Privacy Policy for Ad Engine

1. Who we are and what this policy covers

Ad Engine is a business-to-business (B2B) web application. From the advertorial and product photos you upload, it writes marketing research documents with AI, and generates image ads modelled on competitor ads you choose. Simon Tacquet, established in Belgium, runs Ad Engine and decides how and why your personal data is used: in the terms of the EU General Data Protection Regulation (GDPR), Simon Tacquet is the controller. "We" and "us" in this policy mean Simon Tacquet.

This policy applies to everyone whose personal data we handle, wherever they live: people with a Ad Engine account, people who visit our public pages (this policy, the sign-in pages and the Meta data deletion status page), and people whose personal data appears in content our customers upload. It explains what we collect, why, who receives it, how long we keep it, and what your rights are.

When we act for our customers

The content you upload is mostly about products. When it contains personal data about other people, such as names or testimonials in an advertorial, or people shown in a photo, we handle that data only to provide Ad Engine to you. For that data, you are the controller and we are your processor, under a separate data processing agreement between you and us. Ask us for it at simontacquet@icloud.com. You are responsible for being allowed to share that data with us, and with the companies in section 5. If someone asks us about their data in your content, we pass the request on to you.

For data we receive from Meta, we also follow Meta's Platform Terms (opens in a new tab) and Developer Policies (opens in a new tab).

2. What we collect and why

Each category below says what we store, where it comes from, why we use it, and our lawful basis (explained in section 3). How long we keep each one is in section 7.

A. Your account

What we store

• Your email address.
• A hash of your password, made by our sign-in system. We never store the password itself.
• The version of this policy you were shown when you signed up, and when you ticked the box to confirm you had read it.
• When your account was created and when you last signed in.
• For your signed-in sessions and for some security events, the IP address and browser details (user agent) our sign-in system records.

Where it comes from

You, and your browser when you sign in.

Why

To create your account, sign you in, keep it secure, and send the emails the service needs: confirming your address and resetting your password. And to be able to show which version of this policy you were given.

Lawful basis

Contract, for the account and its emails. Legitimate interests, for the security records and the policy record.

B. Content you upload

What we store

• For each project: its name (usually your product's name), and your advertorial, a PDF of up to 32 MiB.
• For each swipe: the competitor ad image (JPEG, PNG, WebP or GIF, up to 3.7 MB), the competitor's brand name if you enter it, and the upload date.
• Product photos: up to five per upload, up to 10 MiB each.

How we store it

In private storage, under file names our server generates. We don't keep your original file names, and only your account can read your files.

Where it comes from

You.

Why

To write your documents and generate your ads. Section 5 says which company receives what.

Lawful basis

Contract. For personal data about other people in your content, we act as your processor (section 1).

C. Content we generate

What we store

• Your five foundational documents: the Deep Research brief, the research report, the avatar (target customer) document, the offer brief and the necessary beliefs document. Claude (Anthropic) writes four of them; OpenAI's Deep Research writes the research report.
• The saved state of each document run: the whole conversation with Claude, including the documents and a reference to your advertorial file. Our server signs it, so a change made anywhere else is detected.
• For each swipe: the image prompt Claude wrote, the models, resolution and aspect ratio used, and the run's status.
• For each generated ad: our copy of the image in your storage, the web address where Higgsfield hosts it, and Higgsfield's ID for the request.

Where it comes from

Our AI providers generate it from your content.

Why

It is the service you use us for.

Lawful basis

Contract.

D. Credits

What we store

Your credit balance, and one ledger entry for each change: the amount, a description (a charge names the project), the run it paid for, and the time. Every new account starts with 1,000 credits. Ad Engine takes no payments today and holds no card or bank details.

Where it comes from

Your use of the service.

Why

To charge for runs, refund runs that fail, and show your balance.

Lawful basis

Contract.

E. Meta Ads, if you connect it

Connecting Meta is optional. Nothing below applies until you connect it.

Permission we ask for

Only ads_read. We don't request ads_management: Ad Engine cannot create, edit, publish or delete anything in your Meta account.

What we store

• Meta's ID for you within our app (an app-scoped ID, which differs from your Facebook profile ID).
• Your Meta access token, encrypted, and when it expires.
• The connection's status and, if it stopped working, the reason.
• For each ad account we sync (the first 25 active accounts your login can read): its ID and name, and the sync's status and progress.
• For every ad in those accounts, one row per day: ad ID, campaign ID, ad account ID, date, spend, impressions, clicks, cost per click (CPC) and click-through rate (CTR).

What we don't read

We read every ad, whatever its format, but only the figures above. We read no video metrics, no audience or demographic data, and no ad images or text.

When we read it

Our scheduler checks for due work every 15 minutes. Each ad account is synced about once a day, re-reading the last three days so that Meta's late corrections are included. After you connect, we also import up to 12 months of each account's history, in steps every 15 minutes until it is done.

How we use it today

We store these figures. The dashboard shows only your connection and the sync status. No feature reads the figures yet, and no Meta data is sent to any AI provider.

Where it comes from

Meta, at your request.

Lawful basis

Contract: you ask us to connect your Meta ad accounts.

Note on future use: we plan to use these figures to improve the ads Ad Engine generates. Before any feature uses your Meta data that way, we will update this policy and tell you by email, as described in section 13.

F. Protecting our Meta connection from misuse

What we store

For each account: when its current ten-minute window started, and how many times in that window it has asked to connect Meta, or to disconnect it (which asks Meta to remove our access). After five, we refuse further connections until the window ends, and a disconnect still deletes your data but doesn't contact Meta.

Where it comes from

Your use of the Meta connection.

Why

Every attempt uses our app's Meta API quota, and a script could otherwise use it up for every customer.

Lawful basis

Legitimate interests.

G. Meta data deletion requests

What we store

When Facebook asks us to delete someone's data, we log a random confirmation code and when the deletion finished. The log holds no Facebook ID, no account ID and nothing else about the person.

Why

So that the status page Facebook links to can show that the deletion was done. On its own, the log cannot be linked to anyone.

Lawful basis

Legitimate interests: being able to show that a deletion was done.

H. Technical logs

What we store

Our API server logs your account ID (a random identifier, not your email address) with events such as connecting or disconnecting Meta, and the confirmation code of each Meta deletion request. Our hosting providers (Vercel, Render and Supabase) keep logs of the requests our services receive, with IP addresses, the addresses requested, times and browser details.

Where it comes from

Your browser and our servers.

Why

To run the service, find and fix faults, and detect and investigate misuse and security incidents.

Lawful basis

Legitimate interests.

3. Our lawful bases

• Contract (GDPR Art. 6(1)(b)). To provide what you sign up for: your account and its emails, your uploads and everything we generate from them, your credits, and the Meta sync when you connect it.
• Legitimate interests (Art. 6(1)(f)). Our interests are: keeping accounts and the service secure (sign-in records and logs); protecting our Meta app's API access from automated misuse (the connect-attempt limit); finding and fixing faults (logs); being able to show which version of this policy you were given; and being able to show that a Meta deletion request was carried out. You can object to this processing (section 9).
• Legal obligation (Art. 6(1)(c)). Only when a law or a court order requires us to disclose or keep data.

The box you tick at sign-up confirms that you were shown this policy. It is not consent that we rely on as a lawful basis: we process no data on the basis of consent, so there is no consent to withdraw. You control the Meta connection by disconnecting it, or by removing our app in your Facebook settings (section 8).

4. What you must give us

To have an account, you must give us an email address and a password: we need them to provide the service you sign up for. Without them we cannot create an account.

Uploading content and connecting Meta are optional, but the features that use them don't work without them: documents need an advertorial, ads need a competitor ad and product photos, and the Meta sync needs a Meta connection.

We don't make any decision about you based solely on automated processing that has legal or similarly significant effects on you. The AI in Ad Engine generates documents and ads; it decides nothing about people.

5. Who receives your data

We don't sell your personal data, and we don't share it for advertising. We never sell, license or share data we receive from Meta: only Supabase, Render and Vercel handle it, as our service providers.

We send no email address and no account ID to Anthropic, OpenAI or Higgsfield. They receive only the content listed below.

Service providers that work for us

These companies handle personal data only to provide their service to us, under a data processing agreement that forbids them to use it for their own purposes.

Image generation: Higgsfield, under its own terms

To create your ads, we send Higgsfield the content below. Higgsfield is not our service provider: we have no data processing agreement with it, and it handles this content under its own terms of use and privacy policy, as a company responsible for it in its own right.

Higgsfield's terms allow it to use the product photos, prompts and images to train its AI models, and content used for training cannot be removed from a trained model. Don't upload photos that show identifiable people unless you may share them on these terms.

Meta

If you connect a Meta ad account, Meta is the source of your ad data, not a service provider of ours. Meta is responsible for your Facebook data under its own privacy policy (opens in a new tab); in the EEA, that is Meta Platforms Ireland Limited. We send Meta only what its API needs:

• Your access token, with a proof made from our app's secret (appsecret_proof), to read your ad accounts and their figures.
• When you disconnect, or connect a different Facebook login, a request to remove Ad Engine's access. It identifies you by the ID Meta gave you for our app.

Authorities

We disclose personal data to a public authority only when a law or a court order requires us to.

6. International transfers

Simon Tacquet is established in Belgium. Several companies in section 5 are established outside the European Economic Area (EEA): in the United States, and Supabase in Singapore. Anthropic and OpenAI contract with us through their Irish companies, but also process data outside the EEA. Whichever data centre holds our data, these companies' staff and systems outside the EEA can reach it, so we treat each of them as a transfer.

The European Commission has not decided that the United States as a whole, or Singapore, protects personal data to EU standards. Its decision for the United States (Implementing Decision (EU) 2023/1795) covers only US companies certified under the EU-U.S. Data Privacy Framework.

These safeguards apply:

• Supabase: The EU Standard Contractual Clauses, in Supabase's data processing agreement.
• Render: Render's data processing agreement, which forms part of its terms. Render states that it is certified under the EU-U.S. Data Privacy Framework.
• Vercel: The EU Standard Contractual Clauses, in Vercel's data processing agreement.
• Resend: The EU Standard Contractual Clauses, in Resend's data processing agreement. Resend also states that it complies with the EU-U.S. Data Privacy Framework.
• Anthropic: We contract with Anthropic Ireland, Limited. Where Anthropic processes the data outside the EEA, its data processing agreement applies the EU Standard Contractual Clauses.
• OpenAI: We contract with OpenAI Ireland Ltd. It transfers data to other OpenAI companies and to its service providers outside the EEA under the EU Standard Contractual Clauses or an adequacy decision.
• Higgsfield: None from us. Higgsfield processes data in the United States, Kazakhstan and other countries, under the safeguards its own privacy policy describes. We have no transfer agreement with it.

Getting a copy of the safeguards

The Standard Contractual Clauses are published on EUR-Lex (Decision (EU) 2021/914) (opens in a new tab). Each provider's agreement is linked in section 5, and certified companies are listed on the Data Privacy Framework list (opens in a new tab). You can also ask us at simontacquet@icloud.com for a copy of the safeguards that cover your data. We may black out commercial terms that have nothing to do with data protection.

7. How long we keep your data

To have a project or a file deleted before your account is, write to simontacquet@icloud.com.

Copies held by other companies follow their own retention, described in section 5. In short: Resend keeps emails for 30 days; OpenAI keeps research content for up to 30 days; Anthropic deletes requests within 30 days (flagged content up to 2 years) but keeps the advertorial files we upload until we delete them, which today we don't; and Higgsfield keeps content under its own terms.

8. Your Meta data and how to delete it

There are three ways to remove the data we hold from your Meta connection. None of them touches your projects, documents or ads, and none can be undone.

A. Disconnect in Ad Engine

On your dashboard, choose Disconnect Meta. We delete your Meta connection, the encrypted access token, your ad accounts' sync jobs and every synced performance row, all at once.

We also ask Meta to remove Ad Engine's access to your Facebook login. Meta doesn't always confirm this; if it doesn't, remove the app in your Facebook settings (C below). We skip this request when another Ad Engine account still has an active connection with the same Facebook login, because removing our access would disconnect that account too, and the app tells you when that happens. We also skip it after five connect or disconnect attempts in ten minutes (section 2F). Your data is deleted either way.

B. Connect a different Facebook login

If you reconnect Meta with a different Facebook login, we first delete the previous login's sync jobs and synced history, then ask Meta to remove our access to the previous login, unless another Ad Engine account still has an active connection with it, as in A. The app tells you which happened.

C. From your Facebook settings

In Facebook, go to Settings & privacy > Settings > Apps and websites and remove Ad Engine. Then open View removed apps and websites, choose View next to Ad Engine, and choose Send request. (Facebook's menu names change from time to time.)

Facebook then sends us a signed deletion request. We check its signature, then delete the Meta data of every Ad Engine account connected with that Facebook login: the connection, the access token, the sync jobs and the synced performance rows. Facebook shows you a confirmation code and a link to our status page, /meta-deletion-status/<code>, which shows when the deletion finished. That page holds only the code and the time, and works without signing in.

If you remove the app without sending a request

Meta stops accepting our access token. At our next attempt to sync, we delete the token and pause syncing, and your dashboard shows that access was revoked. Your synced history stays until you disconnect in Ad Engine (A), send a deletion request (C), or delete your account (section 9).

9. Deleting your account, and your other rights

Deleting your account

Ad Engine has no button to delete your account yet. To delete it, email simontacquet@icloud.com from the address you signed up with. Within one month of confirming the request comes from you, we delete your account. That removes your login and every row our database holds for it (projects, documents, run state, swipe runs, ad records, credits, your Meta connection and synced data, and the connect-attempt counter), and the files in your storage.

Copies elsewhere follow section 7: logs and backups until they are overwritten, and copies at Anthropic, OpenAI, Resend and Higgsfield under their retention. In particular, Anthropic keeps the advertorial files we uploaded, because we don't delete them there today. Deleting your account doesn't ask Meta to remove our access: disconnect Meta first (section 8A), or remove the app in your Facebook settings.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you and get a copy of it.
• Rectification: have inaccurate data corrected. You can reset your password yourself; we change your email address on request.
• Erasure: have your data deleted, as described above and in section 8.
• Restriction: have us stop using your data, other than storing it, while a dispute about it is resolved.
• Portability: receive the data you gave us, and the data we hold to provide the service to you, in a structured, commonly used, machine-readable format, or have it sent to another company. We export it on request by email.
• Object to processing we base on legitimate interests (section 3). We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We make no such decisions.
• Complain to a data protection authority (section 14).

How to exercise them

Email simontacquet@icloud.com, preferably from the address you signed up with. If we can't tell that a request comes from you, we ask you to confirm it from that address before we act. We answer within one month of receiving your request. If a request is complex, or we receive many, we can extend this by two further months; we then tell you why within the first month. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

If your personal data is in content one of our customers uploaded, that customer is the controller for it. Contact them; if you contact us, we pass your request on.

10. Cookies and browser storage

Ad Engine stores only the items below in your browser. All of them are strictly necessary to provide the service you ask for, or keep a display choice you made, so Belgian law, which implements Article 5(3) of the EU ePrivacy Directive, does not require your consent for them. That is why we show no cookie banner.

We use no analytics, advertising or third-party tracking cookies or scripts. Our fonts are served from our own website, so loading a page sends no request to Google or any other font service. You can delete these items in your browser settings; deleting the session cookies signs you out.

11. How we protect your data

No system is perfectly secure, and we can't guarantee that your data will never be accessed without permission. These are the measures Ad Engine has in place:

• Isolation: Row-Level Security is enabled, and forced, on every table in our database, so a request can read and change only its own account's rows.
• No master key: our server holds no database key that bypasses these rules. It acts as the signed-in user. The Meta sync and Meta's deletion requests, which have no signed-in user, can call only a few database functions, and each one checks a signature from our server.
• Private storage: files sit in private storage buckets, and storage rules let each account reach only its own folder.
• Controlled writes: you can read your credits and your Meta data, but nobody can write them directly. Credits change only through database functions: an account can spend only its own credits, and a refund needs a signature (an HMAC) that only our server can make. Every change to Meta data needs such a signature too. The saved state of document runs is signed the same way.
• Meta tokens: encrypted by our server with AES-GCM before they are stored, bound to the account they belong to, and never sent to your browser. Every call to Meta's API carries an appsecret_proof.
• Meta sign-in: the state we pass through Meta's login is signed for your account and valid for 10 minutes, and each account can make at most five connect attempts in ten minutes.
• Uploads: checked by their actual content (their file signature) and size, not by the name or type your browser gives them.
• Website: a Content Security Policy with a fresh nonce for every page, HTTPS enforced with HSTS, and no other site allowed to frame our pages.

If a personal data breach is likely to put your rights and freedoms at high risk, we will tell you without undue delay.

12. Children

Ad Engine is a service for businesses and is not meant for anyone under 18. We don't knowingly collect personal data about children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

The effective date at the top of this page is the version of this policy. When you sign up, we record the version you were shown and when you confirmed you had read it. Before a material change takes effect, we tell every account holder by email.

14. Contact and complaints

Simon Tacquet is the controller of your personal data. For questions about this policy, or to exercise your rights, contact us:

Email

simontacquet@icloud.com

Address

Vennestraat 13, 8790 Waregem, Belgium

If you believe we process your personal data unlawfully, you can complain to the Belgian Data Protection Authority. You can also complain to the authority of the EU country where you live or work, or where the infringement took place.