Privacy policyPrivacypolicy

When you and the people you invite use Adzi, we hold:

• Your account: your name, your email address, whether it is verified, and whether a second factor is on. If you sign in with Google, the link to your Google account and the email, name and profile scope it gives us; we do not keep your profile photo.
• Your phone: the number you verify at sign-up, its country, the channel the code went by (WhatsApp, Telegram or SMS), and the attempts made to verify it or to pass the second factor, which expire after ten minutes.
• Your sessions: a token, the device and browser you signed in from, your IP address where our hosting passes it on, and when the session was created, last used and expires. Settings shows this list and lets you end any session.
• Your workspace: its name, logo, settings such as report colours and fonts, the members and their roles, and invitations with the invitee’s email and who sent them.
• What happens in the workspace: an activity log of changes made by you, your team and Adzi, with who made each one and when. It is kept as a record and cannot be edited.
• What you ask Adzi: your messages in a report conversation, Adzi’s replies, the report’s versions, and any thumbs up or down you give with the reason you pick. We also record each AI call’s size and cost for your workspace’s usage page.
• The people you add: email addresses for alerts and scheduled reports, and names and WhatsApp numbers for client messages, with any opt-out they send.
• What you upload: your workspace’s and clients’ logos, and creative files for campaigns you draft, including files you import from a public Google Drive link.
• Share links you create and when they were last opened, and the Meta and Slack identity of the person who connected each account.
• Technical logs of requests to Adzi, with the IP address and the path, and never a token, a code or a phone number.

Once you connect a client, Adzi reads and keeps:

• From Meta: the ad account’s name, currency and time zone, its business, its balance and funding, its campaigns, ad sets and ads with their names, statuses and budgets, their daily figures (spend, impressions, clicks, purchases, purchase value, video and engagement) and breakdowns by age, gender, placement, platform and country, and a small private copy of the image of each ad that spent recently.
• From Shopify: order facts (dates, currencies, lines, units, money, refunds and returns), products and their pictures, collections, stock, locations, costs and discounts, and figures such as new against returning customers and conversion rate as totals. Never a customer’s name, email, phone, address, IP address or browsing journey: Adzi does not ask for them and does not keep them.
• From Slack: the workspace and channel names and identifiers Adzi posts to, and who installed Adzi there. So that a critical alert can mention someone, Adzi asks Slack for the workspace’s members and user groups when an owner or an admin opens the list to choose one. Of what Slack sends, Adzi keeps only each name and Slack identifier and discards the rest at once: no email address, phone number, picture or other profile detail. It leaves out bots, deactivated accounts and guests. The list is held in memory for at most ten minutes and is never saved. Adzi keeps only the person or group you choose: their Slack identifier and their name as it was that day, until you choose another, remove the client, or Adzi finds that its access to Slack has ended. Adzi never reads messages.
• The access credentials each platform gives us, which we keep encrypted.

From you and your team as you use Adzi; from Meta, Shopify and Slack through the connections you authorise; from Google when you sign in with it or import from Drive; and from our messaging provider’s delivery receipts for the codes and messages Adzi sends.

We use this data to:

• provide Adzi: sign you in, sync your clients, show their figures, run the four alerts, build and send reports, and post to Slack;
• keep Adzi and your data secure: verify your phone, run the second factor, show your sessions, limit abuse, and keep the activity log;
• support you when you write to us;
• improve Adzi, which includes members of our team reading conversations with Adzi and the ratings you give, to see where it answered badly;
• meet our legal duties and enforce our terms.

Where the law asks for a legal basis, ours is the agreement we have with you for providing the service, our legitimate interest in keeping it secure and making it better, and your consent where the law requires it. We do not sell your data and we do not use it for advertising.

Reports are built with an AI model from OpenAI. For each request Adzi sends the model your message as you typed it, the client’s name, the names of its campaigns, ad sets, ads and products, the figures the model asks for, the report’s current outline and the conversation so far. Where a workspace has AI help in the campaign builder switched on, the draft’s text is sent the same way. We send these with the provider’s storage turned off, and we do not use your data to train models. A report’s figures come from the data itself; the model only writes the sentences around them.

OpenAI is the only AI provider Adzi uses today. If we add another, we will name it here and in section 6 before it processes anything of yours.

Adzi runs on services from other companies, which process data on our behalf:

• Render (Frankfurt, Germany) hosts Adzi, its database and its queue, so it holds everything above.
• OpenAI (United States) receives what section 5 describes, for reports and, where switched on, the campaign builder.
• Brevo (European Union) sends Adzi’s emails: sign-in codes, invitations, “your client is ready”, alerts and scheduled reports, with the recipient’s address and the report or figures.
• Akedly sends the verification and second-factor codes to your phone and, where a workspace uses it, WhatsApp messages to the client numbers you add, with the message’s figures and link.
• Cloudinary (United States) stores logos, the private copies of ad and product images, and uploaded creative files.
• Google provides sign-in, Drive import and, where it is switched on, the map in the campaign builder, each under Google’s own terms.
• Slack, Meta and Shopify receive what Adzi posts or asks for under the permissions you grant them.
• Sentry (United States) receives error reports from Adzi’s background worker, with no credentials, customer data or platform payloads.

Your data is also seen by the members of your workspace according to their roles, by the recipients you add, and by anyone you give a report link to. We share data with authorities when the law requires it, and with a buyer or successor if Adzi changes hands, in which case we will tell you.

Data from Meta is used only to provide Adzi to you, under Meta’s Platform Terms, and is deleted when you remove the client or ask us to (section 13).

For Shopify, Adzi subscribes to the store’s privacy webhooks: a request to erase a customer or a store is applied automatically, and a customer’s data request is answered within the 30 days Shopify allows, which in Adzi’s case confirms that no customer identity is held.

In Slack, Adzi posts and reads the names of members and user groups so that you can choose who a critical alert mentions; it never reads messages. On WhatsApp, Adzi only sends messages through templates the platform has approved, and honours a recipient who replies to stop.

Adzi sets a few cookies, all for signing in and none for tracking:

• a session cookie that keeps you signed in for seven days, extended as you use Adzi, which scripts cannot read;
• a ten-minute cookie while a second-factor code is pending;
• short-lived cookies that tie a Meta, Shopify or Slack connection to the browser that started it.

Adzi keeps a few preferences in your browser’s own storage, such as whether the sidebar is collapsed, your column choices and an unsent campaign draft. Adzi has no analytics, advertising or tracking cookies and loads no analytics or advertising scripts. The one script from another company is Google’s map in the campaign builder, which loads when a workspace has the map switched on and sends Google the request as any map does. Shared report pages send no referrer and ask search engines not to index them.

We keep data only as long as it does its job:

• a client’s dated figures from Meta and Shopify: today and the 94 days before it; older dates fetched for a report for about seven days after they were last read;
• conversations with Adzi and their ratings: 90 days after the conversation ends; the delivery log of sent reports: 90 days;
• share links: until they expire, after 7, 30 or 90 days, or you revoke them;
• creative files for campaigns: seven days after nothing refers to them; WhatsApp alert sends: 30 days;
• the person or user group a critical alert mentions in Slack: until you choose another, remove the client, or Adzi finds that its access to Slack has ended;
• sessions: until they expire or you end them; verification attempts: ten minutes;
• your account and your workspace: while they exist, and up to 30 days after you ask us to delete them;
• the activity log: for the life of the workspace, and a removed client’s name stays in the entries that mention it;
• records of AI use: as accounting records for the workspace.

Platform credentials are encrypted at rest with keys we rotate, and are never shown in Adzi or written to logs. There are no passwords to steal: sign-in is a code to your email or Google, with an optional second factor to your phone. You can see every session and end it. Roles decide who sees which client. The activity log cannot be changed. Logs and error reports carry no credentials, customer data or platform payloads.

No system is perfectly secure. If you believe your account or a client’s data has been exposed, write to info@adzi.io at once.

Adzi and its database run in Frankfurt, Germany. Some of the companies in section 6 process data in the United States under their own terms and safeguards for international transfers.

Where the law gives you rights over your personal data, you can ask us to access, correct, export, delete or restrict it, or object to how we use it, by writing to info@adzi.io from the address on your account. We answer within 30 days. A workspace’s owner can act for the workspace. You can also change your name, logo and settings in Adzi, end sessions, and remove members, clients and connections yourself. If you believe we have not handled your data properly, you can complain to the data protection authority where you live.

To delete your account or your whole workspace, email info@adzi.io from the account’s email address and say which. We complete the deletion within 30 days and confirm it to you. What goes: your account, the workspace, its members and invitations, its clients, their synced data, the platform credentials, the conversations, reports, share links and uploads. What stays: entries in the activity log that record what happened, records of AI use kept as accounting records, and anything the law requires us to keep.

To delete one client’s data, including everything Adzi read from Meta or Shopify for it, remove the client in Settings. Adzi deletes its records, its synced data and the credentials nothing else uses, and removes the image copies in the next cleanup. This does not revoke Adzi’s access on the platform, which you do in Meta or Shopify.

Adzi is for businesses and is not for anyone under 18. We do not knowingly collect data from children; if you think we have, write to us and we will delete it.

We may change this policy. We post the new version here with a new effective date and, for a change that matters to you, we tell you by email or in Adzi before it applies.

Privacy requests go to info@adzi.io and everything else to support@adzi.io. Our registered address is 19th floor, Northern Tower, Nile City Towers, Cairo, Egypt.