Privacy
Policy

This privacy policy applies to ourownbrand.co and any services delivered through it. The data controller is:

We are not required to appoint a Data Protection Officer under UK GDPR, but you can contact our founder Richard Williams about any data-protection question at the email above.

Form submissions. When you contact us via the contact form, the floating chat-style ContactPopup, the Thumbprint access request on our Labs page, or the Creator Collective application form, we collect the fields you provide — typically your name, email address, company or brand name, role, channels you work on, budget range, and your message. Optional attachments may also be collected.

Free tools (Bravery Index). When you use our free Bravery Index tool in OOB Labs, we collect the email address you provide and the public social media handle you ask us to analyse. We use these to generate and email you a provisional report (see Sections 03 and 07). If you tick the optional marketing checkbox, we also record that consent and the time you gave it. If you submit a handle you do not own, you are asking us to analyse information that is already publicly available about that account; we do not access any private or logged-in data.

Interaction events (analytics consent only). If you accept analytics cookies, we measure how visitors interact with the site so we can improve it. Specifically we record: page views on every route change; form submissions (form name + success status); CTA clicks (label + page location); outbound clicks to social or external links; scroll-depth milestones (25, 50, 75, 100% on long-form pages); and video play events on our embedded reels.

Device & browser information. When analytics is enabled, this includes browser type, operating system, screen resolution, and language settings. IP addresses passed to Google Analytics are anonymised before storage.

Performance telemetry. If you accept analytics cookies, Vercel Speed Insights collects aggregated, anonymous Core Web Vitals (LCP, CLS, INP) so we can spot performance regressions. No personal identifiers are sent.

Security & abuse-prevention data. When you submit a form, we briefly store a hash of your IP address and request fingerprint to enforce rate limits and block spam. This data is discarded automatically after the rate-limit window expires (typically within an hour).

Server request logs. Our hosting provider (Vercel) automatically logs HTTP requests including IP address, user agent, and URL for short-term operational and security purposes. These logs are retained by Vercel for up to 30 days.

Cookies. We use cookies and similar storage technologies as described in Section 04 below.

We use the data we collect for the following purposes, each with a defined lawful basis under UK GDPR:

• To respond to your enquiry — when you submit a contact form, we use your details to reply. Lawful basis: legitimate interest in responding to prospective clients.
• To deliver free tools you ask for — when you submit a handle to the Bravery Index, we use your email to send you the report you requested and the handle to produce it. Lawful basis: legitimate interest in providing a service you actively requested. We only add you to a marketing list if you give separate, explicit consent via the optional checkbox — you can withdraw it at any time.
• To manage potential client relationships — submissions are stored in our content management system as a CMS-side backup so we don’t lose them if email delivery fails. Lawful basis: legitimate interest.
• To analyse and improve the site — aggregated, anonymised analytics help us understand what works and what to fix. Lawful basis: consent (you can grant or withdraw at any time).
• To maintain security and prevent abuse — server logs and rate-limit hashes help us detect attacks, fraud, and service issues. Lawful basis: legitimate interest in operational integrity.
• To meet legal obligations — for example responding to lawful data requests or maintaining tax-relevant records. Lawful basis: legal obligation.

We do not sell your personal data to third parties. Ever. We do not use your form submissions to train AI models. We do not run retargeting or behavioural advertising.

We use four categories of cookies and similar storage technologies. Your choice is recorded in the oob-consent cookie and the matching oob-cookie-consent entry in your browser’s localStorage. You can change your preferences at any time via the cookie banner, or by clearing those values in your browser settings.

Third-party embeds. When you play a Vimeo video on a case study or our showreel, Vimeo may set its own cookies governed by Vimeo’s privacy policy. We do not embed YouTube videos or social media widgets that set tracking cookies on page load.

Do Not Track signals. Browsers can send a Do Not Track (DNT) header. There is no settled industry standard for DNT, so we currently rely on our cookie banner as the canonical place to record your preferences. If you tick “Reject all” in the banner, no analytics, marketing, or preference cookies will be set regardless of your DNT setting.

We engage the following third-party providers to deliver this website. Each is a UK GDPR sub-processor with its own published privacy policy. We share only the minimum data each service needs to function.

• Vercel Inc. (USA) — hosting and edge network. Processes HTTP request logs (IP, user agent) for short-term operational and security purposes.
• Vercel Speed Insights (USA) — aggregated Core Web Vitals. Loaded only with analytics consent; no personal identifiers collected.
• Google Analytics 4 (Google LLC) (USA / EU) — aggregated usage analytics with IP anonymisation. Loaded only with analytics consent.
• Resend (USA, delivery via Amazon SES eu-west-1) — transactional email. Delivers contact form, Thumbprint access requests, and Creator Collective application submissions to our internal inbox.
• MongoDB Atlas (cloud-managed; AWS region selected by us) — managed database that backs our Payload CMS content (case studies, blog posts, media) and stores form submissions as a CMS-side backup.
• Vercel Blob (USA) — managed object storage for site media (images, video posters).
• Payload CMS — the open-source content management software running inside our Vercel deployment. Self-hosted; not a third-party data processor.
• Vimeo Inc. (USA) — video hosting and HLS delivery for our showreel and case studies. Vimeo may set its own cookies when you play a video.

For the free Bravery Index tool specifically, we additionally use:

• Apify (Czechia / USA) — collects the recent public posts of the social handle you submit, so we can analyse them. We send only the handle; we do not send your email or other personal data to Apify.
• Google (Gemini API, Google LLC) (USA / EU) — the AI model that reads the public posts and produces the Bravery Index score and summary. We send post captions and cover images; we do not send your email. Under Google’s paid API terms, this content is not used to train Google’s models.
• OOB Social Analytics (our own application, hosted on Vercel and Railway with a Neon-managed PostgreSQL database, Amazon S3 storage in London / eu-west-2, and Upstash Redis) — runs the analysis and stores the result, your email, and a few of the analysed public post thumbnails to include in your report.
• Resend — also delivers the Bravery Index report email to you (in addition to the internal-inbox use noted above), and, if you consent, holds your email in a marketing audience.

We may add or change sub-processors as the site evolves. Material changes will be reflected in this list with a revised “Last updated” date.

Several of our sub-processors are based outside the UK and EEA — primarily in the United States. Where personal data is transferred internationally, we rely on one of the following safeguards required by UK GDPR:

• UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs) with the UK Addendum, included in our agreements with US-based providers.
• EU–US Data Privacy Framework certification, where the provider is certified (Vercel, Google, and others publish their certification status).
• UK Adequacy Regulations for transfers within the EEA.

You can request a copy of the relevant transfer mechanism for any specific sub-processor by emailing richard@ourownbrand.co.

We are transparent about where AI and machine learning are used by OOB, both on this website and across our work:

• Thumbprint (OOB Labs). Our brand-fidelity engine analyses social media performance for clients who’ve signed an engagement contract. If you submit the Thumbprint access-request form on our Labs page, we use your contact details only to follow up with you about access — nothing is processed by the model itself unless you become a paying client and we contract separately for it.
• Bravery Index (OOB Labs). Our free Bravery Index tool uses AI (Google’s Gemini) to read the recent public posts of a handle you submit and produce a provisional “bravery” score (0–100) and a short written summary. This is an informational marketing report — it is not a decision that produces legal or similarly significant effects about you, and it is not used to evaluate you. Scores are provisional, generated by a language model, and may vary between runs; they are not a definitive measurement.
• No AI-generated public copy. We do not use AI to write or rewrite the editorial copy on this website. Blog posts, case studies, and service descriptions are written by our team.
• No automated decision-making about you. We do not make any solely-automated decisions that have legal or significant effects on you (no AI scoring of your enquiry, no automated rejection of contact submissions, no AI-driven pricing).
• Site-wide AI & bot disclosure. Our /llms.txt file at ourownbrand.co/llms.txt tells AI crawlers what they may and may not index. We do not opt our content out of mainstream search indexing.

We only retain personal data for as long as we have a reason to. Our defaults:

• Contact, Thumbprint & Creator Collective form submissions — sent via Resend to our inbox AND stored in our Payload CMS as a backup. Retained while your enquiry is active and for up to 24 months after, then deleted unless we have a contractual reason to keep them longer (e.g. you become a client). Resend retains email delivery logs per its own retention policy.
• Bravery Index audits — the analysis result for a given handle is cached for up to 7 days (to avoid re-running it), then refreshed on the next request. Your email and lead record are kept on the same basis as the form submissions above (up to 24 months). The re-hosted post thumbnails used in your report are stored alongside the cached result. You can ask us to delete any of this sooner, or unsubscribe from marketing, at any time.
• Google Analytics data — retained for 26 months per our GA4 configuration, then aggregated into long-term reports without identifiers.
• Vercel request logs — retained by Vercel for up to 30 days for security and debugging.
• Rate-limit hashes — discarded automatically after the rate-limit window expires (typically within one hour).
• Cookie consent record — your consent choice is stored in the oob-consent cookie for 12 months or until you clear it.
• CMS content (blog posts, case studies, projects) — retained indefinitely as part of our editorial archive. This contains no visitor personal data.

You may request earlier deletion of your data at any time — see Section 09.

Under UK GDPR you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data (‘right to be forgotten’).
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing of your data for marketing or profiling purposes.
• Right to restrict processing — request that we limit how we use your data in certain circumstances.
• Right to withdraw consent — where processing is based on consent (e.g. analytics cookies), you may withdraw it at any time via the cookie banner. This does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email richard@ourownbrand.co. We will respond within 30 days. If we cannot resolve your concern, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

This website is intended for a professional B2B audience. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted information to us, please contact richard@ourownbrand.co and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will revise the “Last updated” date at the top of this page.

For material changes (for example, adding a new sub-processor that handles personal data, or a change to our retention periods) we will surface a banner notice on our homepage for at least 30 days. We encourage you to review this page periodically.

For any questions or concerns about this Privacy Policy, or to exercise your data rights, please get in touch: