Who we are
The Brooklyn Pacific platform (the “Platform”), available at hq.brooklynpacific.com, and this website at brooklynpacific.com are operated by Zonster LLC, a Wyoming limited liability company (“Zonster,” “we,” “us” or “our”). Brooklyn Pacific is the name of the platform we operate. We are responsible for the information described in this policy. You can reach us at [email protected].
What this policy covers
The Platform is a private, internal operations tool. It is not offered to the public, there is no sign-up, and only our owner and people we specifically authorize can log in. We use it to manage the brands, stores, social media accounts, advertising accounts and creator accounts that we own or operate.
This policy explains:
- what information the Platform accesses from each connected service, and why;
- how that information is used, stored, protected, retained and deleted; and
- the choices available to anyone whose information may pass through the Platform, including people who comment on or message our accounts, our customers and our business contacts.
It also covers this public website. Third-party services we connect to have their own privacy policies, which govern how they handle your information on their own platforms.
Information we collect
This website
brooklynpacific.com has no forms, no analytics, no advertising and no cookies, and it loads nothing from third parties. Our hosting provider, Cloudflare, processes standard technical request data (such as IP address, browser type and the page requested) to deliver the site and protect it from abuse.
Platform users
For the people authorized to log in, we keep login identity (name and email address), multi-factor authentication settings, and security logs such as sign-in times, IP addresses and devices.
Connected services
When we connect one of our accounts on a third-party service, the service asks us to approve the specific permissions (“scopes”) the Platform requests. We request the minimum permissions needed for the features we use. The next section describes the data involved, service by service.
Information from people who interact with our accounts
Running our accounts means the Platform may process limited information about other people: for example, the public username and text of a comment on one of our posts, a message sent to one of our accounts, a customer order’s details as provided by a marketplace, or a business contact’s name and email address. We use that information only to reply, fulfill orders, keep business records and run our accounts.
Data from connected services
The exact data depends on which features are in use for a given account. In every case, the data comes from accounts that we own or operate and is used only to run those accounts.
- What we access
- Basic profile information (name, email address and profile picture) when signing in with Google; Google Calendar events and calendar lists, to show and edit them in our calendar; and, where connected, Google Ads and Google Merchant Center account, campaign, product and performance data, to manage our advertising and product listings.
- Why
- To sign in, to keep our calendars in one place (including creating, editing and responding to events), and to manage and report on our own advertising and product listings.
- What we do not access
- We do not use the Gmail API or request access to Gmail through Google’s APIs.
YouTube
- What we access
- Through the YouTube API Services: our channel’s profile and settings; the videos, Shorts, playlists and thumbnails we upload and their metadata (title, description, tags, category, privacy status, scheduled publish time, made-for-kids and altered-or-synthetic-content settings); comments on our videos and our replies; and channel and video analytics such as views, watch time, subscribers and engagement.
- Why
- To upload and schedule our videos, manage their details, respond to comments, and measure how our content performs.
- YouTube API Services
- The Platform uses YouTube API Services. By connecting a YouTube channel to the Platform you agree to the YouTube Terms of Service, and Google’s handling of your information is described in the Google Privacy Policy. You can revoke the Platform’s access to your Google and YouTube data at any time through the Google security settings page. We delete stored YouTube data as described in Retention.
TikTok
- What we access
- Through TikTok’s Login Kit, Content Posting API and Display APIs: our account’s basic profile (display name, avatar and open ID), account statistics (such as follower and like counts), the list of our videos and their metrics, and permission to upload videos and photos to our account’s TikTok inbox as drafts (and, where TikTok has approved it, to publish them) together with the caption and settings we choose.
- Why
- To send finished videos and captions to our TikTok accounts for publishing, and to measure how our content performs. Drafts sent to the inbox are reviewed and published by a person in the TikTok app.
Meta (Facebook, Instagram and Threads)
- What we access
- For the Facebook Pages, Instagram professional accounts and Threads profiles we manage: page and account profile information; the posts, Reels, Stories and media we publish; comments and direct messages sent to our accounts and our replies; and insights such as reach, impressions and engagement. Where our ad accounts are connected, we access campaign, ad set, ad, audience-size, catalog and performance data through the Meta Marketing API.
- Why
- To publish and schedule our content, reply to comments and messages, measure performance, and manage our own advertising.
Amazon (Selling Partner API and Amazon Ads API)
- What we access
- For our own seller accounts: orders and order status, sales and traffic reports, inventory and fulfillment data, product catalog and listing data (including A+ content), fees, refunds, settlements and other financial data, and account health notifications. For our own advertising profiles: campaigns, ad groups, keywords, targets, bids, budgets, search-term and performance reports.
- Why
- To manage listings and inventory, keep accurate business and accounting records, and analyze and optimize our advertising, including bid and budget changes that we approve.
- Buyer information
- We do not request Amazon’s restricted roles for buyer personally identifiable information. If any buyer personal information is ever provided to us, we use it only to fulfill the related order or meet a legal obligation, and keep it no longer than Amazon’s policies allow (see Retention).
- Amazon policies
- We handle Amazon information in line with the Amazon Services API Developer Agreement, the Acceptable Use Policy and the Data Protection Policy, including encryption, access controls, logging and incident reporting (see Storage and security).
Fanvue
- What we access
- For the creator accounts we operate, through the scopes granted to our Fanvue OAuth app: profile information, posts and their pricing and visibility, subscriber and follower information (such as usernames and subscription status), message threads with fans, and earnings and payout data.
- Why
- To publish and schedule posts, reply to fan messages (replies are drafted with help from AI and approved by a person before sending), and track revenue for each creator account.
Other services
The Platform also connects to other services we use to run our businesses, such as bank and brokerage connections, payment processing, print-on-demand fulfillment, email, and other social networks (for example X, LinkedIn, Pinterest and Reddit). The same principles apply: minimum permissions, use only for our own operations, encryption, and deletion on disconnection or request.
Google API Services: Limited Use
Brooklyn Pacific’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, for information received from Google APIs (including YouTube API Services):
- We use it only to provide and improve the user-facing features of the Platform described in this policy.
- We transfer it to others only as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.
- We do not use or transfer it to serve advertisements, including retargeting, personalized or interest-based advertising.
- We do not sell it, and we do not transfer it to data brokers or information resellers.
- We do not use it to determine creditworthiness or for lending purposes.
- We do not allow humans to read it unless we have your affirmative agreement for specific messages or data, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymized and used for internal operations.
- We do not use it to develop, improve or train generalized or non-personalized artificial intelligence or machine-learning models.
How we use information
We use the information described above only to:
- publish, schedule and manage content on our own accounts;
- reply to comments and messages sent to our accounts;
- manage our listings, inventory, orders and advertising;
- measure performance and prepare internal reports;
- keep accurate financial, tax and business records;
- prepare drafts for human review (see AI processing);
- secure the Platform, prevent abuse and investigate incidents; and
- meet legal obligations and platform policies.
What we never do
- We do not sell or rent personal information or platform data, and we do not share it for cross-context behavioral advertising.
- We do not use data from connected services to target, build or enrich advertising audiences or user profiles.
- We do not combine data across services to profile individuals.
- We do not use connected-service data to make decisions about anyone’s credit, employment, housing or insurance.
- We do not use connected-service data for any purpose other than running the accounts it came from.
AI processing
Some Platform features use artificial-intelligence services to help us work: for example, drafting post captions, replies to comments and messages, listing copy and summaries of performance reports, and checking generated images. To produce a draft, the relevant content (such as the text of a comment we are replying to, or the metrics a report summarizes) is sent to an AI provider through its API.
- Our main provider is Anthropic (Claude). We also use specialized providers for image, video, voice, transcription and search features.
- We send only the content needed for the task, and the provider processes it to return a result to us.
- We use these providers under their commercial API terms, which state that data submitted through their APIs is not used to train their models by default. We have not opted in to any program that would allow such use.
- We do not use information from connected services, including information received from Google APIs, to train generalized AI or machine-learning models ourselves.
- AI output is a draft. Anything that would be published, sent or spent on our behalf goes through a person’s approval unless it falls within narrow, pre-approved rules that we set and monitor.
Storage and security
The Platform’s data is stored in the United States with Supabase (PostgreSQL database and file storage) and Cloudflare (application hosting and object storage).
- Encryption. Data is encrypted in transit with TLS 1.2 or higher and encrypted at rest (AES-256). Access and refresh tokens for connected services are additionally encrypted in Supabase Vault and are never sent to the browser.
- Access control. The Platform is protected by Cloudflare Access and multi-factor authentication, and only authorized people can reach it. Each internal service uses its own database role limited to the data it needs, and row-level security is enabled on every table.
- Logging and monitoring. Every action taken by a person, automated job or AI agent is recorded in an audit log, and sign-ins and security events trigger alerts.
- Least privilege. We request only the permissions we need, and actions that publish, send or spend are gated by approval rules.
- Incident response. If we discover a security incident affecting your information, we will notify affected people and platforms as required by law and by platform policy, including notifying Amazon within 24 hours of detecting an incident involving Amazon information.
No system is perfectly secure, but we work to protect information with safeguards appropriate to its sensitivity.
Retention
We keep information only as long as we need it for the purposes in this policy:
- Access tokens are kept while an account is connected and deleted immediately when it is disconnected in the Platform or when we learn that access was revoked.
- Content, comments, messages and metrics from a connected service are kept while the account is connected and deleted within 30 days after it is disconnected or access is revoked.
- YouTube data obtained through YouTube API Services is deleted within 7 days after access is revoked, and data that YouTube’s policies require us to refresh is refreshed or deleted within 30 days.
- Amazon buyer personal information, if any is received, is kept no longer than 30 days after the order is delivered, unless a longer period is required by law (for example, for tax records), in which case it is kept only for that purpose and that period.
- Financial and business records (such as order totals, fees, payouts and ad spend) are kept for as long as tax and accounting law requires, generally up to seven years, without personal information wherever possible.
- Security and audit logs are kept for up to 12 months, or longer if needed to investigate an incident.
Deleted data may remain in encrypted backups until those backups expire on their regular schedule. We keep daily backups for 30 days and monthly backups for 12 months, so deleted data is gone from every backup within 13 months. Backups are used only to restore service and are not used for any other purpose.
Disconnecting and deleting data
You can stop our access and have your data deleted in any of these ways:
- Disconnect in the Platform. Authorized users can disconnect any account from the Platform’s connection settings. Disconnecting revokes the stored tokens immediately and starts deletion as described in Retention.
- Revoke access at the service. For Google and YouTube, use the third-party access page in your Google Account. For TikTok, remove the app under Security and permissions in TikTok’s settings. For Facebook and Instagram, remove the app under Apps and websites or Business integrations in your settings. For Amazon, remove the app in Seller Central under Manage your apps, or revoke it in the Amazon Ads console. For Fanvue, remove the app from your connected apps.
- Email us at [email protected] with the subject “Data deletion request”. Tell us which account or information the request concerns. We will confirm receipt, complete the deletion within 30 days, and confirm when it is done.
People who are not Platform users, such as someone who commented on or messaged one of our accounts, can also ask us by email to delete information about them that we hold.
Meta data deletion instructions
If you have connected a Facebook or Instagram account to the Platform, or interacted with one of our accounts, you can ask us to delete your data in either of these ways:
- Remove the app from Facebook or Instagram. Go to your Facebook settings, open Apps and websites (or Business integrations), select Brooklyn Pacific and choose Remove. Meta then sends us a data deletion request through our data deletion callback. We delete the data associated with your account and give you a confirmation code and a link where you can check the status of the deletion.
- Email us at [email protected] with the subject “Meta data deletion” and your Facebook or Instagram username. We will complete the deletion within 30 days and confirm by email.
Your rights
Depending on where you live, you may have the right to ask us to access, correct, delete or provide a copy of the personal information we hold about you, and to object to or limit certain processing. We honor these requests regardless of where you live, and we will not treat you differently for making one. To make a request, email [email protected]. We may need to verify your identity before acting on it, and we will respond within 30 days (or sooner where the law requires).
You can also learn how each service handles your information in its own policy: the Google Privacy Policy, the TikTok Privacy Policy, the Meta Privacy Policy, the Amazon Privacy Notice and the Fanvue Privacy Policy.
Children
The Platform and this website are not directed to children, and we do not knowingly collect personal information from anyone under 13 (or the minimum age required in their country). If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as the Platform or the law changes. We will post the updated version on this page and change the “Last updated” date above. If a change materially affects how we use information received from a connected service, we will ask for any new consent the service requires before the change takes effect.
Contact
For questions about this policy or to make a privacy request, contact:
Zonster LLC, operator of the Brooklyn Pacific platform
Email: [email protected]
Website: brooklynpacific.com