Privacy Policy

AdGenz.ai ("AdGenz," "we," "us," or "our") operates an AI-powered Meta advertising platform that helps marketing teams research, generate, edit, and publish ad creative. This Privacy Policy describes the personal information we collect, how we use it, the third-party services that help us deliver the product, and the rights you have over your data.

This policy applies to adgenz.ai, the AdGenz dashboard, our APIs, marketing pages, and any other product we describe as covered by this policy (together, the "Service").

Where AdGenz processes information about your end-customers (for example, contacts in your knowledge-base files), AdGenz acts as a data processor and you (or your employer) are the data controller. Where AdGenz processes information about you as an account holder, AdGenz acts as the data controller.

AdGenz.ai is operated by the entity that has entered into the AdGenz Terms of Service with you. For privacy-related contact, write to:

3.1 Account information

When you create an account, we collect your email address, display name, and (if you use single sign-on) the profile photo URL returned by your identity provider. Authentication is handled by Supabase Auth. If you sign in with Google, Google returns your basic profile information (name, email, avatar) to us.

3.2 Workspace & team information

We store the workspaces you create, the members you invite (email, role, capabilities, and an audit log of activity), and the invitations you send. Workspace owners and admins can see activity logs of who took which action — generation, approval, publishing, etc. — under their workspace.

3.3 Brand & content data

When you build a brand, we store everything you provide: brand name, product description, landing-page URL, brand assets (logos, images), knowledge-base documents (PDFs, text, scraped URLs), ICPs (ideal customer profiles), voice profiles, angles, generated ads, edit history, and any creative briefs. Files you upload are stored in Supabase Storage.

3.4 Source ads & competitor research

When you point AdGenz at a competitor ad URL or upload a reference image, we fetch and process that public content to generate similar or contrasting creative. We do not use your competitor research to train models for other customers.

3.5 Meta Platform Data (after you connect Meta)

If you connect a Facebook or Instagram account, we receive and store the information described in section 7. Meta Platform Data below. We request only the scopes needed to deliver the product and explain each one there.

3.6 Billing & usage data

Paid plans are billed through Stripe. Stripe collects payment card and billing-address details directly — AdGenz never sees or stores your full card number. We receive and store: your plan, subscription status, customer ID, invoice metadata, and credit balances/transactions. We also log per-feature credit usage to enforce plan limits and show you transparent usage reports.

3.7 Telemetry & logs

We log the following to operate, secure, and improve the Service:

• API request metadata — endpoint, status, timing, IP address, user-agent.
• Background job records (Inngest run IDs, status, duration, errors).
• Per-call AI provider usage — model name, token counts, latency, cost estimates — used for admin metering and billing reconciliation. We do not log prompt or completion content for telemetry purposes.
• Application errors and stack traces, with personal identifiers minimized.

3.8 Cookies & local storage

See section 13 below. We use a small set of strictly necessary cookies and use sessionStorage for short-lived state such as the Meta OAuth nonce used to prevent CSRF.

We use information for the following purposes and legal bases (where the GDPR or comparable law applies):

AdGenz is an AI-first product. To generate ads, copy, images, and analyses, we send your inputs (prompts, brand data, knowledge-base excerpts, source images) to third-party AI providers acting as our processors. We have configured each provider to act on our instructions only.

Providers and what they receive

What does not happen

• We do not authorize providers to use your inputs or outputs to train their public foundation models. Anthropic, Google, and Fal AI offer enterprise/API terms that exclude API content from model training by default; we rely on those terms.
• For generating your own ads, retrieval is scoped to your workspace and brand: Supermemory containers used to draft your copy and images pull only from your own brand's knowledge base, angles, and history, and do not read another workspace's content.

Shared creative library (opt-out available)

Separately from the retrieval above, ads you approve or mark as a winner may be contributed to a cross-workspace creative library that powers format/style/hook suggestions and per-niche playbooks for every AdGenz workspace. Only anonymized creative attributes are shared (format, visual style, hook type, craft grade, and similar) — not your brand identity, and a workspace never sees its own contributions presented back to it as inspiration. Workspace owners and admins can turn this off at any time from Settings → Global Inspiration Library; once disabled, no further approved ads from that workspace are added to the shared library.

We rely on the sub-processors listed below to operate the Service. Each is bound by a written agreement that limits their use of data to providing services on our instructions.

We update this list as our processing changes. Material additions will be announced in this document and, where required, by email to workspace owners.

When you connect a Meta account, AdGenz integrates with Facebook Login for Business and the Meta Graph & Marketing APIs (currently v25.0). This section is provided to comply with the Meta Platform Terms and Developer Policies.

7.1 Permissions we request and why

7.2 Data we receive from Meta

• Your Meta user ID and display name (to identify which account is connected).
• The ad accounts you administer, with account ID, name, status, and currency.
• The Pages you administer, with Page ID, name, and category.
• Campaigns, ad sets, and ads in the selected ad account, plus their insights (spend, impressions, clicks, CTR, CPC, CPM, reach, frequency, purchase and link-click actions, revenue, ROAS).
• A short-lived access token, which we exchange for a long-lived token and store encrypted at rest.

7.3 What we do not do with Meta Platform Data

• We do not sell, license, or transfer Meta Platform Data to data brokers or advertisers.
• We do not use Meta Platform Data to build profiles of individuals or for surveillance.
• We do not use Meta Platform Data to determine eligibility for housing, employment, insurance, education, credit, or government benefits.
• We do not use Meta Platform Data to discriminate or to encourage discrimination.
• We do not attempt to re-identify de-identified data or decode anonymized data.
• We do not request, store, or use Meta user passwords.

7.4 Token storage and security

Long-lived Meta access tokens are stored in our Supabase Postgres database with row-level security and access scoped to the workspace that connected the token. Tokens are transmitted only over TLS, and only to the Meta Graph API. You can revoke our access at any time from Facebook → Settings → Business Integrations or by disconnecting Meta from the brand’s settings page.

7.5 Deleting Meta Platform Data

You can ask us to delete Meta Platform Data we hold for you at any time by:

• Disconnecting Meta from the brand settings page (clears the token);
• Deleting the brand or workspace from Settings (cascades all related Meta data);
• Emailing privacy@adgenz.ai from the address tied to your account.

We will action verified deletion requests within 30 days. If you remove the AdGenz app from your Meta account, Meta will notify us; we treat that signal as a deletion request for the affected user’s Platform Data.

7.6 Compliance commitments

We maintain administrative, technical, and physical safeguards designed to meet or exceed industry standards. We will report qualifying incidents to Meta as required by the Platform Terms. We do not change the functionality of the app materially without resubmission through Meta App Review when required.

A workspace owner, admin or a member allowed to manage integrations can connect one Google account to a workspace so that approved ads are saved to Google Drive and an ad log is kept in Google Sheets. This section describes what Google user data AdGenz accesses, stores and shares when you do.

7A.1 What we access

• Your Google account identity (the openid and email scopes): your Google account ID and email address, so we know which account is connected and can show it to your workspace.
• Only the Drive files AdGenz creates (the drive.file scope): the AdGenz folders, the ad images and copy files we save, and the spreadsheets we create. AdGenz cannot see, read, list or change any other file in your Google Drive. We do not request full Drive access or the broader Google Sheets scope.

7A.2 What we store

• An OAuth refresh token, kept in a server-only table that is never sent to your browser or shown to workspace members. Short-lived access tokens are kept only in server memory.
• Your Google account ID and email address, the granted scopes and the time zone you choose for date folders.
• The IDs, names and links of the folders, files and spreadsheets AdGenz created, plus a record of which ads were saved, so nothing is saved twice.

We do not store the contents of your Drive. The files we write are copies of ads and ad copy you created in AdGenz.

7A.3 How we use and share it

We use Google user data only to provide the features you turned on: saving ads to Drive, keeping the ad-log spreadsheet up to date, and the one-off “Save to Drive” and “Export to Sheets” actions. We do not sell it, use it for advertising, use it to train AI models, or let humans read it, except with your consent, for security or abuse investigations, or where required by law. We do not transfer it to third parties except as needed to run these features (our hosting and database providers in section 6), or as required by law.

7A.4 Disconnecting and deletion

• Disconnecting Google in Settings → Integrations revokes AdGenz’s access at Google (unless another of your AdGenz workspaces still uses the same Google account) and deletes the stored token and our records of the folders, files and spreadsheets.
• You can also remove AdGenz at any time at myaccount.google.com/permissions; AdGenz then stops writing and shows a Reconnect prompt.
• If the person who connected Google leaves the workspace or deletes their AdGenz account, we revoke access (where unshared) and delete their stored token.
• AdGenz never deletes files in your Google Drive. Files and spreadsheets already saved are your copies, under your control in Google, and stay there after you disconnect.

We share information only in the following circumstances:

• With sub-processors listed in section 6, under written contracts that restrict their use of data to our instructions.
• Within your workspace: members can see brands, ads, ICPs, and activity logs according to their role and granted capabilities.
• Across workspaces, in anonymized form only: unless a workspace opts out (Settings → Global Inspiration Library), ads it approves or marks as a winner may contribute anonymized creative attributes (format, style, hook, craft grade) to a shared cross-workspace creative library used to power suggestions and niche playbooks for other AdGenz workspaces. See section 5 for details.
• With Meta, when you publish an ad: the creative assets, copy, and targeting choices you submit are sent to the Meta ad account you selected.
• With professional advisors (accountants, lawyers, auditors) bound by confidentiality.
• For legal reasons: to comply with a valid legal request, to protect rights, property, or safety, or to investigate suspected violations.
• In a business transfer: if AdGenz is acquired or merged, your data may be transferred to the acquirer. We will notify you in advance and you will retain the rights described here.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not share Meta Platform Data outside the conditions permitted by the Meta Platform Terms.

When the retention period expires or you request deletion, we delete the data or irreversibly de-identify it, except where a longer period is required by law or for the establishment, exercise, or defence of legal claims.

• Encryption in transit: TLS 1.2+ for all client-to-server and server-to-provider traffic.
• Encryption at rest: Supabase Postgres and Storage encrypt data at rest using AES-256.
• Access control: Postgres row-level security restricts row visibility to the owning workspace; admin APIs require an authenticated super admin and audit each request.
• Authentication: Email/password and Google SSO via Supabase Auth. Sessions use short-lived JWTs with refresh rotation.
• Application security: rate limiting, CSRF protection on OAuth flows, server-side validation of workspace and brand authorisation on every request, secret rotation for third-party API keys.
• Vulnerability reporting: please report security issues to security@adgenz.ai. We acknowledge reports within 3 business days and will not pursue legal action against good-faith researchers who follow coordinated disclosure.

No method of transmission or storage is perfectly secure. While we work hard to protect your information, we cannot guarantee absolute security.

Depending on where you live, you may have the following rights over your personal information:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (see section 12).
• Restriction — restrict processing in specific circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent.
• Lodge a complaint — with your local data protection authority. In the EU/UK, you can find your authority on the European Data Protection Board’s website.

U.S. residents (California, Colorado, Connecticut, Virginia, Utah, and other applicable states)

You have rights to know, access, correct, delete, and (where applicable) opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. AdGenz does not sell personal information and does not process sensitive information for purposes beyond providing the Service. You may exercise these rights using the contact details in section 17. We will not discriminate against you for exercising your rights.

We will verify your identity before responding to rights requests, typically by matching the request to the email on file and, where needed, asking you to confirm details only the account holder would know.

Meta data deletion callback

For Meta's data-deletion request flow, please email privacy@adgenz.ai with the subject line "Meta data deletion request" and include your Meta user ID. We will respond with a confirmation code and complete deletion within 30 days.

We may retain limited information after deletion where required for legal, accounting, anti-fraud, or security purposes — described in section 9.

We use a small number of strictly necessary cookies and browser storage items, plus analytics (Google Analytics) and advertising-measurement (Meta Pixel) cookies that are set only after you accept our cookie banner. They help us understand how visitors use the site and measure which of our own ads lead to signups and purchases. We never set them on the admin panel or on shared review links, and we do not sell this data. We also send conversion events (for example a signup or a purchase) from our servers to Meta and Google, with email addresses and user ids hashed (SHA-256) before they leave our systems; for visitors in the EEA, UK and Switzerland this only happens after you accept.

Rejecting or not responding to the cookie banner keeps Google Analytics and the Meta Pixel fully off — Consent Mode v2 defaults every visitor to denied until they explicitly accept, and you can change your choice at any time by clearing the adgenz_consent cookie/local-storage item and reloading the page. Most browsers also let you block or delete cookies directly; blocking strictly-necessary cookies will break sign-in and ad-publishing flows.

AdGenz is operated from, and stores data primarily in, the United States. Several of our sub-processors are located in the United States or operate globally distributed infrastructure. When data is transferred from the EEA, UK, or Switzerland to a country that has not received an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, supplemented by technical and organisational measures such as encryption in transit and at rest, and access-control reviews.

AdGenz is a business tool intended for users aged 16 and older. We do not knowingly collect personal data from children under 16. If we learn that we have collected data from a child, we will delete it. If you believe a child has used the Service, please contact privacy@adgenz.ai.

We may update this policy when our product, technology, or legal obligations change. The "Last updated" date at the top of this page reflects the latest revision. For material changes, we will notify workspace owners by email at least 14 days before the change takes effect, or as required by law.

Continued use of the Service after a change becomes effective constitutes acceptance of the revised policy.

Questions, requests, or complaints about this policy or our handling of your data:

If we cannot resolve a concern, you can lodge a complaint with your local data protection authority.