Privacy policy

1. Who we are and our role

For your account data (name, e-mail, authentication, the log of your actions), for support and for the security of the platform, we are the CONTROLLER.

For the data we process on behalf of your organisation — data from the connected accounts and stores and the materials you produce — we are a PROCESSOR and your organisation is the controller; the rules are in the Data Processing Agreement (DPA). We have not appointed a data protection officer (we are not required to); for any question write to us at the address above.

2. What data we process

• Your platform account: name, e-mail, password (stored only as a hash), the organisation you belong to, the log of your actions.
• Meta (Facebook) data, with your authorisation through "Connect with Facebook": the ad accounts and Pages you share, their campaigns, ad sets, ads and creatives (including the ads' videos, for analysis), and performance metrics. Permissions used: ads_read, business_management, pages_show_list, pages_read_engagement. We do not create, modify or delete ads without a separate, explicit permission.
• TikTok data, with your authorisation through "Connect TikTok": the chosen ad accounts, spend per campaign and day, campaign names and ad links. Read only.
• Shopify data, with your authorisation when you install the app: products, media files, the store theme, orders and inventory costs (for the profit calculation). From orders we do NOT take the buyers' names, addresses, phone numbers or e-mails.
• Fulfilo data, with the token you give us: orders with their statuses, amounts, products and delivery costs. We do NOT take the buyers' names, addresses, phone numbers or e-mails.
• AI provider access keys that you enter (BYOK): stored encrypted (AES-256-GCM), used only for the generations you start.
• The materials you produce in the platform: scripts, images, clips, edits, product pages — plus the technical trace of the generation (which model, what estimated cost, what the provider refused).
• The messages you send us from the "Feedback" button (or from "Report" on an ad): the text, the screenshots you attach and technical data added automatically — the page you were on, the browser, the screen size and the platform's latest errors in your tab, so that we can reproduce the problem. Screenshots are deleted automatically 90 days after the issue is resolved; the conversation stays in your account.
• Public ads of competitors, collected from ad libraries for the research module. Their images and clips are deleted automatically after 30 days; only the text and the analysis remain.
• Technical security data: IP address and browser at sign-in, technical errors (with no personal data in the error reports).

3. Why we process it and on what legal basis

• Providing the contracted service (analyses, signals, profit calculation, research, generation of ads and product pages), the account and communications about the service — performance of the contract with your organisation (art. 6(1)(b) GDPR). Each platform is connected only with your authorisation, which you can withdraw at any time by disconnecting it.
• Security of the platform, the audit log, error reports, support (including visible impersonation) and the defence of our rights — our legitimate interest in delivering a secure service and in being able to prove how data was handled (art. 6(1)(f) GDPR).
• Research of competitors' public ads — your organisation's legitimate interest in understanding its market; we keep their media for 30 days only.
• Invoicing and accounting records — legal obligations (art. 6(1)(c) GDPR).

4. What we do NOT do

We do not sell the data, use it for our own advertising or use it to train models. The policies of the AI providers you choose (with your key) remain between you and them. We do not take decisions based solely on automated processing that produce legal effects on you (art. 22 GDPR): the platform's signals and estimates are suggestions, the decision remains yours.

5. Who we share it with

With our providers, as processors, bound by contract to confidentiality and security obligations:

• Vercel Inc. — hosting of the web application and API (EU/US)
• Neon Inc. — database (managed PostgreSQL) (EU (Frankfurt))
• Cloudflare, Inc. (R2) — file storage: images, clips, edits (EU/global)
• Hetzner Online GmbH — video rendering server and backup mirror (Germany)
• Resend, Inc. — transactional e-mails and alerts (EU/US)
• Functional Software, Inc. (Sentry) — technical errors and execution traces (EU)
• Anthropic PBC — language models for scripts, analyses and reviews (US) — only if you add your key
• OpenAI, L.L.C. — image and text generation (US) — only if you add your key
• Google LLC — image/video generation, transcription and video analysis of ads (EU/US) — only if you add your key
• KIE.ai — image and video clip generation (global) — only if you add your key
• fal.ai — media generation and processing (US) — only if you add your key
• ElevenLabs Inc. — synthetic voice and lip sync (US) — only if you add your key
• Apify Technologies s.r.o. — collection of public ads from ad libraries (EU (Czechia)) — only if you add your key

6. Platforms you connect

We read your data from these only after you connect them; they are independent controllers with their own privacy policies:

• Meta Platforms Ireland Ltd. — your Meta ads, campaigns and metrics, when you connect the account (EU/US)
• TikTok for Business — your TikTok ad spend and ad links, when you connect the account (EU/global)
• Shopify International Ltd. — your store's products and orders, when you install the app (EU/Canada)
• Fulfilo (fulfilo.tech) — orders and delivery statuses, when you connect the token (EU)

7. Transfers outside the European Economic Area

Some providers process data in the United States or other countries outside the EEA. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses, with the additional measures in the providers' contracts. On request, we tell you which safeguard applies to each provider.

8. How long we keep it

For as long as the ad account, the store or the fulfilment centre is connected and your organisation has an active account.

When a Meta account is disconnected in Settings, its synced ads, metrics and analyses are deleted from the platform. When TikTok is disconnected, the token and the spend brought from the TikTok account are deleted. When Fulfilo is disconnected, the token is removed; the orders already brought in (with no buyer data) stay in the profit calculation until the organisation is closed or you ask us to delete them.

When the app is uninstalled from Shopify, we delete the store's orders and data within 48 hours of Shopify's notification. When the organisation is closed, its data and files are permanently deleted after a safety period of 30 days; backup copies disappear with their rotation (at most 35 days).

Research media (other people's public ads) is deleted automatically after 30 days.

The INTERMEDIATE files of your ads — frames, clips and voice — are deleted automatically after 30 days, in two cases: (1) cancelled or failed runs; (2) for a delivered ad, the old versions of a frame or clip that you REPLACED — that is, only those over which you have since approved a newer version. What you approved, and any file for which there is no newer approved version, remains. DELIVERED ads are not deleted automatically: they stay until you move them to the bin or the organisation is closed.

The audit log (who, which action, when) is kept after the organisation is closed, as evidence of how the data was handled and for the defence of legal claims. We delete it on request, unless a legal obligation or a claim to defend requires us to keep it. Accounting documents are kept for the periods required by accounting and tax law.

9. Cookies

We only use strictly necessary cookies: the sign-in session and short-lived cookies that protect the connection to Meta, TikTok and Shopify (they expire within 10 minutes). We do not use analytics, advertising or tracking cookies, so we do not ask for consent for them.

10. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, under the GDPR, and the right to withdraw at any time the authorisation given to a platform (by disconnecting it). You exercise them by writing to contact@iterio.io; we answer within one month. For data processed on behalf of your organisation, we also forward the request to the organisation, which is the controller.

You can also request the deletion of your Meta data from Facebook (Settings → Apps and Websites → Remove); we receive the request automatically, immediately delete the connection, the token and the ads data synced through it, and show you a confirmation code.

You can file a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro).

11. Security

Access tokens and keys are encrypted at rest (AES-256-GCM), each organisation's data is isolated at database level (row-level security), internal access is logged, and our team's access to your account ("impersonation") is visible to you at the top of the page. The connection is HTTPS only. If we learn of a security breach that concerns you, we notify you without undue delay.

12. Minors

The platform is intended for professionals and is not knowingly used by persons under 18.

13. Changes

We update this policy when what the platform does changes. The date of the last update is shown at the top; for an important change we notify you by e-mail or in the platform before it applies.

14. Contact

ITERIO S.R.L. · contact@iterio.io · https://www.iterio.io