

Data we process

When a business connects an account to Signals, we access only the data that account authorizes, to render it back to that same business inside the app. Depending on which integrations are connected, this may include:

Instagram & Facebook messaging (via the Meta Instagram and Messenger APIs): the content of direct messages sent to or from the connected professional account, the sender's and recipient's user IDs, usernames, display names and profile pictures, and message timestamps. Used solely to present a unified inbox and let the business read and reply to its own conversations.
Account & page profile: the connected account's ID, name/username, and profile image.
Advertising insights (Meta and Google): campaign, spend, and performance metrics for the connected ad accounts.
Advertising management (Meta, where the business grants it): the ability to create and change campaigns, ad sets, ad creatives and ads in the ad accounts that business connected, and to pause or resume them. Everything Signals creates is created paused, so nothing it makes can spend money until a person turns it on. We do not create, change, pause or resume anything in an ad account on our own initiative, and we do not act on an ad account a business has not connected.
Other connected sources a business may link (e.g. Google Analytics, Google Business Profile, payment and booking providers, email): the corresponding metrics, records, or messages, used only to display them to that business.
Authentication tokens for the above, which we store encrypted at rest and use only to make the API calls the business asked for.

Google user data

Signals can connect a Google Account so a business can work its own mail, calendar and files inside the app. Google data is handled separately from everything else on this page, and the commitments in this section are binding.

We request only the scopes the connected features actually use:

gmail.modify — read the connected mailbox and mirror its state. Signals displays your threads and messages, and applies the changes you make in the app (read/unread, archive, move to Trash, labels) back to Gmail. It does not delete mail permanently.
gmail.send — send, reply to and forward messages as you, only when you press send.
calendar.readonly and calendar.events — show your calendar alongside the pipeline, and create or update the events you book in Signals.
drive — the in-app file browser: list and search your Drive, create folders, rename, upload, move files to Trash, and import a file you choose into Signals. This is full Drive access because the browser can navigate any folder you can; Signals touches a file only when you act on it.

Google data is used only to provide these features to the person who connected the account. Specifically, Signals does not:

sell it, or transfer it to data brokers, information resellers or advertising networks;
use it for advertising, ad targeting, or building marketing profiles;
use it to develop, improve or train generalized artificial-intelligence or machine-learning models;
let Brillion Studio personnel read your Gmail, Calendar or Drive content, except where you have given specific consent (for example, you ask us to investigate a problem with a named message), where it is necessary for security or to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

Limited Use. Signals's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and revocation. Gmail messages are cached so the app can render your inbox without re-fetching everything; Calendar and Drive are read live and not warehoused. You can revoke Signals's access at any time from your Google Account permissions, or by disconnecting inside Signals (Integrations → Disconnect), which also revokes the token. On revocation we stop accessing your Google data immediately, and the cached copy is deleted on request to privacy@brillionstudio.com.

Text messages and phone calls

Signals can send and receive text messages (SMS and MMS) and place and receive phone calls on behalf of a business that has connected a phone number. Messaging and calling are carried by Twilio, which acts as our sub-processor for this purpose.

When these features are used, we process: the mobile or landline number of the person contacted, the content and timestamps of messages sent and received, call times and durations, and, where call recording is switched on, the call recording and a written transcript of it.

We do not share mobile information with third parties or affiliates for marketing or promotional purposes. No mobile information is sold, rented, or passed to data brokers, information resellers, or advertising networks. Text messaging originator opt-in data and consent are not shared with any third party for any purpose. The only parties that ever see this data are the business that sent or received the message, Brillion Studio personnel who operate the service, and the infrastructure and telecommunications providers named in this policy that carry it on our behalf.

Consent. A business using Signals is responsible for obtaining consent from the people it messages, and for messaging only those who have given it. Messages are conversational: they are sent in reply to an enquiry, or to follow up on an appointment, quote, or existing relationship with that business.

Frequency and cost. Message frequency varies, because messages follow the course of a conversation rather than a schedule. Message and data rates may apply, charged by the recipient's own mobile carrier.

Stopping messages. Anyone receiving messages can reply STOP at any time to end them, and HELP for assistance. Replying STOP ends messages from that number; no further messages are sent to it unless the person opts in again.

Call recording. Calls are recorded and transcribed only where a business has switched recording on. Recording laws differ by jurisdiction, and several require the consent of every party on the call. A business using Signals is responsible for announcing recording and obtaining the consent its jurisdiction requires. Recordings and transcripts are stored with the rest of that business's data, are visible only to that business, and can be deleted on request.

How we use it

Only to provide the Signals service to the business that connected the account: displaying its inbox, reports, pipeline, and related tooling. We do not sell personal data, we do not use it for advertising, and we do not share it with third parties except the infrastructure providers below that operate the service on our behalf.

Where it is stored

Data is stored in our database and object storage hosted by Supabase, and served through Vercel. Messages, calls, recordings and transcripts are carried by Twilio. Access is restricted to the connecting business (enforced by per-account access controls) and to Brillion Studio personnel who operate the service. Tokens are encrypted at rest.

Data retention & deletion

We retain connected data for as long as the account remains connected. You can remove it at any time:

Disconnect the integration inside Signals (Integrations → Disconnect), or remove Signals's access from the platform's own app settings. This revokes our access going forward.
Request deletion of the data we already hold. If you remove our app from Instagram or Facebook, Meta notifies us and we automatically delete the message data associated with your account. You can also request deletion directly at privacy@brillionstudio.com, and check status via our data deletion endpoint.

Meta data deletion callback: /data-deletion

Your choices

You control which accounts are connected and can disconnect or request deletion at any time. If you are an end user who messaged a business that uses Signals and want your data removed, contact that business, or email us at privacy@brillionstudio.com and we will act on verified requests.

Government and law enforcement requests

We may receive requests from public authorities (courts, regulators or law enforcement) for personal data we hold. Brillion Studio applies the following to every such request:

Legality review. We review each request to confirm it is lawful, properly issued and binding on us before disclosing anything. We do not disclose data on an informal or voluntary basis.
Challenging unlawful requests. Where a request appears unlawful, overbroad or defective, we push back, seek to narrow it, or challenge it through the appropriate channel, and seek legal advice where warranted.
Data minimisation. We disclose only the minimum information necessary to satisfy a valid request, never a broader export of an account or conversation than the request requires.
Documentation. We keep a record of each request, our response, the legal reasoning applied and the people involved in the decision.

Where we are legally permitted to do so, we will notify the affected business or person before disclosing their data.

Changes

We may update this policy; material changes will be reflected by the "last updated" date above.

Contact

Brillion Studio · privacy@brillionstudio.com · Terms of Service

This policy covers Signals's use of the Meta Platform (Instagram & Messenger APIs), Google APIs, and other connected integrations, consistent with the Meta Platform Terms and Developer Policies and the Google API Services User Data Policy.