Privacy policy

Draft. Last updated 2026-09-26. Contact: [email protected].

What we collect

• Account data: your name, work email and hashed password, plus your workspace and team members.
• Business profile data you provide or we read from your public landing page: offer details, brand colors, logos and compliance notes.
• Advertising account data, when you connect an ad account:
  • ad account, Page and ad set identifiers
  • an access token, which is encrypted at rest
  • ad-level performance metrics: spend, impressions, clicks, conversions and conversion value
• Generated creative: the ad copy, images and metadata we produce for you.
• Pilot applications: the details you submit through our application form.

How we use it

• To generate ad variants, create draft ads in the ad accounts you connect, and read their performance.
• To decide which ads are profitable, recommend or perform pauses you've enabled, and write your reports.
• To improve generation for that same account only. Learning is per account and never shared with other customers. Aggregate, anonymized statistics may inform product defaults.
• To operate, secure and support the service.

Meta platform data

We access Meta data only with the permissions you grant: ads management, ads read, business management and Page listing. We use it solely to provide the service to you. We don't sell it or use it for advertising profiles, and we delete it when you disconnect or ask us to (see data deletion).

Sharing

We use subprocessors to run the service:

• cloud hosting and database
• AI model providers for copy and image generation, which only receive the content needed to generate your ads
• Meta's APIs

We don't sell personal data.

Optional advertising measurement

When you allow advertising cookies, we use Meta Pixel and Conversions API to measure visits to our public website, successful pilot invoice requests, and confirmed paid subscriptions. Meta may receive browser and click identifiers, your browser's user agent, event times, and payment amount and currency. For a request, we share a SHA-256 hashed version of your email address for matching. Hashing does not make this anonymous. We do not send card details, bank references, passwords, workspace content, or connected clients' ad data.

You can reject or change your choice using Advertising cookie preferences on the public site. Tracking is off until you allow it, and we honor Global Privacy Control. Browser tracking does not run on client or admin pages. Payment events use the consent recorded with your request; rejecting cookies in that same browser also withdraws that request's consent for future server events. Events already sent to Meta cannot be recalled by changing this choice. Meta's privacy policy describes its processing. Contact [email protected] to withdraw consent for a request from another browser.

Security

• Ad platform tokens are encrypted at rest.
• Passwords are hashed.
• Each workspace's data is isolated from every other workspace.
• Every publish and pause action is recorded in an audit log.

Retention and your rights

We keep your data while your account is active. You can ask us to access, correct, export or delete your data at [email protected].

This policy is a working draft and will be reviewed by counsel before general availability.