Privacy Policy

Ad Army Group, Inc. ("Ad Army," "we," "us," or "our") operates the Ad Army platform, including our website, applications, APIs, and related services (collectively, the "Service").

This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It applies to all users of the Service, whether you are on a free plan, trial, or paid subscription. By accessing or using the Service, you acknowledge that you have read and understood this policy.

We built Ad Army for creative teams who move fast. We treat your data with the same precision we bring to the product itself -- no unnecessary collection, no selling your information, no dark patterns.

We collect information in three categories:

a) Account & Profile Information

When you create an account, we collect your name, email address, company name, job title, and authentication credentials. If you sign up through a third-party provider (e.g., Google), we receive basic profile information from that provider.

b) Usage & Technical Data

We automatically collect information about how you interact with the Service, including: pages visited, features used, pipeline configurations, generation parameters, timestamps, device type, browser type, IP address, and referring URLs. This data helps us improve the product and diagnose issues.

c) Creative Assets & Content

When you use Ad Army, you may upload images, videos, text briefs, scripts, brand assets, and other creative materials. These assets are processed to deliver the Service (e.g., generating ad variations, running pipelines, rendering video) and are stored in your workspace.

d) Billing Information

Payment processing is handled by third-party processors (Stripe). We do not store full credit card numbers. We receive and retain a token identifier, card brand, last four digits, and billing address for record-keeping.

We use the information we collect to:

• Deliver the Service -- run AI generation pipelines, render video in the Studio, manage your projects, and provide the core functionality you signed up for.
• Improve the product -- analyze aggregate usage patterns to build better features, optimize performance, and fix bugs. We do not use your creative assets to train AI models.
• Communicate with you -- send transactional emails (account confirmation, billing receipts, security alerts), product updates, and, with your consent, marketing communications.
• Process billing -- track credit usage, process payments, and manage subscriptions.
• Maintain security -- detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations -- respond to lawful requests from authorities and enforce our terms.

We do not sell your personal data. Full stop.

We share information only in the following limited circumstances:

• AI providers -- When you use AI generation features, prompts and input assets are sent to third-party AI providers (e.g., Google, OpenAI, Anthropic, xAI, Kling, ByteDance) to produce outputs. These providers process data under their respective terms and do not use your inputs to train their models when accessed through our API agreements.
• Cloud infrastructure -- We use Vercel for hosting and Supabase for database and authentication services. Your data is processed and stored on their infrastructure under data processing agreements.
• Payment processors -- Stripe processes payment transactions on our behalf.
• Analytics -- We use privacy-respecting analytics tools to understand product usage in aggregate. We do not share raw personal data with analytics providers.
• Legal requirements -- We may disclose information when required by law, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers -- In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

We take the security of your data seriously. Our security posture includes:

• Encryption at rest and in transit -- All data is encrypted using AES-256 at rest and TLS 1.2+ in transit.
• Access controls -- Role-based access controls, multi-factor authentication for internal systems, and principle of least privilege across all environments.
• Regular security assessments -- We conduct vulnerability scanning and code reviews as part of our development lifecycle.
• Incident response -- We maintain a documented incident response plan. In the event of a data breach affecting your personal information, we will notify you within 72 hours as required by applicable law.

No system is completely secure. If you discover a vulnerability, please report it to security@adarmy.com.

We retain your personal information and creative assets for as long as your account is active or as needed to provide the Service. Specifically:

• Active accounts -- All account data, project data, and creative assets are retained for the duration of your subscription.
• Account closure -- When you close your account, we initiate deletion of your personal data, creative assets, and project data within 90 days. Some data may be retained longer if required for legal or compliance obligations.
• Billing records -- Transaction records are retained for 7 years to comply with tax and accounting requirements.
• Aggregated data -- De-identified, aggregated usage data that cannot be linked back to you may be retained indefinitely for analytics and product improvement.

You can request early deletion of your data at any time by contacting us. See "Your Rights" below.

Depending on your location, you may have the following rights regarding your personal data:

Under GDPR (European Economic Area, UK, Switzerland)

• Access -- Request a copy of the personal data we hold about you.
• Rectification -- Request correction of inaccurate or incomplete data.
• Erasure -- Request deletion of your personal data ("right to be forgotten").
• Portability -- Request your data in a structured, machine-readable format.
• Restriction -- Request that we limit processing of your data in certain circumstances.
• Objection -- Object to processing based on legitimate interests or for direct marketing.

Under CCPA (California)

• Right to know -- Request disclosure of categories and specific pieces of personal information collected.
• Right to delete -- Request deletion of personal information.
• Right to opt-out -- We do not sell personal information, so there is nothing to opt out of. If this ever changes, we will provide a clear mechanism.
• Non-discrimination -- We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at privacy@adarmy.com. We will respond within 30 days (or sooner where required by law). We may ask you to verify your identity before processing your request.

We keep cookies to a minimum. Here is what we use:

• Essential cookies -- Required for authentication, session management, and security. These cannot be disabled without breaking core functionality.
• Analytics cookies -- Used only with your consent to understand how the Service is used in aggregate. You can opt out at any time through your account settings or by contacting us.

We do not use advertising cookies or tracking pixels. We do not participate in cross-site tracking or retargeting networks.

Ad Army is based in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission where applicable.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your data, reach out:

If you are in the EU and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.