Privacy Policy
Last updated
Brandmasters Media ("Brandmasters", "we", "us") operates brandmastersgtm.com and the Brandmasters GTM platform. This policy explains what personal data we handle, why, who we share it with, how long we keep it, and what you can ask us to do about it.
Contact us about anything in this policy at support@brandmastersmedia.com.
The three roles we play
Most privacy policies blur this. Ours does not, because your rights and who you should ask depend on it.
| Whose data | Our role | Who decides how it is used |
|---|---|---|
| Visitors to this website | Controller | Us |
| People at our client companies who use the Platform | Controller | Us |
| Prospects our clients reach out to through the Platform | Processor | Our client |
When we act as a processor, we handle personal data only on our client's documented instructions. If you have received outreach sent through Brandmasters GTM and want your data corrected or deleted, the fastest route is to reply to the message, because the client controls that data. You can also write to us and we will identify the client and pass your request on without undue delay.
If you visit this website
We collect very little, because this site carries no analytics and no advertising technology.
What we handle. Your IP address and standard request information (browser, referring page, time) are processed transiently by our hosting infrastructure to serve pages and to protect against abuse. Server logs are short-lived and are not used to build a profile of you.
Cookies. This site sets one cookie, and only after you sign in. There is no analytics cookie, no advertising cookie and no third-party tracker. The detail is in our Cookie Policy.
If you book a call. The "Book a call" button takes you to our scheduling page hosted by Cal.com. What you enter there — your name, email, company and anything you write in the notes — is collected to arrange and hold the call, and is handled under Cal.com's own privacy notice as well as this one.
If you email us. We keep the correspondence so we can answer you and keep a record of what was agreed.
Legal basis (UK/EU). Our legitimate interests in running a secure website and responding to enquiries, and taking steps at your request before entering a contract.
If you use the Platform
You will have been given access by us during your company's onboarding. There is no public sign-up.
What we handle. Your name, work email address, job title and workspace role; your authentication data, including a hashed password, multi-factor authentication settings and backup codes; your sessions and devices; your notification preferences; and a record of your actions in the Platform — which accounts you worked, what you approved, what you changed and when.
Why. To give you access, to keep the account secure, to provide support, to produce the audit trail the Platform promises, to send service messages, and to meet our legal and contractual obligations.
The audit trail is deliberate. Every action is recorded from first signal to last send, including who approved each message. This exists so that you, your compliance team and any regulator can reconstruct what happened. It is a core feature, not incidental logging, and it cannot be switched off.
Legal basis (UK/EU). Performance of a contract with your employer; our legitimate interests in securing the service and preventing misuse; and compliance with legal obligations.
Prospect data, where we are a processor
When our client runs a workspace, the Platform handles personal data about the people that client wants to reach. The client decides who is contacted and what is said. We provide the machinery.
What is handled. Business contact details — name, job title, employer, work email address, professional profile links; the buying signal that caused the account to surface and its source; the score the account received and the written reasons for it; the message drafts, approvals, sends and replies; and engagement events such as opens, clicks, bounces and unsubscribes returned by the sending provider.
Where it comes from. Licensed business data and enrichment providers, publicly available professional sources, and the client's own records and CRM. The current providers are listed at Sub-processors.
Where it does not come from. We do not use a LinkedIn login, LinkedIn cookies, browser extensions or scraping tools to obtain data, and the Platform is built so that it cannot.
Verification before contact. Email addresses are checked across multiple verification providers before anything is drafted to them. An address that cannot be verified is never sent to.
Legal basis (UK/EU). Determined by our client as controller, and typically their legitimate interests in business-to-business outreach, assessed and documented by them. We process on their instructions under a data processing agreement.
If you are a prospect and want this to stop: reply to the message you received, or write to support@brandmastersmedia.com with the message you received. Reply detection stops the sequence on both email and LinkedIn for that account, and an unsubscribe adds you to a suppression list that persists.
Automated scoring and AI-assisted drafting
We think you should be told this plainly.
Scoring. The Platform scores accounts automatically against criteria the client sets. Each score comes with the reasons it was given, in plain words. A score decides the order of a queue; it does not by itself cause anything to be sent.
Drafting. Outreach is drafted with the help of large language models, grounded in a verified fact about the account. Drafts are proposals. A person at the client company reads and approves every message before it leaves.
No solely automated decisions. Nothing in the Platform makes a decision producing legal effects, or similarly significant effects, on an individual without human involvement. Sending always requires a human approval.
Data sent to our model provider for drafting is not used by them to train their models.
Who we share data with
We share personal data with sub-processors who help us run the service — data and enrichment providers, address verification providers, sending infrastructure, CRM connections, hosting, database and alerting. Each is bound by a contract that limits them to our instructions and requires appropriate security. The current list, with what each one does, is at Sub-processors.
We also share data with professional advisers where necessary, and with authorities where the law requires it. If our business is reorganised or transferred, data may move with it, and we will tell affected clients.
We do not sell personal data, and we do not share it for cross-context behavioural advertising — as those terms are defined under the California Consumer Privacy Act as amended. We have never done so.
International transfers
We and our sub-processors may process data outside your country, including in the United States. Where data leaves the UK or the European Economic Area, we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses or the UK International Data Transfer Addendum, together with additional safeguards where they are needed. Ask us at support@brandmastersmedia.com for details of the mechanism covering a particular transfer.
How long we keep it
| Data | Retention |
|---|---|
| Website server logs | Days, not months |
| Enquiries and booking records | Duration of the conversation, then up to 24 months |
| Platform account and profile | Life of the engagement, then deleted within 90 days |
| Outreach records, approvals and audit trail | Life of the engagement, then per the client's instructions and our legal obligations |
| Suppression and unsubscribe lists | Kept indefinitely, because forgetting an opt-out would be worse |
| Operational job and run records | Purged on a rolling schedule, 30 to 90 days by record type |
| Backups | Rolling window, then overwritten |
A client may instruct a shorter or longer period for data we process on their behalf.
Security
Access is protected by multi-factor authentication and role separation. Data is encrypted in transit, secrets are held outside the codebase, backups are taken daily and restore is tested. The full description is at Security.
Your rights
Depending on where you live, you may have the right to access your personal data, to correct it, to delete it, to obtain a portable copy, to object to or restrict processing, to opt out of sale, sharing or targeted advertising — none of which we do — and to not be discriminated against for exercising any of these.
In the UK and EEA you may also withdraw consent where we relied on it, and you may complain to your supervisory authority — in the UK, the Information Commissioner's Office.
In California you may also request details of the categories of personal information collected, the purposes, and the categories of third parties it was disclosed to. This policy provides that information. You may use an authorised agent.
How to exercise a right. Write to support@brandmastersmedia.com. We will respond within the time the applicable law allows — one month in the UK and EEA, 45 days in most US states — and will tell you if we need longer. We may need to verify your identity, and we will ask for no more information than that requires. Exercising a right is free unless a request is manifestly unfounded or excessive.
If your request concerns outreach you received, we are likely a processor and will pass it to the client who is the controller, and tell you we have done so.
Children
The Site and the Platform are for business use and are not directed at anyone under 18. We do not knowingly collect data from children. If you believe we have, write to us and we will delete it.
Changes to this policy
We may update this policy. The "Last updated" date at the top always shows the current version. Where a change materially affects how we handle personal data, we will give notice to affected clients before it takes effect.
Contact
Brandmasters Media — support@brandmastersmedia.com
Related: Cookie Policy · Sub-processors · Security · Acceptable Use Policy · Terms of Use