Privacy Policy

1. Data we collect

• Sign-in details. Your email address and, if you add it, your name. You sign in with a one-time code: our database holds only a hash of the code, and it stops working after 10 minutes.
• Organisation and team. The organisations and workspaces you belong to, your role in each, your notification settings, and the email address of anyone you invite or refer.
• Workspace content. What you and your team create: brand notes, chat messages with the AI Marketer, schedules, reports, creatives, campaign briefs, experiments, and feedback you send us from the app.
• Files. Images, videos and documents you upload, files you attach to a chat, generated ad images and saved copies of reports.
• Ad platform data. What we receive from Google Ads and Meta after you connect an account. Sections 2 and 3 list it exactly.
• Activity records. Each suggested change, who approved or declined it and when, what was sent to the ad platform, and how many credits each AI reply used.
• Website events. If you install the Deepvision Pixel on your own site, we receive from your visitors’ browsers the page address, the referring address, the event name with any value and properties you send, and two random IDs (one for the visitor, one for the visit). If your site passes a visitor’s email address or phone number, our server replaces it with a SHA-256 hash before storing it; the plain value is not kept. You decide whether to install the pixel and you are responsible for telling your visitors about it.

We do not collect payment card details: the app takes no payments. We do not store the IP address or browser details of people using the app in our database.

2. Google user data

When you connect Google Ads you sign in with Google and are asked to grant these scopes. We request no others.

• openid: Identifies the Google account you signed in with. We store its account ID with the connection.
• email: Your Google email address. We store it as the name of the connection, so your team can see which Google account is connected.
• profile: Your basic Google profile. We read your name from it only when Google returns no email address, and store nothing else from it.
• https://www.googleapis.com/auth/adwords: Lets us list the Google Ads accounts you can reach, read their campaigns and metrics, and send the changes your workspace approves.

• What we read. The Google Ads accounts your Google account can reach (ID, name, currency, and whether it is a test or manager account). For the accounts you choose to include: campaigns, ad groups and ads (ID, name, status, daily budget) and their daily impressions, clicks, cost, conversions and conversion value, plus cost, clicks and conversions by hour of the week.
• What we write. Only changes a member of your workspace approved, such as creating a campaign, pausing it or changing its daily budget. Each one is recorded in the workspace’s activity log with who approved it.
• What we store. Your Google account ID, your Google email address as the name of the connection, the account list, the synced campaign data, and the refresh token Google issues. The refresh token is encrypted with AES-256-GCM before it is stored and is never shown in the app. We do not store your Google profile picture or any other profile field.
• How we use it. To show your workspace its dashboard and reports, to answer questions you ask the AI Marketer about your accounts, and to prepare suggested changes.
• Who receives it. Only the providers in section 6, which process it for us. We do not sell it, and we do not use it for advertising, retargeting or credit decisions.

Deepvision Ads’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you see in Deepvision Ads.
• We do not transfer it to others except as needed to provide those features, with your consent, for security purposes, to comply with the law, or as part of a merger or acquisition with equivalent protection.
• Our staff do not read it unless you ask us to (for example in a support request), it is necessary for a security investigation, or the law requires it.
• We do not use Google user data to develop, improve or train generalised AI or machine learning models.

To withdraw access, click Disconnect on the Google Ads card under Integrations, or remove Deepvision Ads at myaccount.google.com/permissions. Disconnect deletes the stored token and the account list. Neither step deletes campaign data already synced; section 9 explains how to have that deleted.

3. Meta platform data

When you connect Meta Ads you log in with Facebook and are asked to grant these permissions. We request no others.

• ads_read: Lets us list your ad accounts and read their campaigns, ad sets, ads and insights.
• ads_management: Lets us send the changes your workspace approves: creating a campaign, pausing it, or changing a daily budget.

• What we read. Your Facebook name and app-scoped user ID. The ad accounts you can reach (ID, name, currency). For the accounts you choose to include: campaigns, ad sets and ads (ID, name, status, daily budget, and the address of each ad’s thumbnail image) and their daily impressions, clicks, spend, conversions and purchase value, plus spend, clicks and conversions by hour of the week. Before sending a change we also read whether the ad account has a payment method and whether it has spent anything; we check the answer and do not store it.
• What we write. Only changes a member of your workspace approved, as for Google Ads.
• What we store. Your app-scoped user ID, your Facebook name as the name of the connection, the account list, the synced campaign data, and a long-lived access token, encrypted in the same way as the Google token. Meta sets the token to expire after about 60 days.
• How we use it and who receives it. As described for Google Ads data. We do not sell it or use it to build profiles of people.

Deleting it. Clicking Disconnect on the Meta Ads card deletes the access token and the account list, but leaves the campaign data already synced. To delete that as well, remove Deepvision Ads under Apps and websites in your Facebook settings and ask for your data to be deleted: Meta notifies us, and we delete every connection made with that Facebook account together with its token, account list and synced campaign data. You can also ask us by email. Data deletion has the steps and shows the status of a request.

4. AI features

At present no language model provider is connected to Deepvision Ads: replies from the AI Marketer and draft ad copy are composed by our own software, and nothing you type is sent to a model provider. Before one is connected we will name it here and in section 6.

Suggested changes in your Inbox are worked out from your synced figures by rules in our own software; no model provider is involved. If you give the AI Marketer your website address, we fetch the public home page to draft a description of your business.

5. Where data is stored

• Database. Account data, workspace content, ad platform data, tokens, activity records and website events are stored in a Cloudflare D1 database.
• File store. Uploaded files, chat attachments, generated ad images and saved reports are stored in a Cloudflare R2 bucket. They are served only to signed-in members of the workspace, with one exception: a report you choose to share gets a link that anyone holding it can open until you switch sharing off.
• Location. The database and the file store are located in the Asia-Pacific region (Cloudflare APAC). Cloudflare runs our application in the data centre closest to the person using it, so data passes through, and may be processed in, countries other than Singapore and your own. When personal data leaves Singapore we take steps to ensure it receives protection comparable to the Personal Data Protection Act 2012.

6. Who receives data

• Cloudflare, Inc. Runs the application, the database and the file store, and handles every request to the service, including the IP address it comes from.
• Google and Meta. Receive the requests we make to their APIs for your connected accounts, including the changes you approve. If you use Competitor Ads, the brand names you search for are sent to Meta’s public Ad Library.

We use no advertising, analytics or email delivery provider in the app. We will update this list before another provider handles your data.

7. Cookies and browser storage

The app sets only the cookies below. They are needed for it to work, are not readable by scripts, and are sent only over HTTPS. We set no advertising or analytics cookies.

• dva_session: Keeps you signed in. It holds a signed reference to your user ID and nothing else. Lifetime: 30 days, or until you sign out.
• dva_oauth_google_ads, dva_oauth_meta_ads: Set while you connect an ad account, to check that the reply from Google or Meta belongs to the request you started. Lifetime: 10 minutes, removed as soon as the connection completes.

The Deepvision Pixel sets no cookie. On a site where it is installed it keeps the two random IDs from section 1 in the browser’s local storage (dv_vid and dv_sid), where they stay until the visitor clears their site data. A visit ends after 30 minutes without an event.

8. How long we keep data

• Sign-in code. Valid for 10 minutes and deleted when used. The sign-in cookie lasts 30 days.
• Access tokens and account lists. Until you disconnect the integration, the organisation is deleted, or a deletion request is carried out.
• Synced ad data. Each sync reads the last 30 days. Synced rows are kept until the organisation is deleted or a deletion request is carried out; disconnecting does not remove them.
• Workspace content, files and website events. Until you delete the item, or the organisation is deleted. Website events have no automatic expiry.
• Activity records. For as long as the organisation exists, so that your team can see who approved what.
• Your sign-in profile. Your email address and name are kept until you delete the last organisation you belong to with Delete account, or ask us to delete them. While you still belong to another organisation, Delete account removes your membership of the deleted organisation and keeps your profile. If someone else deletes an organisation you were a member of, your profile stays.
• Deletion request records. The confirmation code, dates and outcome of a deletion request, with a hash in place of the user ID, are kept so that the status can still be shown.
• Logs. We keep no request log of our own. The application writes operational messages (errors, an organisation being deleted) to Cloudflare’s logging for the service; these can contain an email address or internal ID, never a sign-in code or token.

9. Deleting your data

• One integration. Disconnect deletes its token and account list at once. To remove its synced campaign data too, use the Facebook route in section 3 for Meta, or ask us by email.
• Single items. Chats, files, reports, creatives, schedules and brand notes can each be deleted in the app. Deleting a file or report also removes its stored copy.
• A whole organisation. An owner can choose Delete account in the organisation’s settings. This deletes, at once, the organisation’s database records (its workspaces, tokens, synced ad data, content, activity records and website events) and every file its workspaces keep in the file store: uploads, chat attachments, generated ad images and saved reports. What happens to the sign-in profile of the owner (email address and name) depends on whether they belong to another organisation. If they do, the profile is kept: only their membership of the deleted organisation is removed, and they stay signed in with access to the other organisation. If they do not, the profile is deleted too and they are signed out. The profiles of the other members are not deleted; a member can ask us by email.
• By email. Write to hello@deepvision.sg. We complete deletion requests within 30 days and tell you when it is done.

Changes already made in an ad account stay in that account. Data deletion explains each route step by step.

10. Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, withdraw consent, or ask us to delete it. Write to hello@deepvision.sg. If you use Deepvision Ads through your employer or an agency, we may refer your request to the owner of that organisation.

11. Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use Google user data or Meta platform data, we will ask for your consent before it applies to data already collected.