Privacy Policy

1. Information We Collect

• Account data: Email address, hashed password, profile information.
• Generation data: Prompts, uploaded assets, generated outputs.
• Payment data: Processed by Stripe. We do not store your full card number.
• Failed-payment records: if a subscription payment fails, a record of it: the amount and currency, when it failed and when it was or will be retried, the reason code our payment processor gives for the decline, whether your bank asked for extra verification, how it ended (paid, cancelled or expired), which payment emails we scheduled and sent you and when, whether you opened the link to update your payment method, and whether you turned the reminders off. We don't store your card details or the text of those emails.
• Usage data: Pages visited, features used, generation history, credit transactions.
• Cancellation data: when you cancel, the reason you choose and anything you type (both optional), which offer, if any, we showed you and whether you took it, and, if you cancel through our payment processor's page, the reason and comment you give Stripe there.
• Technical data: IP address, browser type, device information, cookies.

2. How We Use Information

• To provide and operate the Service.
• To process payments and manage subscriptions.
• To generate AI content based on your prompts and uploads.
• To send transactional emails (receipts, password resets).
• To improve the Service through aggregated, anonymized analytics.
• To prevent fraud, abuse, and enforce our Terms.
• To send marketing communications (only with your explicit consent).

3. Data Processors

We share data with the following third-party processors to operate the Service:

3a. Advertising Measurement

If — and only if — you accept marketing cookies, we tell Meta and TikTok when someone creates an account, starts a checkout or makes a purchase, so we can tell which of our ads are worth running. This happens in two ways: from your browser via the Meta Pixel and the TikTok Pixel, and from our servers. Both describe the same event and are matched so it is counted once. Each Pixel also reports the pages you view on our site. What TikTok receives is described separately below.

What our servers send to Meta:

• your email address, hashed with SHA-256, so Meta receives a fingerprint rather than your address;
• your Adkeet account ID, hashed with SHA-256 (Meta calls this the external_id), with sign-ups, checkout starts and every purchase, including automatic renewals and plan changes;
• for a purchase made through Stripe Checkout, SHA-256 hashes of the billing details entered there: first name, last name, city, state or province, postal code and country, and phone number only if one was collected. For renewals and plan changes, only the hashed billing country and postal code;
• your IP address and browser user agent (these are sent as they are, not hashed, because Meta requires them in that form);
• Meta's browser identifier from the _fbp cookie and, if you arrived from one of our ads, the ad-click identifier from the _fbc cookie or our own ak_fbc copy of it (see our Cookie Policy);
• the address of the Adkeet page where the event happened, without its query string or fragment (for a sign-up through Google, the page the sign-in returns you to);
• for sign-ups, checkout starts and purchases, the address of the page that referred you to Adkeet, such as a search engine or social site, reduced to the site and path, without query string or fragment. To make this possible, with your consent your browser passes that address to our servers when you sign up or start a checkout;
• the type of event, and for a checkout or purchase its amount and currency and whether it is a first subscription payment, a renewal, a plan change or a credit pack.

What the Pixel sends from your browser: checkout and purchase events and the pages you view, with the page address, the referring page, your IP address, your browser user agent and the _fbp/_fbc cookies. Meta's automatic collection of button clicks and page content is switched off, so the Pixel does not read form fields or what is on the page.

Advanced matching for signed-in users: if you are signed in and have accepted marketing cookies, your browser also gives the Pixel a SHA-256 hash of your account email and a SHA-256 hash of your account ID when it starts, so they are attached to Pixel events, including page views, from the first page view. Both hashes are computed in your browser before the Meta script receives them; your plain email address is never given to Meta's script. If you sign out, or another account signs in in the same tab, we reload the page so the previous account's hashes are no longer attached to anything, and no browser events are sent until that reload.

About the hashes: hashing is pseudonymisation, not anonymisation. Meta uses these values to match an event to a Meta account. Each value is hashed once, after being put in the standard form Meta specifies (for example, trimmed and in lower case).

TikTok: with the same consent, and only for sign-ups, checkout starts and purchases made at Stripe Checkout (subscription renewals and plan changes are not sent to TikTok), our servers send TikTok: a SHA-256 hash of your email address (trimmed and in lower case); a SHA-256 hash of your Adkeet account ID; for a purchase, a SHA-256 hash of your phone number only if Stripe Checkout collected one; your IP address and browser user agent, as they are; TikTok's browser identifier from the _ttp cookie and, if you arrived from one of our TikTok ads, the ad-click identifier from the ttclid cookie or our own ak_ttclid copy of it; the address of the Adkeet page where the event happened and of the page that referred you, each without query string or fragment; and the type of event, with, for a checkout start or purchase, its amount, currency and whether it is a subscription or a credit pack. The TikTok Pixel in your browser reports the pages you view and checkout starts and purchases. If you are signed in, your browser gives the TikTok Pixel the same two hashes (email and account ID), computed in your browser — never your plain email address — and if the account in the tab changes, the TikTok Pixel is switched off in that tab until the page is reloaded. TikTok's automatic collection of button clicks, page content and form fields is not used: the TikTok Pixel loads switched off and is only switched on once it has confirmed that this automatic collection (including TikTok's automatic advanced matching, which would read email and phone fields) is turned off for our pixel. If it is not, the Pixel stays off and reports nothing, apart from possibly a single signal to TikTok that it is switched off. When you withdraw consent, the TikTok Pixel is switched off in the open page and may likewise send TikTok one final signal that it is off; after that it sends nothing. See TikTok's Privacy Policy.

Stored with the checkout: with your consent, the Adkeet page where you started a checkout and its referring page (site and path only) are stored in the Stripe Checkout Session, next to the ad cookie values (including the TikTok _ttp and ttclid values when present), IP address and user agent already stored there, so the purchase can be reported to Meta and TikTok after payment. Withdrawing consent stops them being sent to Meta and TikTok; they remain in Stripe's records for Stripe's retention period.

What we never send: your prompts, your generated images or videos, your actors, your project names or any other content you create. None of it is sent to Meta or to any other advertising service, ever.

If you decline, nothing is sent. Neither the Meta Pixel nor the TikTok Pixel is loaded, no TikTok or Meta cookie is set, and our servers report nothing. If you accept and later change your mind, reporting stops from that point — in the open page as well as on later visits, and including for subscription renewals, which happen without your browser being involved at all. Switching marketing off also deletes the _fbp, _fbc, ak_fbc, _ttp, ttclid, ttcsid, _tt_enable_cookie and ak_ttclid cookies from our site, and the TikTok Pixel's tt_ session storage. Our servers record your answer against your account. If you switch marketing off while signed out, it is applied straight away when this browser holds our essential ak_cw cookie (see our Cookie Policy), and otherwise the next time you sign in from that browser; a yes given while signed out always waits for your next sign-in. Meta processes this as an independent controller; see Meta's Privacy Policy and our Cookie Policy.

4. Data Retention

• Account data is retained for the life of your account plus 30 days after deletion.
• Generated content is retained until you delete it or your account is closed.
• Payment records are retained for 7 years for tax and legal compliance.
• Failed-payment records are kept as part of our payment records. If you delete your account, they are kept without your account ID for revenue accounting. They still carry our payment processor's customer and subscription references, so they are not anonymous.
• Server logs are retained for 90 days.

5. Your Rights

GDPR Rights (EU/EEA/UK residents)

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Portability: Receive your data in a machine-readable format.
• Object: Object to processing based on legitimate interests.
• Restrict: Request limited processing of your data.

CCPA Rights (California residents)

• Right to Know: What personal information we collect and why.
• Right to Delete: Request deletion of your personal information.
• Right to Opt-Out: Opt out of the sale of personal information (we do not sell your data).
• Non-Discrimination: We will not discriminate against you for exercising your rights.

Two of these rights are self-serve and immediate — no request needed. Download my data in your account settings exports your profile, credit ledger, usage and generation history, asset, folder and project listings, subscriptions, consent records (including your ad-tracking answer), the conversions our servers reported to Meta about you, any cancellation feedback you gave, and your failed-payment records with the payment emails we sent about them, as JSON (portability and access). Delete account in the same place erases your data and cancels any active subscription (erasure).

For anything else — rectification, objection, restriction, or a question about an export — email privacy@adkeet.com. We will respond within 30 days.

6. Children's Privacy

Adkeet is not intended for anyone under 18. We do not knowingly collect personal information from children under 13. If we discover that we have collected data from a child under 13, we will delete it immediately. If you are a parent and believe your child has provided us with personal information, please contact us.

7. International Transfers

Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where applicable. The advertising measurement data described in section 3a, including the hashed account ID, name, billing address and phone number, is disclosed to Meta Platforms and to TikTok, outside Quebec, only on the basis of your consent to marketing cookies.

8. Data Security

We implement industry-standard security measures including encryption in transit (TLS), row-level security on our database, secret scanning in our CI/CD pipeline, rate limiting, and CSRF protection. No system is 100% secure; we cannot guarantee absolute security.

9. Changes

We may update this policy. Material changes will be communicated via email or in-app notice at least 30 days before taking effect.

10. Contact

For privacy inquiries, data requests, or complaints: privacy@adkeet.com