Privacy Policy

1. Who This Policy Covers

The Service involves several types of users, and the way we handle data differs by role:

• Customers — individuals or businesses that register for an AdLaunch account, including Agencies.
• Agencies — Customers who use the Service to manage advertising on behalf of their own Clients, including through the white-label client portal.
• Clients and Client end users — businesses (and their personnel) who access the Service through an Agency's white-label portal.
• Website visitors — anyone who visits adlaunch.com or os.adlaunch.com without necessarily holding an account.

Where an Agency brings a Client's data into the Service, the Agency is generally the party that determines how that data is used (the "controller"), and AdLaunch processes it on the Agency's behalf (as a "processor"). See Section 8.

2. Information We Collect

2.1 Information You Provide

• Account and profile information — name, email address, password, phone number (for verification), and business details.
• Billing information — processed by our payment processor, Stripe. We do not store full payment card numbers; we receive limited billing metadata such as subscription status and the last four digits of a card.
• Brand and campaign information — website URLs, brand details, business categories, campaign settings, ad copy, creative, and any content you provide or generate through the Service.
• Support and communications — information you provide when you contact support or otherwise communicate with us.

2.2 Information From Connected Accounts

When you connect a third-party account (such as a Meta advertising account, Facebook Page, or GoHighLevel account), we collect and process information from that account as needed to provide the Service, including:

• Access credentials (tokens), which we store in encrypted form;
• Advertising account, page, and pixel identifiers;
• Campaign, ad set, and ad configurations and status;
• Advertising performance and insights data (such as spend, impressions, clicks, and conversions);
• Audience and targeting information you choose to use.

We use Connected Account information only to provide the Service and the functions you direct.

2.3 Information Generated by the Service

• AI Output — brand profiles, ad copy, ad imagery, strategies, and recommendations generated through your use of the Service.
• Usage and log data — how you interact with the Service, including pages viewed, features used, actions taken, timestamps, and error and performance data.
• Device and technical data — IP address, browser type, device identifiers, and similar technical information.

2.4 Information From Cookies and Similar Technologies

We and our service providers use cookies and similar technologies for authentication, security, preferences, and analytics. See Section 7.

3. How We Use Information

We use information to:

• Provide, operate, and maintain the Service, including creating brand profiles, building campaigns, and launching and managing advertising on Connected Accounts you authorize;
• Authenticate users, secure accounts, and prevent fraud and abuse;
• Process subscriptions and payments;
• Generate AI Output you request, including by sending necessary inputs to our third-party AI providers;
• Provide support and respond to your communications;
• Monitor, analyze, and improve the Service, including its performance, reliability, and features;
• Develop and improve our AI and data-intelligence capabilities, as described in Section 4;
• Send service-related and, where permitted, marketing communications (you can opt out of marketing messages);
• Comply with legal obligations and enforce our Terms.

We rely on the following legal bases where applicable: performance of our contract with you, our legitimate interests in operating and improving the Service, your consent (where required), and compliance with legal obligations.

4. Aggregated and De-Identified Data

This section corresponds to Section 10.2 of the Terms of Service.

We collect, use, and retain aggregated and de-identified data derived from use of the Service — including campaign configurations, performance metrics, and category-level patterns across the 143 local-business categories the Service supports — to operate, analyze, improve, benchmark, and develop the Service and its features, including its AI and data-intelligence capabilities.

The following limits apply, and they are the same commitments made in the Terms:

• We use this data only in aggregated or de-identified form that does not identify you, any Client, any individual, or any single business.
• Cross-Customer insights are derived only from aggregated patterns, never from exposing one Customer's identifiable data to another.
• We do not sell your identifiable data.
• Within your own account, your historical data remains available to you as part of the Service.

This allows the Service to provide category-level benchmarks and recommendations (for example, typical performance patterns for a category of local business) without revealing any individual Customer's or Client's underlying data.

5. How We Share Information

We share information only as described here. We do not sell personal information.

• Service providers (sub-processors). We share information with vendors that help us operate the Service, under contracts that limit their use of the data. These include, among others:
  • Stripe — payment processing
  • Anthropic and OpenAI — AI text generation
  • fal.ai — AI image generation
  • Cloudflare (R2) — image and asset storage
  • Neon and database/hosting infrastructure providers — data hosting
  • Replit — application hosting and deployment
  • Loops and email/SMS providers — transactional and verification messaging
  • Sentry and PostHog — error monitoring and product analytics
  • Gleap — in-app support
• Advertising and integration platforms. When you direct the Service to act on a Connected Account, we share the necessary information with that platform (for example, Meta or GoHighLevel) to perform the action. Your use of those platforms is also governed by their own privacy policies.
• Within the Agency–Client relationship. Where you use the white-label portal, information flows between an Agency and its Clients as necessary to provide the Service. Agencies are responsible for their own handling of Client data.
• Legal and safety. We may disclose information to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of AdLaunch, our users, or others.
• Business transfers. If AdLaunch is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

6. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service, and thereafter as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Aggregated and de-identified data, which cannot be linked back to you, may be retained indefinitely. When you close your account, we delete or de-identify personal information within a commercially reasonable period, except where retention is required by law or legitimate business need.

7. Cookies and Tracking

We use cookies and similar technologies for:

• Essential functions — authentication, session management, and security;
• Preferences — remembering settings such as light/dark mode;
• Analytics — understanding how the Service is used so we can improve it (for example, via PostHog).

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service. Where required by law, we obtain consent for non-essential cookies.

8. Agency and Client Data (Controller / Processor Roles)

When an Agency uses the Service to manage advertising for its Clients:

• The Agency is generally the controller of its Clients' data and is responsible for having a lawful basis and any necessary consents to bring that data into the Service and to authorize actions on Connected Accounts (consistent with Section 6.2 of the Terms).
• AdLaunch acts as a processor of that data, handling it on the Agency's behalf to provide the Service.
• Where required by applicable data-protection law, a separate Data Processing Addendum (DPA) governs this relationship and is available on request.

Agencies are responsible for providing their own privacy notices to their Clients and end users as required by law.

9. Your Rights and Choices

Depending on your location, you may have rights to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information;
• Object to or restrict certain processing;
• Receive a copy of your information in a portable format;
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at [email protected]. We will respond as required by applicable law. If your information was provided to the Service by an Agency (as a Client), please direct your request to that Agency; we will support the Agency in fulfilling it.

Marketing choices. You can opt out of marketing emails using the unsubscribe link in those messages. Service-related messages (such as billing and security notices) are not promotional and may still be sent.

10. U.S. State Privacy Rights

Residents of certain U.S. states, including Virginia under the Virginia Consumer Data Protection Act (VCDPA), may have specific rights regarding their personal data, including the rights to access, correct, delete, and obtain a copy of their data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. AdLaunch does not sell personal data and does not use personal data for cross-context behavioral advertising. To exercise applicable state-law rights, contact [email protected]. You may appeal a decision regarding your request by replying to our response; if we deny your appeal, you may contact the Virginia Attorney General.

11. International Users

The Service is operated from the United States, and information is processed and stored in the United States and in other countries where our service providers operate. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data-protection laws than your jurisdiction. Where required, we rely on appropriate safeguards for such transfers.

12. Security

We use technical and organizational measures designed to protect personal information, including encryption of Connected Account credentials, encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

13. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a revised "Last Updated" date and, for material changes, provide notice by email or within the Service. Your continued use of the Service after changes take effect constitutes acceptance.

15. Contact Us

For questions or requests regarding this Policy or your personal information: