1. Introduction

AdStrategy AI ("we", "our", or "us") operates the AdStrategy AI platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application, including our integrations with Meta (Facebook) advertising services and Shopify.

2. Information We Collect

We collect the following types of information:

Account Information: Name, email address, and password when you create an account.
Brand Data: Brand names, descriptions, colors, logos, and positioning information you provide.
Campaign Data: Campaign strategies, ad copy, creative concepts, and performance metrics.
Meta Ads Data: When you connect your Meta Ad Account, we access your Ad Account ID, campaign performance metrics (CTR, CPM, CPC, CPA, ROAS, Frequency), and campaign management data via the Meta Marketing API.
Community Inbox Data: If you use the Community Inbox, we read comments and messages people leave on the Facebook Pages, Instagram accounts, and ads you connect — including content authored by your audience and customers — so you can triage and reply to them from AdStrategy AI.
Shopify Store Data: When you install our Shopify app or connect a store, we access store info (name, domain, currency, plan), product catalog, order summaries (last 90 days), and abandoned checkouts via the Shopify Admin API. Where the merchant grants access to Protected Customer Data, we may process customer email and aggregated RFM (recency / frequency / monetary) data strictly to surface analytics and recommendations inside the merchant's workspace.

3. How We Use Your Information

To provide and maintain our AI-powered ad campaign services.
To create, manage, and optimize Meta advertising campaigns on your behalf.
To generate AI-powered strategies, ad copy, creative concepts, and video scripts.
To pull and display performance metrics from your Meta Ad Account.
To improve our services and user experience.

4. Meta (Facebook) Data Usage

Our application integrates with Meta's Marketing API. When you connect your Meta Ad Account:

We request permissions to manage and read your ad campaigns (ads_management, ads_read, business_management).
We use your Meta data solely to create campaigns, ad sets, and ads, and to retrieve performance insights.
We do not sell, rent, or share your Meta advertising data with third parties.
We do not use your Meta data for any purpose other than providing our services to you.
Your Meta access token is stored on our servers and is readable only by server-side code, never by the browser.

5. Community Inbox Data (Comments & Messages)

If you use the Community Inbox, we read the comments and messages people leave on the Facebook Pages, Instagram accounts, and ads you connect, so you can triage and respond to them from AdStrategy AI. This may include content authored by people other than you (your audience and customers).

We request permissions to read and respond to this content: pages_read_user_content, pages_manage_engagement, pages_messaging, instagram_basic, instagram_manage_comments, and instagram_manage_messages.
Nothing is sent, replied to, hidden, or deleted automatically. Every outbound action happens only when you click, after you review the text.
We use inbox content solely to display, triage, and let you respond to conversations inside your own workspace. We do not sell, rent, or share it, and we do not use it to build advertising profiles of the people who contacted you.
Retention & deletion: Comments and messages pulled into the inbox are stored per brand and retained while your account is active and the Page or account stays connected. They are deleted within 48 hours of disconnecting that account or deleting the brand/workspace. You may request earlier deletion by emailing hello@adstrategyai.com.
Page and Instagram access tokens are stored on our servers and are readable only by server-side code, never by the browser.

6. Shopify Data Usage

Our application integrates with the Shopify Admin API. When you install our app or connect a Shopify store:

We access store information (name, domain, currency, plan), the product catalog, order summaries (last 90 days), and abandoned checkouts using read-only scopes.
Where the merchant has been approved for and grants access to Protected Customer Data, we may process customer email addresses and aggregated RFM data. This is handled in accordance with Shopify's Protected Customer Data requirements.
Shopify data is used solely to power analytics, advisor recommendations, and ad strategy inside the merchant's own AdStrategy AI workspace.
We do not sell, rent, or share your Shopify store or customer data with third parties.
Retention & deletion: Store and product data is retained while the app is installed and deleted within 48 hours of uninstall via Shopify's shop/redact webhook. Customer data is deleted on demand via the customers/redact webhook, and customer data export requests are fulfilled within 30 days via customers/data_request. Merchants and end-customers can also request data export or deletion at any time by emailing hello@adstrategyai.com.
Shopify access tokens are stored on our servers and are readable only by server-side code, never by the browser.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide you services. Campaign data and performance metrics are retained to enable historical analysis and optimization. Shopify store data is automatically purged within 48 hours of app uninstall. You may request deletion of your data at any time by contacting us.

8. Data Security

We implement industry-standard security measures including encryption in transit (TLS/SSL), encryption at rest provided by our hosting infrastructure, connection tokens that no client role can read, row-level security on all database tables, and secure authentication mechanisms.

Our staff may view your account data in a read-only mode to provide support and diagnose issues; every such access is logged.

9. Your Rights

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data and account by emailing hello@adstrategyai.com.
Revoke Meta Ads permissions at any time through your Facebook settings.
Uninstall the Shopify app at any time from your Shopify admin, which triggers automatic deletion of your store data within 48 hours.
Opt out of any non-essential data processing.

10. Third-Party Services & Subprocessors

We rely on the following subprocessors to operate the service. Each processes only the data needed for its function and under its own privacy terms:

Supabase — application database, authentication, file storage and server functions (hosting infrastructure).
Meta (Facebook) — advertising and, where connected, community-inbox APIs. See Meta's Data Policy.
Google — Google Ads and Google Analytics (GA4) APIs, where you connect them.
Shopify — store, product and order data. See Shopify's privacy policy.
Stripe — subscription and payment processing.
AI providers — Lovable AI Gateway and OpenAI (text and image generation), Google Gemini (image generation), fal.ai (image/video generation) and ElevenLabs (text-to-speech) to produce the content you request.
Firecrawl — reads public web pages (e.g. your store URL) to draft brand context.
Resend — delivery of transactional email.
Klaviyo — lifecycle and product email, where enabled.
Sentry — error and performance monitoring.
Slack — internal operational alerts.

A current subprocessor list is available on request at hello@adstrategyai.com, and business customers may request a Data Processing Addendum (DPA) at the same address.

Google API Services — Limited Use

AdStrategy AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not transfer it except to provide or improve user-facing features of the app, to comply with applicable law, or as part of a merger or acquisition. We do not allow humans to read Google user data except with your explicit consent, for security purposes, to comply with applicable law, or on aggregated, de-identified data for internal operations.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights (including Shopify data export or deletion requests), please contact us at hello@adstrategyai.com or through the application's Settings page.