Privacy Policy

Addapt stores the following, and nothing more than it needs to work:

• Account: the name, email address, profile picture and user id that Facebook shares when you sign in.
• Meta ads data: with your ads_read permission, the ad accounts you administer, their campaigns, ad sets, ads, creatives (including images and copy) and performance metrics, plus the access token Meta issues to read them.
• Your content: product URLs and descriptions, brand settings, uploaded logos and reference screenshots, the notes and approvals you leave, and the drafts and images the AI generates for you.
• Billing: your plan, credit balance and a ledger of credit movements, and the customer and payment ids Dodo Payments gives us. Card details are entered on Dodo's checkout and never reach us.
• Technical: server logs with IP addresses and request details, kept by our hosting providers for security and debugging, and the cookies listed below.

To run the service: generate drafts from your product and the changes you describe, render images, show your ads next to the creatives they came from, and keep your balance right. To keep the service safe: detect abuse of trials and credits, investigate failures and answer support requests. To meet legal obligations such as tax and accounting records, which Dodo Payments keeps as the merchant of record.

Where data protection law applies, we rely on the contract with you (providing the service), our legitimate interest in running it securely, your consent for the Meta permissions you grant, and legal obligations. We do not sell personal data and we do not use it for advertising of our own.

Ads data is read through Meta's Marketing API and used only to display your ads and their performance inside Addapt and to link them to the creatives you make. Addapt never publishes, edits or pays for ads. You can revoke our access at any time in your Facebook settings under Apps and Websites; the data already synced stays until you delete it or your account.

Our use of Meta data follows Meta's Platform Terms and Developer Policies.

We use these providers (sub-processors). Each one only receives what its job needs:

• Supabase: sign-in, database and private file storage (EU/US data centres).
• Vercel: hosting of the application and server logs.
• Anthropic: text generation. Receives your product description and analysis, brand settings, ad drafts and the changes you describe, plus imported ad copy and images you ask it to describe.
• OpenAI: image generation. Receives ad drafts and visual directions, your logo and reference screenshots, and existing ad images you vary.
• Firecrawl: fetches public Meta Ad Library pages you ask to import. Receives only the ad's public URL.
• Dodo Payments: checkout, subscriptions, invoices and taxes as merchant of record. Receives your email, name, billing address and payment details, and shares customer and payment ids with us.
• Meta: we read your ads data from Meta; Meta's own privacy policy governs what Meta does with your account.

Account, ads and content data are kept while your account is active and deleted within 30 days after you ask us to delete it or we close the account. Hosting backups expire within a few weeks after that. Billing records needed for tax and accounting are kept by Dodo Payments for as long as the law requires.

Addapt sets only cookies it needs to work: the Supabase session cookies that keep you signed in, and one preference cookie (addapt-sidebar) that remembers whether the sidebar is collapsed. There are no analytics, tracking or advertising cookies.

Depending on where you live you may have the right to access, correct, export or delete your data, to object to or restrict its processing, and to complain to a supervisory authority. Email tim@addapt.xyz from the address on your account and we will respond within 30 days.

To delete your Addapt account and everything in it, email tim@addapt.xyz from the email address on your account with the subject "Delete my data". Within 30 days we delete your account, products, drafts, images, synced ads data and Meta access token, and confirm by email. Invoices are kept by Dodo Payments as the law requires.

To stop Addapt reading your Meta data immediately, remove Addapt in your Facebook settings under Apps and Websites. Removing the app revokes our access; it does not by itself delete the data already stored, so send the email as well.

Data travels over HTTPS and is stored by providers that encrypt it at rest. Access to production data is limited to the operator. No system is perfectly secure; if a breach affects you we will tell you without undue delay.

Our providers process data in the European Union and the United States. Where data leaves the region it was collected in, transfers rely on the providers' standard contractual safeguards.

Addapt is a business tool and is not intended for anyone under 18.

We may update this policy; the effective date at the top changes when we do, and material changes are announced on the site or by email. Questions: tim@addapt.xyz.