Privacy Policy
Last updated 14 October 2026
BrandLocker is a place for design studios to keep the brand kits they make for clients and share them through a private link. This policy explains what personal information we handle when you use it, why, and what you can do about it.
It covers two groups of people:
- Studios - the designers and agencies who sign up, pay for a plan and build brand kits.
- Portal visitors - the studio's clients, and anyone else they pass a link to, who open a brand portal without an account.
BrandLocker is operated by Heath Design Studio, based in Queensland, Australia. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where we say "we", "us" or "BrandLocker", we mean that business.
What we collect from studios
Your account. Your name, email address, studio name and a password (stored by our authentication provider as a one-way hash, never in a form we can read). If you sign in with Google, we receive your name and email address from Google instead of a password.
Agreement to our terms. When you create an account we record that you agreed to the Terms of Service and Privacy Policy, which version, and when.
Billing. If you are on a paid plan, payments go through Stripe. Stripe collects your card details directly; we never see or store them. We keep the Stripe customer and subscription references we need to know which plan you are on and whether it is paid.
What you put in your brand kits. Logos, colours, fonts, font files, guidelines, photos, documents and anything else you upload, plus the notes and settings around them. This is your content. It may contain personal information about other people (a photo, a staff headshot, a contact name in a document), and you are responsible for having the right to upload it.
Contacts. The names, positions and email addresses of the people on your client's side of a brand, which you add so that updates, portal links and design approvals can be sent to the right person. You are responsible for having the right to give us those details.
Design approvals. When you ask people to review a piece of artwork, we keep the artwork, the reviewers' names and email addresses, the comments they pin to it, their decisions (approved, changes requested or rejected) with any note, and the dates. Reviewer links are stored only as a one-way hash, so a leaked backup cannot be turned into working links.
Emails you ask us to send. When you send a portal link, a brand update or a sharing invitation, we use the recipient addresses you enter to send that email on your behalf, and keep a record that it was sent.
Feedback. If you use the Feedback button, we keep your message, the page you were on, your browser's user agent string and a hashed version of your IP address.
Records of what happens in your account. Changes to brand kits are logged so studios can see what changed and when, and actions taken by BrandLocker administrators are logged for accountability.
What we collect from portal visitors
Opening a portal does not need an account, and we do not track visitors across pages or sites. We only collect information when a visitor does something that needs it:
- Sharing a link by email. The recipient's email address is used to send that one email. We keep a hash of it, and a hash of the sender's IP address, for 48 hours so the button cannot be used to send spam, then delete them.
- Print Room requests. If a studio has turned on print and design requests, the visitor's name, email address, delivery details, notes and any file they attach are passed to that studio so it can do the work. We also keep a hash of the IP address to limit abuse.
- Design approvals. If a studio invites you to review artwork, you open it through a personal link, with no account. We record your name and email address (as the studio entered them), your comments and pins, your decision and any note, when you last viewed it, and a hash of your IP address so decisions can be told apart in an audit. The studio can see all of this, and a record of the approval is kept with the artwork. If you have not decided, we email you reminders on the studio's behalf, and you can ask the studio to stop them.
- Feedback. An optional name and email address (the form works without them), the message, the page, the browser user agent and a hashed IP address.
- Send to Canva. If a visitor connects their Canva account to send a file there, Canva handles the sign-in. We hold the resulting access token only inside an encrypted cookie in the visitor's own browser, for up to four hours. We do not store it on our servers.
- Portal passwords. If a portal is password protected, a cookie remembers that the visitor has unlocked it. The password itself is never stored in the cookie.
Beta sign-ups. When sign-ups are closed, people can join a waiting list with their email address, and optionally their name, studio name and a note. We use this only to invite them to BrandLocker and send beta updates, and every one of those emails has an unsubscribe link.
Who is responsible for which information
For the brand kits themselves, and for anything a portal visitor sends to a studio (such as a Print Room request), the studio decides what is collected and why. We store and deliver it on the studio's behalf. If you are a portal visitor and want to know what a studio does with your details, ask that studio.
For studio accounts, billing, feedback, beta sign-ups and the anti-abuse records above, we are responsible.
How we use it
We use personal information to:
- run your account and deliver the service you signed up for
- take payment and manage your plan
- send the emails the service needs (confirmations, password resets, portal links and updates you trigger, design approval invitations and reminders, alerts about requests and feedback)
- stop spam, bots and abuse, including checking forms with Cloudflare Turnstile
- answer feedback and support requests and fix problems
- comply with the law
We do not sell personal information, we do not use it for advertising and we do not use your brand kit content to train AI models.
Who we share it with
We use a small number of service providers to run BrandLocker. They process information only to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | Sydney, Australia |
| Vercel | Hosting the app | Application servers in Sydney, Australia, served through a global network that includes the United States |
| Stripe | Payments and subscriptions | Australia and the United States |
| Resend | Sending email | United States |
| Cloudflare Turnstile | Bot checks on forms | Global network |
| Sign in with Google, if you choose it | United States and elsewhere | |
| Canva | Send to Canva, if a visitor chooses it | Australia and elsewhere |
Because some of these providers store or process data outside Australia, your information may be sent overseas, mainly to the United States. We choose providers that protect information to a standard comparable to the Australian Privacy Principles.
We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or restructure of the business (in which case this policy would continue to apply to it).
Cookies
BrandLocker only uses cookies that the service needs to work. There are no advertising or analytics cookies, so there is nothing to opt in or out of.
| Cookie | What it does | How long |
|---|---|---|
Sign-in (sb-...) | Keeps a studio signed in | Until you sign out |
brandlocker_signup_intent | Carries your chosen plan, and your agreement to the Terms, through sign-up with Google | 30 minutes |
brandlocker_recovery | Completes a password reset | 15 minutes |
| Portal unlock | Remembers a password-protected portal was unlocked | Browser session, or 90 days with "remember me" |
canva_oauth | Completes the Canva sign-in | 10 minutes |
canva_session, canva_designer | Holds the Canva connection | Up to 4 hours |
Cloudflare Turnstile may set its own cookie while it checks a form. The portal also remembers whether you collapsed its sidebar, in your browser's local storage.
How long we keep it
- Account and brand kit content is kept while your account is open. When an account is closed or you ask us to delete it, we delete the account, its brand kits and its files. Copies in our providers' backups expire on their normal cycle.
- Share-by-email records are deleted after 48 hours.
- Unclaimed Print Room uploads are deleted after 24 hours.
- Design approvals and contacts are kept with the brand kit they belong to, and deleted with it. A studio can also delete a proof or a contact at any time.
- Feedback, Print Room requests and beta sign-ups are kept until they are no longer needed, or until you ask us to delete them.
- Billing records are kept as long as tax law requires.
Security
Files are held in private storage and only ever served through short-lived signed links, studios are isolated from each other at the database level, and portal passwords are stored as salted hashes. The Security page has the detail. No system is perfectly secure, but if a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner as the law requires.
Your choices and rights
You can:
- See and correct your account details at any time in your account settings.
- Ask for a copy of the personal information we hold about you.
- Ask us to delete your account or your information.
- Unsubscribe from beta and product emails using the link in them. Emails the service needs to work, like password resets, cannot be turned off while you have an account.
Email info@brandlocker.app with any of these requests and we will respond within 30 days. If you are in the European Union or the United Kingdom, you also have the rights the GDPR gives you, including to object to processing and to data portability.
Complaints
If you have a concern about how we have handled your personal information, email us first at info@brandlocker.app and we will try to put it right. If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner.
Children
BrandLocker is a tool for businesses and is not meant for anyone under 18.
Changes to this policy
If we change this policy, we will update the date at the top. If a change materially affects how we use your information, we will tell studios by email before it takes effect.