Privacy Policy

Account information. When you register, we collect your name, email address, and password. If you enable two-factor authentication, we store the associated TOTP secret or WebAuthn credential.

Business information. To configure your campaigns, we collect your company name, website URL, industry, location, target audience details, and brand assets you upload.

Ad account credentials. When you connect advertising platforms (Meta, Google, TikTok, or Bing Ads), we store OAuth access tokens and refresh tokens. We do not store your platform passwords.

Campaign data. We collect and store campaign configurations, ad creatives, targeting parameters, performance metrics (impressions, clicks, conversions, spend), and optimization history.

Billing information. Payments are processed by Stripe. We store your Stripe customer ID and subscription status. We do not store credit card numbers, CVVs, or full bank account details on our servers.

Usage data. We collect information about how you interact with the Service, including pages visited, features used, and actions taken within your dashboard.

We use the information we collect to:

• Operate and deploy advertising campaigns on your behalf across Meta, Google, TikTok, and Bing Ads.
• Generate AI-driven ad creatives, copy, and targeting recommendations using our eight specialized agents.
• Optimize live campaign performance through automated bidding, audience refinement, and budget allocation.
• Generate performance reports, analytics dashboards, and actionable insights for your campaigns.
• Send transactional notifications about campaign status, billing events, approval requests, and system updates.
• Process payments, manage subscriptions, and maintain your spend balance.
• Improve the Service through aggregated, anonymized usage analytics.

We share data only as necessary to operate the Service. We do not sell your personal information.

Advertising platforms. We transmit campaign configurations, ad creatives, targeting parameters, and budget instructions to Meta (Facebook/Instagram), Google Ads, TikTok Ads, and Microsoft Advertising (Bing Ads) to deploy and manage your campaigns.

Stripe. We share billing-related information with Stripe to process subscription payments, top-ups, and refunds.

Resend. We use Resend to deliver transactional and notification emails. Your email address and name are shared for delivery purposes.

Anthropic & OpenAI. Our AI agents use Anthropic (Claude) and OpenAI models to generate ad copy, creative strategies, and campaign optimizations. We do not send personally identifiable information (PII) to these providers. Only business context, campaign parameters, and anonymized performance data are transmitted.

Sentry. We use Sentry for error tracking and application monitoring. Error reports may contain technical request metadata but are stripped of sensitive credentials.

Account data. Your account information, business details, and workspace data are retained while your account is active and for 90 days after account deletion to allow for recovery or data export.

Campaign performance data. Campaign metrics, optimization history, and reporting data are retained for 2 years after collection to support long-term performance analysis and historical reporting.

Ad platform credentials. OAuth tokens and refresh tokens for connected advertising platforms are deleted immediately upon account closure or when you disconnect a platform.

Billing records. Transaction records and invoices are retained as required by applicable tax and accounting regulations.

Regardless of your location, we provide the following rights with respect to your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request that we correct inaccurate or incomplete data.
• Deletion. Request that we delete your personal data, subject to legal retention obligations.
• Data export. Request a machine-readable export of your data, including campaign configurations, performance history, and creative assets.
• Restriction. Request that we restrict processing of your data in certain circumstances.
• Objection. Object to processing of your data for specific purposes.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Essential cookies. We use strictly necessary session cookies to authenticate your login and maintain your session state. These cannot be disabled without breaking core functionality.

Analytics (optional). We use PostHog for product analytics to understand how the Service is used and to identify areas for improvement. PostHog analytics are optional and can be disabled in your account settings. We do not use third-party advertising trackers on the Service.

Encryption in transit. All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.

Encryption at rest. Sensitive credentials, including OAuth tokens for connected ad platforms, are encrypted at rest using AES-256.

Role-based access control. Access to your workspace data is governed by role-based access control (RBAC). Team members only see data within their assigned scope and permission level.

Infrastructure. Our infrastructure is hosted on hardened, regularly patched servers. Database access is restricted to application services and protected by network-level isolation.

The Service is intended for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at [email protected].

We may update this Privacy Policy from time to time. For material changes, we will notify you by email at the address associated with your account at least 30 days before the changes take effect. Non-material changes (such as formatting or clarification) may be made without advance notice. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: