Privacy Policy
Last updated: March 28, 2026
1. What We Collect
When you create an account, we collect your name, email address, and password. If you subscribe to a paid plan, payment processing is handled by Moyasar. We do not store your credit card number, bank account details, or any sensitive payment information on our servers. Moyasar receives and processes this data directly under their own privacy policy.
When you use the platform, we store the content you create: projects, brand assets (logos, images, videos, fonts, graphics, sounds), library uploads, custom dimensions, and campaign map notes. This content is stored in your workspace and is accessible only to members of your tenant.
We automatically collect basic usage data: pages visited, features used, browser type, device type, and IP address. This helps us understand how the product is used and where to improve it.
2. How We Store Your Data
Your data is stored on Supabase, which runs on Amazon Web Services (AWS) infrastructure. Database records (projects, user profiles, permissions, settings) are stored in PostgreSQL with row-level security ensuring tenant isolation. Files (images, videos, brand assets, exports) are stored in Supabase Storage, organized by tenant ID.
All data is encrypted in transit (TLS/HTTPS) and at rest (AES-256). Database backups are automated and retained according to Supabase's infrastructure policies.
3. Multi-Tenant Isolation
Each workspace (tenant) is fully isolated at the database level using PostgreSQL Row-Level Security (RLS). Users in one tenant cannot query, view, or access data belonging to another tenant. Storage buckets are scoped by tenant ID, ensuring file-level isolation. This applies to all data: projects, brand assets, library images, team members, permissions, and billing information.
4. Who Has Access
Within your workspace, access is controlled by a role-based permission system. Owners have full access. Admins can manage team, content, and settings. Editors can create and edit projects. Viewers can view projects and leave comments. Per-user permission overrides allow fine-grained control beyond role defaults.
We (the platform operators) have access to infrastructure logs and database administration tools for the purpose of maintaining the service, debugging issues, and responding to support requests. We do not access your creative content unless you explicitly ask us to for support purposes.
5. Third-Party Services
We use the following third-party services that may process your data:
- Supabase — database, authentication, file storage
- Moyasar — payment processing, invoicing
- Vercel — application hosting and content delivery
- Google Analytics — anonymized usage analytics (only with your consent)
Each service operates under their own privacy policy and data processing agreements. We do not sell your data to any third party.
6. Cookies
We use essential cookies for authentication (session tokens managed by Supabase Auth). These are required for the platform to function. We do not use advertising cookies or third-party tracking cookies.
We use Google Analytics to understand how the platform is used. Analytics cookies are only loaded after you give explicit consent via the cookie banner. You can decline, and no analytics data will be collected. Your choice is stored locally and can be changed by clearing your browser data.
7. Data Retention
Your data is retained for as long as your account is active. If you cancel your subscription, your workspace data (projects, assets, settings) remains accessible on the free tier. If you delete your account, we will delete your personal data (profile, email, authentication records) within 30 days. Creative content (projects, uploads) created by a deleted user is preserved in the workspace with the creator field set to anonymous, so that team members do not lose work.
8. Your Rights
You have the right to:
- Access your personal data — available through your profile and settings
- Correct inaccurate data — editable through your workspace admin
- Delete your account and personal data — contact support or use the account deletion feature
- Export your data — projects can be exported as images, and we can provide a data export on request
- Object to processing — contact us at the email below
If you are in the European Economic Area (EEA), you have additional rights under GDPR. If you are in California, you have rights under CCPA. We honor all applicable data protection requests regardless of your location.
9. Changes to This Policy
We may update this privacy policy from time to time. If we make significant changes, we will notify you via email or a prominent notice on the platform. The "last updated" date at the top of this page reflects the most recent revision.
10. Contact
If you have questions about this privacy policy or your data, contact us at: