Last updated: September 6, 2026
Who we are
AdFrames is operated by Creative Ground Technologies Private Limited, registered at T-Hub Foundation, 1C 831, RAIDURG PANMAKTHA, Madhapur, Hyderabad, Telangana, India 500081. For everything described in this policy we are the controller of your account data, and a processor acting on your instructions when AdFrames reads your Meta catalog and generates creative from it.
Privacy questions, data-subject requests and complaints: privacy@adframes.app. We have not appointed a Data Protection Officer, because AdFrames does not carry out large-scale monitoring or process special-category data; the address above reaches the person accountable for privacy.
What we do not do
Stating this first because it is the question most advertisers ask. AdFrames never touches your customers' personal data. We do not upload, build, read or match custom audiences or lookalike audiences; we do not send or receive hashed emails or phone numbers; we do not use the Facebook Pixel or the Conversions API; and we do not read visitor-level event data of any kind. Every call AdFrames makes to Meta concerns your own business assets: business portfolios, ad accounts, catalogs, product records, creatives and aggregate ad performance.
We do not sell personal data, and we do not share it for cross-context behavioural advertising, with one narrow exception you control: see Your choices below.
What we collect, and why
Account and workspace data
Your email address and password (stored and hashed by Supabase, our authentication provider — AdFrames never sees the password), your name if you give one, your workspace names and websites, who you invite and what role you give them, and your acceptance of these documents. Processed to perform our contract with you.
Security and audit records
Sign-in, permission changes, billing changes, Meta connection changes and administrative actions, each recorded with your IP address, your browser's user-agent string and a request identifier. Processed under our legitimate interest in keeping accounts secure, investigating abuse and resolving disputes.
Meta platform data
Once you connect Meta, and only for the assets you authorise: business portfolio and ad account identifiers and names, catalog identifiers, product records (retailer id, title, price, sale price, currency and image URL), creative and product-set structure, ad delivery status, and — if you grant the permission — aggregate ad performance such as spend, impressions, clicks and return on ad spend. Processed to perform our contract, and handled under Meta's Platform Terms.
Your Meta access token is encrypted with AES-256-GCM before it is stored, kept in a private database schema no application user can read, and never sent to your browser or to the AdFrames Chrome extension. Every Meta API call happens on our servers.
Creative assets and generated images
Frames, badges and fonts you upload are held in private storage and are never publicly readable. The product photographs referenced by your catalog are fetched, composited into new images, and the result is stored in Amazon S3. Those generated images are publicly readable by design — Meta's crawler fetches them anonymously when it ingests your supplementary feed, which is the whole point of the product. Re-encoding strips EXIF metadata, so no camera or GPS information from a source photograph survives into the output.
Billing data
Checkout and the billing portal are hosted entirely by Stripe. Card numbers, CVV codes and expiry dates never reach AdFrames' code or database, which keeps us out of PCI-DSS scope. We store the Stripe customer and subscription identifiers, your plan and its status, and a deliberately trimmed summary of each Stripe webhook — the identifier, type, status and amount, never the full payload. Processed to perform our contract and to meet our legal obligations around accounting records.
Support conversations
If you press the Help button, our chat loads HubSpot and we receive whatever you send us: your messages, any files you attach, and the name and email address you give the widget. HubSpot also records which pages you visit on this site while the widget is loaded, so we can see what you were looking at when you asked.
None of that happens until you press the button — HubSpot is not loaded on page load anywhere on this site, including inside the product — and the first press asks you to confirm. We process these conversations to perform our contract with you and on the basis of our legitimate interest in supporting the people who use AdFrames. If you would rather load nothing, email support@adframes.app instead and it reaches the same place.
Please do not paste passwords, API keys or Meta access tokens into chat. We will never ask for them, and we cannot support an account whose credentials have been sent over a third-party channel without asking you to rotate them first.
Website analytics
Described in full in our Cookie Policy. In short: Microsoft Clarity records a replay of your visit on our public pages, and runs only if you opt in. Vercel Web Analytics counts page views without cookies and without any identifier that could single you out.
Who else sees your data
Our sub-processors, each of which is contractually limited to processing data on our instructions. The full register, with what each receives and where, is at adframes.app/subprocessors. In summary: Supabase, Vercel, Amazon Web Services (S3), Stripe, Resend, Microsoft (Clarity), HubSpot, Meta Platforms.
We may also disclose information where we are legally required to, or where it is necessary to establish, exercise or defend legal claims. If AdFrames is acquired, your data would transfer to the acquirer under this same policy; we would tell you before that happened.
Where your data is processed
AdFrames is operated from India and its infrastructure is hosted primarily in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, that means your personal data is transferred outside your jurisdiction. Those transfers rely on the Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) that each of our sub-processors incorporates into its data processing agreement, together with the encryption and access controls described below. We do not currently offer a region-pinned deployment; if your organisation requires EU-only storage, contact us before subscribing.
How long we keep it
These windows are enforced by an automated nightly job, not by intention. Anything past its window is deleted without anyone asking.
| Data | Kept for | Why that long |
|---|---|---|
| Security and audit records (including IP address and user agent) | 2 years | Kept for two years so account takeover, billing disputes and support escalations can still be investigated after the fact. Retained on the basis of our legitimate interest in the security of the service. |
| Server error reports | 90 days | Long enough to see whether a bug is recurring, short enough that a redacted stack trace does not sit in the database for years. |
| Cached Meta ad performance (spend, impressions, clicks, ROAS) | 1.1 years | Thirteen months, so a year-on-year comparison is possible and no longer. Meta Platform Terms require cached platform data to be deleted once it is no longer needed for the authorised purpose. |
| Workspace invitations that were accepted, revoked or left to expire | 90 days | An invitation row holds an invitee’s email address for a purpose that ended when the invitation did. Ninety days covers the "who invited whom" support question, then it goes. |
| OAuth handshake records | 7 days | Single-use values with a lifetime measured in minutes; the week is only so a failed connection can still be debugged. |
| Expired and revoked browser-extension tokens | 30 days | Only hashes are ever stored. The month exists so a device-revocation report can still show what was revoked. |
| Generated images replaced by a newer version of the same design | 30 days | Once a design is re-approved the old images stop appearing in the feed. Thirty days is the window in which Meta may still be serving a cached copy; after that the objects are deleted from storage. |
| Workspaces that were deleted from the app | 30 days | A grace period for accidental deletion. After it, the workspace and everything scoped to it — generated images included — are erased. |
Support conversations are the exception to the table above, and we would rather say so than imply otherwise: they live in HubSpot, not in our database, so the nightly job cannot reach them. We keep them for as long as they are useful for supporting you and for two years after your last message, so a recurring problem still has its history. Ask us at privacy@adframes.app and we will delete a conversation sooner. Deleting your account does not reach into HubSpot automatically — tell us you want your chat history erased along with it and we will remove it there by hand within thirty days.
Account, workspace and catalog configuration is kept for as long as your account is open. Invoices and payment records are kept for as long as tax and accounting law requires, which in most jurisdictions is six to ten years — a deletion request does not override a statutory retention obligation, and we will tell you when that is the reason something is retained.
Your rights
Wherever you are, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or take it elsewhere in a machine-readable form. Two of these you can exercise yourself, immediately, without contacting anyone:
- Download your data. Account settings → Your data → Download my data. Returns a JSON file covering your profile, workspaces, Meta configuration, generated creative records and your account activity log.
- Delete your account. Account settings → Your data → Delete my account. This erases your account, the workspaces you own, the images generated from your catalogs, your uploaded frames and fonts, and your activity log — and revokes AdFrames' access at Meta rather than merely forgetting the token. There is a 7-day grace period during which you can cancel, and we email you when the request is made and again when it completes.
For anything else — correction, restriction, objection, or a request on behalf of someone else — write to privacy@adframes.app. We acknowledge within 10 business days and respond within one month, which we may extend by a further two months for complex requests, telling you why. We do not charge for these requests and we will not treat you differently for making one. We verify a request by confirming control of the account email address; we may ask for more where a request is made on someone else's behalf.
Step-by-step instructions, including for Meta-connected data, are on our User Data Deletion page.
If you are in the EEA, the UK or Switzerland
Our legal bases are named against each category above. Where we rely on legitimate interests you may object at any time. You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office; in the EEA, the authority for your country of residence — and we would ask that you raise it with us first so we can try to put it right.
If you are in California
In the twelve months before the date of this policy we collected the categories described above: identifiers (name, email, IP address), commercial information (plan, subscription and billing status), internet activity (site usage, and session replay where you opted in), and professional information (your business, catalog and ad account details). We collect them for the business purposes described above, from you and from Meta at your direction, and we disclose them to the service providers listed in our sub-processor register.
We do not sell personal information for money. Microsoft Clarity may use what it collects for its own product improvement and advertising, which California treats as "sharing" — so you have the right to opt out, and Clarity does not run at all unless you opt in first. You can change that decision at any time here: . We honour Global Privacy Control signals automatically. You have the rights to know, delete, correct, and to non-discrimination, exercisable as described above; an authorised agent may act for you with written permission. We do not knowingly sell or share the personal information of anyone under 16.
If you are in Brazil, Canada, Australia or India
Brazil (LGPD). You may confirm processing, access, correct, anonymise, port or delete your data, withdraw consent, and ask who we have shared it with. Contact privacy@adframes.app, which also serves as our data-protection contact for LGPD purposes. International transfers rely on the standard contractual clauses referenced above.
Canada (PIPEDA). We collect, use and disclose personal information for the purposes stated here and no others without your consent, which you may withdraw subject to legal and contractual limits. You may challenge our compliance by writing to the address above, and escalate to the Office of the Privacy Commissioner of Canada. If a breach creates a real risk of significant harm we will report it to the OPC and notify you.
Australia (Privacy Act / APPs). You may access and correct your personal information as described above, and complain to us and then to the Office of the Australian Information Commissioner. Eligible data breaches are notified under the Notifiable Data Breaches scheme. We do not use personal information for direct marketing.
India (DPDP Act). As a Data Fiduciary we process personal data for the lawful purpose of providing AdFrames, on the basis of the consent you give at signup and in the consent banner. You may access, correct, complete, update and erase your data, nominate another person to exercise your rights, and raise a grievance with us at privacy@adframes.app before approaching the Data Protection Board of India.
Your choices
- Cookies and session replay. Nothing non-essential loads until you opt in. Change your decision at any time: .
- Meta. Disconnect from inside AdFrames (Brand setup → Disconnect Meta), which revokes our access at Meta and deletes the stored token, or remove AdFrames from Facebook Settings → Apps and Websites.
- Email. Everything we send is transactional — invites, security notices, billing and privacy confirmations. We operate no marketing list, so there is nothing to unsubscribe from.
Security
Access tokens are encrypted at rest with AES-256-GCM. Database access is scoped per workspace by row-level security, so one customer's query cannot reach another's rows. Uploaded assets live in a private bucket reachable only through short-lived signed URLs. Staff access to customer data is restricted by role and every such view is itself recorded in the audit trail. Error reports are stripped of credentials before they are stored. No service can promise absolute security, and we will notify you and the relevant regulator without undue delay — within 72 hours where GDPR applies — if a breach affects your data.
Children
AdFrames is a business tool and is not directed at children. You must be at least 16 to hold an account, and we ask you to confirm that at signup. We do not knowingly collect data from anyone younger; if you believe we have, write to privacy@adframes.app and we will delete it.
Automated decision-making
AdFrames makes no automated decision that produces a legal or similarly significant effect on anyone. Image generation is deterministic: it draws the design you approved over the products in the set you chose. No artificial-intelligence or machine-learning model is used anywhere in the product, and no customer data is used to train one.
Changes to this policy
We will update the date at the top when this policy changes, and we will tell account holders by email before any change that materially reduces your rights takes effect.
Contact
Privacy and data-subject requests: privacy@adframes.app. Everything else: support@adframes.app.
Website: https://adframes.app
Legal entity: Creative Ground Technologies Private Limited
Registered address: T-Hub Foundation, 1C 831, RAIDURG PANMAKTHA, Madhapur, Hyderabad, Telangana, India 500081