Privacy Policy

We collect the following categories of data:

• Account data — name, email address, hashed password (managed by our auth provider), and workspace details.
• Brand & content data — brand profiles, products, marketing goals, generated content, uploaded images and documents you provide.
• Connected-platform data — when you connect Meta, Google Ads, or LinkedIn, we store OAuth tokens and the account/campaign data needed to operate those features on your behalf.
• Billing data — subscription status and plan. Card details are collected and stored by Stripe; we never see or store full card numbers.
• Usage data — feature usage, AI operation logs (for cost accounting and limits), and standard server logs (IP address, browser type, timestamps).

• To provide, operate, and improve the Service.
• To generate marketing content using AI based on the inputs you provide.
• To publish content and manage advertising campaigns on platforms you connect.
• To process subscriptions and payments.
• To enforce plan limits, prevent abuse, and account for AI usage costs.
• To communicate with you about the Service, including transactional and support messages.

To generate content we send your brand inputs and instructions to third-party AI providers (see Sub-processors). We do not sell your data, and we do not use your content to train our own models. Inputs and outputs may be processed transiently by those providers under their respective terms.

We rely on the following processors to deliver the Service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Anthropic — AI text generation.
• OpenAI — AI image generation.
• remove.bg (Kaleido) — image background removal.
• Stripe — payment processing.
• Meta, Google, LinkedIn — only when you connect those accounts, to publish content and manage ads.

We retain your data for as long as your account is active and as needed to provide the Service. If you close your account, we delete or anonymise your personal data within a reasonable period, except where we are required to retain it for legal, tax, or accounting purposes.

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access is restricted to authorised personnel. Storage buckets containing your assets are private and served via short-lived signed URLs. No method of transmission or storage is 100% secure, but we take reasonable steps to protect your data.

Under the PDPA and similar laws, you may request access to, correction of, or deletion of your personal data, and you may withdraw consent for certain processing. To exercise these rights, contact us at the address below. We will respond within the timeframe required by applicable law. See also Data Deletion Requests for the specific account-deletion procedure.

You may request deletion of your personal data and account at any time, including data we received from connected platforms such as Facebook, Instagram, Google, or LinkedIn.

From within the Service: sign in, open Settings → Workspace → Delete account, confirm with your password, and your account, brands, generated content, uploaded assets, and connected-platform tokens will be permanently deleted within 30 days. Aggregated and de-identified usage logs may be retained for security and accounting purposes for up to 12 months.

By email: if you cannot access your account, write to support@iprodezign.com from the email address registered on the account with the subject line “Data deletion request”. We will verify your identity and complete deletion within 30 days, and we will confirm by reply when it is done.

Scope of deletion: brand profiles, products, marketing goals, AI-generated content, uploaded images and documents, OAuth tokens for connected platforms, billing metadata held in our database, and notification history. Content already published to third-party platforms (e.g. a Facebook post that went live before the deletion request) is not in our control; you must remove it directly on that platform.

Records we are legally required to keep: tax invoices and payment records are retained for the period required by Singapore law (typically 5 years), but the personal identifiers within them are restricted to access by authorised finance personnel only.

Our providers may process data outside Singapore (e.g., in the United States or the EU). Where we transfer personal data abroad, we take steps to ensure a comparable standard of protection consistent with the PDPA.

We use strictly necessary cookies for authentication and session management. We do not use third-party advertising cookies on the application.

We may update this policy from time to time. Material changes will be notified within the Service or by email. Continued use after changes take effect constitutes acceptance.

Questions or requests regarding this policy and your data: support@iprodezign.com.