Privacy Policy

This Privacy Policy explains how [Company name] handles personal data when you use [Product name] (the "Service"): a tool that plans, creates, publishes and reports on ad campaigns on Meta (Facebook and Instagram), Google Ads and TikTok on your behalf, with the help of AI.

Who we are

[Company name] ("we", "us", "our") runs the Service and is responsible for the personal data described in this policy.

• Registered address: [Registered address]
• Company registration number: [Company registration number]
• General contact: [Contact email]
• Privacy questions and requests: [Privacy email]

The businesses that use the Service decide which ad accounts, customers' data and content they bring into it. For that content we process data on their behalf and according to their instructions.

Information we collect

Information you give us

• Account and profile: your name, email address, password (stored only as a one-way hash), profile photo, phone number if you add one, language, and your sign-in settings such as passkeys and two-factor authentication.
• Workspace and business details: workspace and business name, website, industry, country, currency, the goals and marketing channels you choose during onboarding, and the people you invite with their roles (owner, editor or viewer).
• Content you create or upload: campaigns, ad copy, designs and creatives, images and files in your library, brand kits (logos, colours and fonts), templates, saved audiences, and your conversations with the AI assistant.
• Billing details: billing name, email, address, country and tax details, your plan, add-ons and invoices. Card payments are handled by our payment provider: we keep only the card brand, the last four digits and the expiry date, never the full card number.
• Messages: what you send us when you contact support.
• Contact requests: what you send us through the contact form on our website: your name, email address, WhatsApp number if provided, and company, your monthly ad budget and goals, and the language you wrote in. We also keep the type of browser you used and a scrambled (hashed) form of your IP address, which helps us spot spam.

Information from the ad platforms you connect

When you connect Meta, Google Ads or TikTok, you sign in with that platform and choose which ad accounts the Service may use. For those accounts we receive and store:

• your user ID and name on that platform, and the access tokens that let us act for you (encrypted);
• the ad accounts, business accounts, Pages and pixels you allow us to see;
• campaigns, ad sets or ad groups, ads, creatives, targeting and budgets;
• performance data such as impressions, clicks, spend, conversions and revenue, with breakdowns by age, gender, region and placement. These are totals for groups of people, never data about an individual person;
• the status of what we publish for you, and the notices the platforms send us about your accounts.

Information collected automatically

• Usage and device data: IP address, browser and device type, the pages you open, the actions you take and when, in our server logs and in the audit log of each workspace.
• Cookies and similar technologies: see Cookies.

Information from websites you ask us to read

When you import a brand kit from a website, we fetch that public website to find its logo, colours and fonts.

How we use information

• To provide the Service: create and manage your account and workspaces, keep your content, and show your dashboards and reports.
• To act on your instructions on the ad platforms: create, change, pause and publish the campaigns and ads you or your team approved, and keep their status and results up to date.
• To provide AI features: write ad copy, create images and designs, plan campaigns and suggest improvements (see AI features).
• For billing: manage your plan, trial, quotas, add-ons and invoices.
• To keep the Service secure and reliable: sign you in, prevent abuse and fraud, fix problems and keep an audit log of important actions and decisions.
• To communicate with you: service emails such as sign-in codes, invitations, finished exports and important changes, and replies to your requests. We send marketing emails only if you agree to them, and you can unsubscribe at any time.
• To meet legal obligations and enforce our Terms of Service.

We do not sell your personal data, and we do not use it, or any data from the ad platforms, to advertise our own products.

Data from Meta, Google and TikTok

We reach the ad platforms only through their official APIs, only after you connect them, and only for the accounts and permissions you grant. We use the data we receive from them only to provide the Service to you: to manage your ads and show you their results. We do not sell it, we do not use it for other purposes (such as building profiles of people, advertising, or deciding anyone's eligibility for credit, employment, housing or insurance), and we share it only with the service providers that help us run the Service (see Sharing), as the platforms' terms allow. Our staff look at it only when you ask us to (for example for support), to keep the Service secure, or when the law requires it.

Google user data

[Product name]'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, the data we receive through the Google Ads API:

• is used only to provide and improve the features of the Service that you use;
• is not transferred to anyone else, except as needed to provide those features, to keep the Service secure, to comply with the law, or as part of a merger or acquisition of which we tell you first;
• is not used to serve ads;
• is not read by people, except with your permission, for security, to comply with the law, or when it is aggregated and anonymised for internal operations;
• is not used to develop, improve or train generalised artificial intelligence or machine learning models.

Meta Platform Data

We process data from Meta's platform in line with the Meta Platform Terms and Developer Policies: only for the purposes described here, keeping it secure, deleting it when we no longer need it to provide the Service or when you or Meta ask us to, and handling Meta's data deletion requests (see How to delete your data).

TikTok data

We use data from TikTok API for Business in line with TikTok's developer terms, only to manage your TikTok ads and show their results in the Service.

AI features

The Service uses AI models from third-party providers (currently Anthropic for text and OpenAI for images) to write ad copy, create and edit images and designs, plan campaigns, analyse results and suggest changes. For each request we send the provider only what the request needs: for example your instructions, your brand kit, campaign details and, for suggestions, performance totals. We use their business services, whose terms do not allow them to use this content to train their models.

AI output can be wrong or unsuitable. Nothing the AI suggests is published on an ad platform until a person in your workspace reviews and approves it. We keep AI conversations, generated content and suggestions in your workspace so you can use them again, and we record how much AI each workspace uses (model, size and cost of each request) to manage quotas.

Legal bases

Where laws such as the EU General Data Protection Regulation (GDPR) or Indonesia's Personal Data Protection Law (Law No. 27 of 2022) apply, we process personal data:

• because it is necessary to perform our contract with you (to provide the Service);
• for our legitimate interests, such as keeping the Service secure, improving it and supporting our customers, where your rights do not override those interests;
• with your consent, for example for optional marketing emails (you can withdraw it at any time);
• to comply with legal obligations, for example keeping tax records.

Sharing

We share personal data only:

• with the ad platforms you connect, when we act on your instructions (for example to publish an ad);
• with the other people in your workspace, according to their role;
• with service providers that process data for us under contracts that oblige them to protect it:
  • hosting and databases: [Hosting provider];
  • file storage: Cloudflare (R2) when enabled, otherwise our own servers;
  • AI: Anthropic (text) and OpenAI (images);
  • email delivery: [Email provider];
  • payments: [Payment provider], once paid billing starts;
• when the law requires it, or to protect the rights, safety and property of our users, the public or us;
• as part of a merger, acquisition or sale of assets, if the buyer goes on protecting the data as this policy describes. We will tell you before that happens.

We do not sell or rent personal data.

International transfers

Our service providers may process data outside your country, for example in the United States. Where the law requires it, we protect these transfers with appropriate safeguards, such as standard contractual clauses.

How long we keep data

Security

We protect data with encryption in transit (HTTPS), encryption at rest of access tokens and other secrets, one-way hashed passwords, optional two-factor authentication and passkeys, role-based access in workspaces and an audit log of important actions. Our staff need two-factor authentication to use our admin tools. No system is perfectly secure: if a breach affects your personal data, we will inform you and the authorities as the law requires.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict some processing, and to withdraw your consent. In the Service you can:

• download a copy of your data in Settings › Profile › Download your data;
• correct your details in Settings › Profile;
• delete your account in Settings › Profile › Delete account;
• disconnect an ad platform in Integrations.

For anything else, email [Privacy email]. We answer within 30 days. You may also complain to your data protection authority.

How to delete your data

• Your account: open Settings › Profile › Delete account. We delete your profile, sign-in methods and personal data, and the workspaces only you own (after ending their connections to the ad platforms; their data is purged 30 days later). Invoices are kept as long as the law requires.
• A workspace: an owner can delete it in Settings › Workspaces. Its content and data are purged 30 days later.
• A connection to an ad platform: disconnect it in Integrations: we stop syncing and delete its access tokens. You can also end our access on the platform itself: on Facebook in Settings & privacy › Settings › Business integrations, on Google in Third-party apps & services, and on TikTok in your TikTok for Business account.
• Facebook data deletion requests: when you remove [Product name] from your Facebook account and ask for your data to be deleted, Meta tells us. We end every connection made with your Facebook account and delete its access tokens and your Facebook user ID and name, and you get a confirmation code with a link to check the status of your request.
• By email: write to [Privacy email] from the email address of your account. We complete deletion requests within 30 days.

Cookies

The Service uses essential cookies: to keep you signed in (the session and "remember me"), to protect forms against forgery (XSRF-TOKEN), and to remember your language, appearance and sidebar choices. Your browser's local storage keeps a few preferences and backups of unsaved designs. When dashboard analytics is enabled by the platform administrator, Google Tag Manager can load Google Analytics 4 for page views and interactions. Our event payloads exclude names, emails, form values and URL parameters. Advertising consent defaults to denied. [Company name] must describe its analytics tags and applicable consent choices before publishing this policy. You can delete cookies in your browser settings, which signs you out.

Children

The Service is a business tool and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy. The date at the top of the page shows when it last changed. If a change is significant, we will tell you by email or in the Service before it takes effect.

Contact us

[Company name], [Registered address]. Email: [Privacy email].