1. Introduction
Promevra (“Promevra,” “we,” “us,” or “our”) provides an AI-powered advertising and growth platform that helps businesses create, launch, manage, optimize, and scale advertising campaigns across multiple advertising networks. This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, and the rights and choices available to you.
This policy applies to our website, web application, background services, and related products and services (collectively, the “Services”). By using the Services, you acknowledge that you have read and understood this Privacy Policy.
For personal data we process on behalf of our business customers (for example, data within a customer’s advertising accounts), the customer is the data controller and we act as a data processor. In those cases, the customer’s own privacy notice and our data processing agreement govern that processing.
2. Information We Collect
Information you provide
- Account information — your name, email address, password (stored hashed), and profile details.
- Organization information — company name, industry, website, region, team members, and roles.
- Brand assets and content — logos, product and lifestyle images, brand colors, guidelines, copy, and any files you upload to generate or manage creatives.
- Campaign inputs — objectives, budgets, target audiences, offers, and other information you enter into the AI Campaign Builder.
- Billing information — subscription plan and billing contact details. Payment card details are collected and processed directly by our payment processor (Stripe); we do not store full card numbers.
- Communications — messages you send to support, feedback, and survey responses.
Information from connected advertising platforms
When you connect an advertising account (for example, Google Ads, Meta, TikTok, Microsoft, LinkedIn, Pinterest, or Reddit) via authorization, we receive access tokens and campaign, performance, audience, and conversion data necessary to provide the Services. Access tokens are stored encrypted and are never exposed to your browser.
Information we collect automatically
- Usage data — features used, actions taken, pages viewed, and timestamps.
- Device and log data — IP address, browser type, operating system, and diagnostic logs (with secrets redacted).
- Cookies and similar technologies — used for authentication, preferences, and analytics (see “Cookies and Tracking”).
3. How We Use Information
We use personal data to:
- Provide, operate, and maintain the Services, including generating strategies, ad copy, creatives, and recommendations.
- Authenticate users, enforce role-based permissions, and secure accounts and organizations.
- Process subscriptions, billing, and AI credit usage.
- Analyze advertising performance and produce insights, reports, and optimization recommendations.
- Communicate with you about your account, transactions, security, and product updates.
- Provide customer support and respond to your requests.
- Detect, prevent, and address fraud, abuse, security incidents, and technical issues.
- Improve and develop the Services, including quality and reliability of AI features.
- Comply with legal obligations and enforce our agreements.
Where required by law, we rely on the following legal bases: performance of a contract, our legitimate interests (such as securing and improving the Services), your consent (for example, certain cookies and marketing), and compliance with legal obligations.
4. AI and Automated Processing
Promevra uses artificial intelligence to analyze businesses and websites, generate advertising strategies and creative content, and produce performance explanations and optimization recommendations. To do this, we send relevant inputs (such as your business information, website content, and campaign data) to our AI sub-processors to generate outputs.
- We do not use your private business data or connected-account data to train third-party foundation models. Our AI sub-processors process inputs only to return outputs to us and do not use your content to train their models on our account configuration.
- AI-generated outputs may contain inaccuracies. We label AI observations as observations, hypotheses, or recommendations, and you remain responsible for reviewing outputs before publishing.
- We do not make decisions producing legal or similarly significant effects about individuals solely by automated means. High-impact advertising actions (such as budget increases, publishing, and major targeting changes) require human approval.
5. Advertising Platform Integrations
When you connect a third-party advertising platform, you authorize Promevra to access and act on that account on your behalf, subject to the permissions you grant. We use this access to import performance data and, where you direct, to prepare and manage campaigns.
Your use of each advertising platform remains subject to that platform’s own terms and privacy policies. You are responsible for complying with the policies of the advertising networks you connect. You can disconnect an integration at any time from the Integrations page, which revokes Promevra’s ongoing access.
6. Service Providers and Sub-processors
We share personal data with vetted service providers who process it on our behalf under contractual confidentiality and security obligations. Our key sub-processors include:
- Supabase — database, authentication, and file storage.
- Anthropic — AI model processing for generation and analysis.
- Stripe — subscription billing and payment processing.
- Resend — transactional email delivery.
- Render — application hosting and background processing.
- Image and media generation providers — creation of advertising visuals, where enabled.
We maintain an up-to-date list of sub-processors and will provide it on request. We require sub-processors to protect personal data consistent with this policy.
8. Data Retention
We retain personal data for as long as your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer required, we delete or anonymize it. Some records, such as billing and audit logs, are retained for longer periods where required by law.
Where we offer soft deletion, records may be retained in a recoverable state for a limited period before permanent deletion.
9. Data Security
We implement technical and organizational measures designed to protect personal data, including encryption in transit, encrypted storage of sensitive credentials, row-level security for organization-scoped data, role-based access controls, signed URLs for private files, audit logging, and secure secret management. Service-role credentials are never exposed to browsers.
No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee absolute security.
10. International Data Transfers
Promevra and its sub-processors may process personal data in countries other than your own. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses and other lawful transfer mechanisms to protect your data.
For personal information of Quebec residents, we assess privacy-related factors before communicating information outside Quebec, consistent with the requirements of Law 25.
11. Your Privacy Rights
Depending on where you live, you may have rights regarding your personal data, including the right to access, correct, delete, or receive a copy of your data, to object to or restrict certain processing, and to withdraw consent.
Canada (including Quebec)
Promevra is established in the Province of Quebec, Canada. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector, as amended by Law 25. You have the right to access and correct your personal information, to withdraw consent, to be informed about our use of automated processing, and, where applicable, to data portability. You may lodge a complaint with the Commission d’accès à l’information du Québec (CAI) or the Office of the Privacy Commissioner of Canada (OPC).
European Economic Area and United Kingdom
If you are in the EEA or UK, you have rights under the GDPR and UK GDPR, including the rights above and the right to lodge a complaint with your local supervisory authority.
California
If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, correct, and to opt out of the sale or sharing of personal information. As noted above, we do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.
To exercise any of these rights, contact us at privacy@promevra.com. We will verify your request and respond within the timeframes required by applicable law. If your data is controlled by a business customer, we will direct your request to that customer.
13. Children’s Privacy
The Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice. Your continued use of the Services after an update constitutes acceptance of the revised policy.
15. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at privacy@promevra.com. For data protection inquiries, you may also reach our privacy team at dpo@promevra.com.