Privacy Policy

Insight Driven Ads (“we”, “us”, “our”) provides e-commerce research and ad-creative tools through this website. We are the controller of the personal data described in this policy, meaning we decide why and how it is processed.

We operate from the State of Florida, United States. For any privacy question, request or complaint, contact info@insightdrivenads.com.

This policy covers the website and the signed-in application. It does not cover third-party sites you reach through our tools — including any storefront you ask us to analyse, which remains governed by that site’s own policies.

We collect only what the service needs to function, bill correctly and stay secure.

Account data

Your email address, display name, and a password stored only as a bcrypt hash — we cannot read or recover your password. If you sign in with Google, we receive your email address and a Google account identifier instead of a password.

Subscription and credit data

Your plan, billing interval, renewal and cancellation state, credit balance, and a ledger of every credit granted or spent. The ledger exists so a disputed balance can be reconstructed.

Payment data

Handled by Stripe. We store your Stripe customer and subscription identifiers so we can match a payment to your account. We do not receive or store full card numbers.

Content you submit

The store and landing-page URLs you ask us to analyse, product details, review text, uploaded images and video, and the prompts you write. Whatever you put into a tool, we hold in order to run it and to show you the result later.

Output we generate

Analyses, ad copy, and generated images and video, together with the metadata needed to serve them back to you — file type, size, duration and which model produced them.

Technical and usage data

IP address, browser type, timestamps, the tools you run, and error diagnostics. IP address is used for rate limiting and abuse prevention, and appears in error reports.

Communications

Emails you send us, and our replies. If you subscribe to the newsletter we store your email address and subscription state until you unsubscribe.

Administrative records

If an operator acts on your account — a manual credit grant, a plan change — we log who did it and why, so account changes are auditable.

• Running the service — authenticating you, executing the tool you asked for, storing the result and showing your history.
• Billing — taking payment, applying and expiring credits, refunding credits when a generation fails, and handling cancellations.
• Support — answering your messages and investigating problems on your account.
• Security and abuse prevention — rate limiting, bot detection on sign-up and sign-in, and detecting misuse of the platform.
• Service email — address verification, password reset, and notices about billing or material changes. These are not marketing and cannot be unsubscribed from while your account is open.
• Improving the product — aggregate, de-identified usage statistics that tell us which tools are used and where they fail.
• Legal compliance — tax and accounting records, and responding to lawful requests.

If you are in the UK or the European Economic Area, we rely on the following legal bases under the UK GDPR and EU GDPR:

Performance of a contract

Creating and running your account, executing the tools you request, and taking payment. Without this data we cannot provide the service.

Legitimate interests

Securing the platform, preventing fraud and abuse, keeping error diagnostics, and understanding aggregate usage to improve the product. We balance these against your rights and use the least data that achieves the purpose.

Legal obligation

Retaining financial records and responding to lawful requests from authorities.

Consent

Newsletter subscriptions only. You can withdraw consent at any time using the unsubscribe link, without affecting anything else.

Our tools work by sending the material you submit to third-party AI models. This is the part of the service most people want to understand precisely, so:

• Text analysis and copy generation run on DigitalOcean’s serverless inference platform.
• Video you upload to Ad Vision is analysed by Google Gemini, because it is the video-capable model in our stack.
• Video generated by the UGC Ad Creator and Ad Launch Kit is produced by OpenAI.
• Pages you ask us to analyse are fetched through ScraperAPI, which receives the URL you submitted.

These providers process the material to return a result and under their own terms. We do not grant them the right to use your content to train their models, and we do not train on it ourselves. AI output is generated automatically, can be wrong, and has no legal or similarly significant effect on you — we make no automated decisions about you in the sense of Article 22 of the GDPR.

We do not sell personal data. We share it with the processors below, each of which is bound to use it only to provide their service to us:

We may also disclose personal data:

• To professional advisers — lawyers, accountants, auditors — under a duty of confidence.
• Where required by law, or to establish, exercise or defend legal claims.
• To protect the rights, property or safety of our users, the public or ourselves, including to prevent fraud and abuse.
• To a buyer or successor in a merger, acquisition or sale of assets, in which case we will give notice before your data becomes subject to a different policy.

We are based in the United States, and the processors above are largely US-based. If you use the service from outside the United States, your personal data will be transferred to and processed in the United States, where privacy laws differ from those in your country.

Where we transfer personal data out of the UK or EEA, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision, together with the safeguards our processors maintain. You can request details of the mechanism used for a particular transfer by writing to info@insightdrivenads.com.

After account deletion, limited records may persist where we are legally required to keep them — principally invoices and payment records held by us or by Stripe — and in routine encrypted backups until those rotate out.

The measures below are the ones actually in place, not aspirations:

• Passwords are stored only as bcrypt hashes. A breach of our database would not reveal them.
• Traffic is served over TLS, and the database connection is encrypted.
• Session cookies are HttpOnly and SameSite, and carry the __Secure- and __Host- prefixes over HTTPS, so page scripts cannot read them and they cannot be set by another site.
• A Content Security Policy restricts which origins the browser may talk to.
• Sign-up, sign-in and password reset are rate limited per IP and per email, and protected by a bot check.
• Authentication cookies and credentials are scrubbed out of error reports before they are transmitted.
• Administrative actions on accounts are written to an audit log.

No system is perfectly secure, and we cannot guarantee absolute security. Use a strong, unique password, keep it to yourself, and tell us promptly at info@insightdrivenads.com if you believe your account has been compromised. Where the law requires it, we will notify you and the relevant regulator of a personal data breach without undue delay.

Depending on where you live, you have some or all of the following rights:

• Access — a copy of the personal data we hold about you.
• Correction — to fix data that is inaccurate or incomplete.
• Deletion — to have your personal data erased.
• Portability — a machine-readable copy of the data you provided.
• Restriction and objection — to limit or object to processing based on legitimate interests.
• Withdraw consent — where processing rests on consent, at any time.
• Non-discrimination — we will not degrade your service because you exercised a privacy right.

How to exercise them

You can delete your account and its stored files yourself at any time from Settings — that is the fastest route to erasure and needs no request. For anything else, email info@insightdrivenads.com from the address on your account. We respond within 30 days, and will tell you if we need longer or need to verify your identity first. Using an authorised agent is fine; we will ask for proof of their authority.

If you are in the UK or EEA and think we have handled your data badly, we would like the chance to fix it — but you may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner’s Office.

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have the rights listed above, exercised the same way. Under the California Consumer Privacy Act you may also request the categories of personal information we collected, the sources, the business purpose, and the categories of third parties we disclosed it to — all of which are set out in sections 2, 3 and 6 of this policy.

Florida residents. The Florida Digital Bill of Rights applies by its terms only to a narrow class of very large businesses, which we are not. We honour the access, correction, deletion and portability requests described above for Florida residents regardless.

Where a state law provides a right to appeal a refused request, you may appeal by replying to our decision. We will respond in writing with our reasoning.

The service is a business tool intended for adults. It is not directed to children, and you must be at least 18 to hold an account. We do not knowingly collect personal data from anyone under 13, and if we learn that we have, we will delete it promptly. A parent or guardian who believes a child has given us data should contact info@insightdrivenads.com.

We update this policy when the service changes. The revision date at the top always reflects the current version. If a change materially affects your rights, we will give notice by email or in the application before it takes effect. Continuing to use the service after that means you accept the updated policy.

This policy is governed by the laws of the State of Florida, United States, without regard to its conflict-of-laws rules.