Política de privacidad

2. Information we collect

2.1 Information you give us.

• Contact and account data: name, email address, phone number, company name, job title, company website, username and password.
• Sales and onboarding data: the details you submit in demo or contact forms, such as marketing budget, ad budget and current marketing channels.
• Customer Content: uploads, briefs, prompts, feedback and generated outputs, as defined in Section 1.1, together with their metadata (file names, dates, formats and edit history).
• Communications data: the contents of emails, chats, calls and support requests you exchange with us. If we record a call, we will tell you first.
• Transaction data: plan, invoices, billing address and transaction history. Card details are collected and stored by Stripe, not by us.
• Marketing data: your marketing preferences and how you engage with our emails.

2.2 Connected Accounts. When you connect an account such as Meta, Google Ads, YouTube, Shopify or Amazon, we receive the data you authorise. This can include ad account structure, campaigns, ads and creatives, performance metrics, audiences, product catalogs and store data. Access follows the permissions you grant and each platform's terms. You can revoke access at any time in the platform's settings or by contacting us.

2.3 Social login. If you sign in with Google, we receive your name, email address and profile picture as permitted by your Google settings.

2.4 Information about other people.

• Creators and influencers. Our influencer tools and services (including Remy) collect information about creators from public sources such as social media profiles. This can include name, handle, public profile data, audience and engagement metrics, and business contact details. We also collect whatever creators provide to us directly during a collaboration.
• People in Customer Content. Uploads may show or name people, such as models, creators, customers or employees. The Customer is responsible for having the rights and consents needed to share them with us.
• Invitees. If you invite teammates, we collect their email addresses to send the invitation.

2.5 Information collected automatically. When you use the Service or open our emails, we and our service providers collect:

• Device data: IP address, browser and operating system, device type, language, and approximate location derived from the IP address.
• Usage data: pages and screens viewed, features used, time spent, referring site, clicks, and access times.
• Email interaction data: whether you opened an email or clicked a link, collected through pixel tags.

2.6 Cookies and similar technologies. We use essential, analytics (Google Analytics, Google Tag Manager), personalisation and marketing (Meta Pixel) cookies and similar technologies. You can change your cookie settings at any time through the cookie banner on our website.

2.7 Other sources. We may combine the information above with data from service providers, analytics and advertising partners, business-data providers used for sales outreach, and public sources.

3. Biometric information

This section applies to residents of Illinois, Texas, Washington and other US states with biometric privacy laws, and to users in the EEA and UK. It takes priority over anything else in this policy that conflicts with it.

Some features process images, video or audio that show a person's face or contain their voice. Examples are AI avatars, UGC-style video, on-model fashion imagery, lip-sync and voiceover. Under certain laws, this processing may involve biometric information. That means measurements of a person's physical characteristics, such as a scan of face geometry (a faceprint) or a voiceprint, and it includes "biometric identifiers" and "biometric data" as those laws define them.

• Purpose. We use biometric information only to deliver the feature you requested. We never use it to identify or verify anyone.
• Consent. Where the law requires consent before collection, we obtain written consent separately from this policy and our Terms of Use. If you upload media showing another person, you confirm that you have their written consent to our processing it for that feature. Providing this media is voluntary. If you decline, only the features that depend on it are unavailable.
• Retention and destruction. We do not create or store faceprints or voiceprints. Any biometric information arising during processing is used transiently and destroyed once the requested output is generated. This is always within the time allowed by law, and never later than the time the initial purpose is satisfied. The uploaded media is kept under Section 6 until you delete it. This section is our written retention and destruction policy for biometric information.
• No sale or profit. We do not sell, lease, trade or otherwise profit from biometric information.
• Disclosure. We disclose biometric information only to service providers that process it on our behalf to deliver the feature, when required by law, or with consent.
• Security. We protect biometric information with a standard of care at least as protective as the one we use for other confidential information.
• Questions and withdrawal. To ask about biometric information or to withdraw consent, email privacy@quickads.ai.

4. How we use information

• To provide the Service. We create and run your Account, generate creatives, analyse ad performance, run creative strategy and QA, manage campaigns and influencer collaborations, process payments, and provide support.
• To communicate with you. We send service announcements, security alerts, billing notices and replies to your requests.
• To improve the Service. We study how the Service is used, fix problems and develop new features.
• For marketing. We send marketing emails, run advertising, and measure how effective it is. You can opt out at any time (Section 7).
• For security and compliance. We prevent fraud and abuse, moderate content, enforce our Terms, meet legal obligations, and establish or defend legal claims.

5. AI processing, training and your content

5.1 AI providers. We use a combination of our own models and third-party AI model and compute providers to deliver features. Customer Content is sent to these providers only to generate your outputs, and we require them to process it only on our instructions.

5.2 No training on your content. We do not use Customer Content, or data from your Connected Accounts, to train our own or third-party foundation models. Our creative-intelligence models are trained on publicly available advertising, such as ads shown in public ad libraries.

5.3 Aggregated and de-identified data. We may create aggregated or de-identified data from Service usage and Connected Account performance, such as category-level creative benchmarks. We use it to improve the Service and to publish insights. It never identifies you, your brand or your individual ads. We do not attempt to re-identify it.

5.4 Connected Account data stays yours. We use Connected Account data only to provide and improve the Service for you. We never share one Customer's account data with, sell it to, or use it for, another Customer or any third party for unrelated purposes. Our use of data received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

5.5 Your content in our marketing. We do not use Customer Content, or creatives we make for you, in our case studies, portfolio or marketing without your written consent. Any results we cite, such as client outcomes, appear only with your approval and with the client context attached.

5.6 Automated decisions. We do not make automated decisions about individuals that produce legal or similarly significant effects.

5.7 Sensitive information. Do not submit sensitive personal information to the Service, such as health, financial account or government ID details. Do not include personal information about others in prompts unless you have the right to share it. Section 3 covers media showing faces or voices.

6. Retention and deletion

6.1 How long we keep data. We keep personal information only as long as we need it for the purposes in this policy. That includes legal, tax, accounting and reporting duties, fraud prevention, and establishing or defending legal claims. In practice:

• Account and Customer Content: for as long as your Account is active, and then as described in 6.2.
• Connected Account data: while the connection is active. After you disconnect, we stop fetching new data and delete stored data within 30 days, unless you ask us to keep historical reports.
• Sales, marketing and prospect data: until you opt out or ask us to delete it, or after 24 months without engagement.
• Billing records: for as long as tax and accounting laws require.

6.2 Deleting content or your Account. You can delete individual content inside the Service. To delete your Account, use your Account settings or email privacy@quickads.ai with the subject "Data Deletion Request" from your registered email address. We verify the request and then:

1. Delete your Account information and Customer Content from our active systems within 30 days of verification.
2. Ask the service providers that hold your data on our behalf to delete it.
3. Confirm in writing once deletion is complete.

Copies in backups are overwritten on our normal backup cycle, within 90 days. We may keep data longer where the law requires it, for example under a litigation hold, a law-enforcement request or a tax audit. We may also keep aggregated or de-identified data that no longer identifies you. Ending or not renewing a paid plan stops billing only. It does not delete your Account or content.

6.3 When we no longer need data. We delete it or de-identify it. If neither is possible yet, for example because it sits in a backup, we store it securely and isolate it from further use until it can be deleted.

7. Your choices and rights

• Access and update. Review and update your Account details in your settings, or ask us for a copy of your data.
• Marketing emails. Use the unsubscribe link in any marketing email, or contact us. You will still receive service and billing messages.
• Cookies. Change your preferences through the cookie banner or in your browser settings. Blocking essential cookies may break parts of the Service.
• Global Privacy Control. We treat GPC signals as a request to opt out of "sale" or "sharing" for targeted advertising, where the law requires it. A GPC signal applies to the browser or device that sends it. We do not respond to "Do Not Track" signals.
• Connected Accounts. Revoke access in the relevant platform's settings (for example, Meta Business Integrations or Google Security Settings) or contact us. Revoking stops future access. It does not affect data we already received, which is handled under Section 6.
• Declining to provide data. Some features need certain data to work. If you do not provide it, those features may be unavailable.

The US state and EEA/UK sections below describe additional rights. To make any request, email privacy@quickads.ai. We may need to verify your identity first.

8. How we share information

We do not sell personal information for money. We share it only with:

• Affiliates: companies in our group, including 88 Ventures US, LLC, which operate the Service with us under this policy.
• Service providers: hosting and cloud, AI model and compute providers, payment processing (Stripe), email delivery, CRM and sales tools, analytics, customer support and security vendors. They act only on our instructions.
• Advertising and analytics partners: such as Google and Meta, through cookies and pixels on our website, as described in Sections 2.6 and 14.
• Creators and influencers: when you use our influencer services, we share your brief, product details and the contact details needed to run the collaboration.
• Connected Accounts and integrations: the platforms you link, including AI assistants and clients you connect through the QuickAds MCP server, when you instruct us to publish, sync or pull data. Their own privacy policies govern their use.
• Your organisation: workspace owners and administrators (Section 1.3).
• Professional advisors: lawyers, auditors, accountants, bankers and insurers.
• Authorities and others: law enforcement, regulators, courts or other parties when we believe in good faith that the law requires it, or to protect rights, safety or property.
• Business transfers: prospective and actual investors, acquirers or successors in a financing, merger, acquisition, asset sale, insolvency or similar event.
• Anyone else you direct us to, or with your consent.

9. Security

We use technical, organisational and physical safeguards, including encryption in transit and at rest, role-based access controls, and logging and monitoring. We are working toward SOC 2 compliance. We have procedures to respond to data breaches, and we will notify you and regulators where the law requires. No system is completely secure, so we cannot guarantee absolute security.

10. International data transfers

We are based in Singapore, and our affiliates, team and service providers operate in other countries, including the United States and India. Your information may be processed in countries whose data protection laws differ from those where you live. When we transfer data, we use the safeguards the law requires. Section 15.6 covers transfers out of the EEA and UK.

11. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, email privacy@quickads.ai and we will delete it.

12. Third-party sites and YouTube API Services

The Service links to and integrates with third-party sites and services that we do not control. Their privacy policies apply to them.

The Service uses YouTube API Services. By using YouTube features in the Service, you agree to the YouTube Terms of Service, and Google's Privacy Policy applies to YouTube data. You can revoke our access at any time through your Google Security Settings.

13. Changes to this policy

We may update this policy from time to time. For material changes, we will notify you by email or in the Service before they take effect and update the dates at the top. Other changes take effect when posted. Where the law requires your consent to a change, we will ask for it. Previous versions are available on request.

14. Notice to US state residents

14.1 Scope. This section adds to the rest of this policy for residents of California, Texas, Virginia, Colorado, Connecticut and other US states with comprehensive privacy laws. Where we process data as a service provider for a Customer (Section 1.2), send requests to that Customer.

14.2 What we collect and why. In the last 12 months we collected the following categories of personal information:

We use each category for the purposes in Sections 4 and 5, and retain it as described in Section 6.

14.3 Sale, sharing and targeted advertising. We do not sell personal information for money. When you visit our website, cookies and pixels from partners such as Google and Meta collect identifiers, internet activity and inferences for targeted advertising. Some state laws treat this as a "sale", "sharing" or "targeted advertising". You can opt out through the cookie banner on our website or by enabling Global Privacy Control in your browser. We do not knowingly sell or share personal information of anyone under 18.

14.4 Sensitive personal information. We do not use or disclose sensitive personal information for purposes that would require offering a right to limit under California law. Biometric information is handled only as described in Section 3.

14.5 Your rights. Subject to applicable law, you can ask us to:

• confirm whether we process your personal information and let you access it;
• delete it;
• correct inaccuracies;
• give you a portable copy of the data you provided;
• opt out of sale, sharing, targeted advertising and profiling that produces legal or similarly significant effects;
• limit the use of sensitive personal information, where that right applies.

We will not discriminate against you for exercising these rights.

14.6 How to make a request. Email privacy@quickads.ai. We will verify your identity by matching the details you give with our records. We respond within 45 days, and may extend this by up to 45 more days with notice. You can use an authorised agent if you give them signed permission. If we deny your request, you can appeal by replying to our decision. We will respond to the appeal within the time the law allows. If you are still unsatisfied, you can contact your state attorney general.

14.7 California "Shine the Light". California residents can ask once a year for information about personal information we disclosed to third parties for their own direct marketing. We do not make such disclosures. To ask, email privacy@quickads.ai.

15. Notice to users in the EEA and UK

15.1 Scope. This section applies to individuals in the European Economic Area and the United Kingdom. "Personal information" includes "personal data" as defined in the EU GDPR and the UK GDPR.

15.2 Controller. Brandbooster Pte Ltd is the controller, except where we act as a processor for a Customer (Section 1.2).

15.3 EU and UK contact. For privacy matters in the EU or UK, contact us at support@quickads.ai.

15.4 Legal bases.

15.5 Your rights. You can ask us to:

• give you access to your personal data;
• correct it;
• delete it;
• restrict our processing of it;
• give you a portable copy, or send one to another controller;
• stop processing it where we rely on legitimate interests (you can always object to direct marketing);
• withdraw any consent you have given, without affecting processing that happened before.

Email privacy@quickads.ai to make a request. We respond within one month. We may extend that by two months for complex or multiple requests, and will tell you if we do. Requests are free unless they are clearly unfounded or excessive. If we refuse a request, we will explain why.

You can also complain to your local data protection authority. EEA authorities are listed by the European Data Protection Board. In the UK, contact the ICO.

15.6 Transfers outside the EEA and UK. We are based in Singapore, and our affiliates and service providers operate in countries including the United States and India. We transfer personal data from the EEA and UK only where one of the following applies:

• the destination has an adequacy decision, including US recipients certified under the EU-US Data Privacy Framework and its UK Extension;
• the European Commission's Standard Contractual Clauses (with the UK Addendum) are in place;
• a GDPR exception applies, such as your explicit consent.

To ask which mechanism applies to a transfer, email privacy@quickads.ai.

15.7 Must you provide data? No. But if we need data to meet a contract or a legal duty and you do not provide it, we may be unable to provide some or all of the Service.

16. Contact us

For questions, complaints or privacy requests:

• Email: privacy@quickads.ai (general support: support@quickads.ai)
• Contact form: quickads.ai/contact-us
• Post: Brandbooster Pte Ltd, 4B Jupiter, Singapore

If you are in the EEA or UK, see Section 15.3.