★ BRUULABS · YOUR AI MARKETING STUDIO ★ WHAT YOU CAN IMAGINE, YOU CAN MAKE ★ NOW TAKING FOUNDING PARTNERS · SEA ★ BRUULABS · YOUR AI MARKETING STUDIO ★ WHAT YOU CAN IMAGINE, YOU CAN MAKE ★ NOW TAKING FOUNDING PARTNERS · SEA ★ BRUULABS · YOUR AI MARKETING STUDIO ★ WHAT YOU CAN IMAGINE, YOU CAN MAKE ★ NOW TAKING FOUNDING PARTNERS · SEA ★ BRUULABS · YOUR AI MARKETING STUDIO ★ WHAT YOU CAN IMAGINE, YOU CAN MAKE ★ NOW TAKING FOUNDING PARTNERS · SEA
bruulabs

Privacy Policy

Effective 20 August 2026

Bruulabs Sdn Bhd (Co. No. 202601025548), trading as Bruulabs (“we”, “us”), maker of the Bruulabs content workspace, helps businesses create branded social content and publish it to their own social accounts. This policy explains what we collect, how we use it, and the choices you have. We keep it short and plain.

What we collect

  • Account details — your name and email when you sign up.
  • Social connections — when you connect an Instagram, Facebook, TikTok, or YouTube account, we receive an access token from that platform and your account’s public identifiers (account name/ID). We never see or store your social-media password.
  • Content you create — the captions, images, and posts you make or schedule in Bruulabs.
  • Post performance — basic engagement numbers (views, likes, comments) we read from the platforms for the posts we publish on your behalf, to show you how they did.
  • Usage data — standard logs (e.g. pages visited, errors) to keep the service working and secure.

How we use it

Only to provide the service: to let you create content and publish posts that you have approved to your own connected accounts, to show you how those posts performed, and to support and secure your account. We do not use your content to train models you didn’t ask us to, and we do not post anything without your approval.

If we contacted you about our services

Separately from the product, we sometimes contact businesses to introduce our marketing services. If you received an email from us without having signed up, this section is the one that applies to you.

  • Where we got your details — from information the business itself has published: its website, its public business listing, or its public social profile. We do not buy contact lists and we do not take details from private or personal accounts.
  • What we hold — business contact details only: name, role, business email or phone, company, website, public listing. Nothing sensitive, and nothing about you as a private individual.
  • Why we may do this — our legitimate interest in offering business-to-business services, balanced against your interests. That balance is why opting out is immediate and needs no reason.
  • How to stop it — reply with the word “remove”, or email jin@bruulabs.com. We stop contacting you and keep only your email address on a suppression list, for the sole purpose of not contacting you again by mistake.
  • How long we keep it — only while the business remains a plausible fit and we are actively considering contact. Ask us to erase it and we will.

Who we share it with

We act on your behalf, so we pass the content you approve to the platform you chose (Meta / Instagram / Facebook, TikTok, or Google / YouTube) through their official APIs. We use a few standard infrastructure providers (hosting, database) to run the product. We do not sell your data, and we do not share platform data with anyone except as needed to deliver the feature you asked for. Our use of information received from Meta APIs follows the Meta Platform Terms; our use of Google/YouTube data follows the Google API Services User Data Policy; our use of TikTok data follows the TikTok Developer Terms.

Your access tokens

The tokens that let us post for you are sensitive, so we encrypt them at rest, restrict access to them, and protect them with commercially reasonable safeguards. You can disconnect any account at any time, which revokes our access and removes the stored token.

Keeping and deleting your data

You can disconnect an account or ask us to delete your data at any time by emailing jin@bruulabs.com. We delete your connections and personal data within a reasonable period of your request, and we honour deletion requests forwarded by the platforms. We keep only what we need to run the service or meet legal obligations.

Your rights, and the law we work under

We are a Malaysian company and we handle personal data under the Personal Data Protection Act 2010 (PDPA). Whether you are a customer or someone we contacted, you can ask us what we hold about you, ask us to correct anything wrong, withdraw consent or object to being contacted, or ask us to limit or delete what we hold. Email jin@bruulabs.com and we will respond. If you are not satisfied, you may raise the matter with the Personal Data Protection Commissioner, Malaysia.

Our registered business address is H-7-2, Block H, Setiawalk, Malaysia. Some of our infrastructure providers store data outside Malaysia.

Cookies

We use a small number of essential cookies to keep you signed in. We do not use advertising trackers.

Children

Bruulabs is a business tool and is not intended for anyone under 18.

Changes & contact

If we make a meaningful change to this policy, we’ll update the date above and, where appropriate, let you know. Questions or requests: jin@bruulabs.com.