Privacy Policy — AdWitch AI Ad Platform

Version 2026-09-14

1. Controller and contact

The controller is Tranquility Psychiatry and Counseling Services LLC, a limited liability company, 100 E Campus View Blvd, Ste 250, Columbus, OH 43235, United States (“AdWitch”, “we”). Contact for privacy and data-protection matters: privacy@adwitch.ai, phone +1 (850) 202-7001. Supervisory authority: the data protection authority of your country of residence (in the EU/EEA, the supervisory authority of your member state; in the UK, the ICO).

2. Data we process

We process:

• Account data: name, email, avatar, locale, team membership, preferences and recorded consent.
• Authentication and security data: password hash, 2FA status and recovery-code hashes, active and past sessions, device/browser label, timestamps, masked IP prefix and approximate country.
• Meta advertising data: OAuth identifiers and encrypted access tokens; connected ad accounts, Pages, campaigns, ad sets, ads, creatives, audiences, performance metrics and actions requested through the Meta Ads API.
• AI conversations: prompts, messages, tool calls, instructions and feedback supplied to the agent.
• Creatives: uploaded or generated images, video, copy and associated metadata.
• Billing: plan, invoices, payment status and transaction evidence. Card details are handled by Stripe.
• Support and communications: requests, emails, Telegram identifiers and notification delivery data.
• Technical data: strictly necessary cookie, service events, audit records and server logs.

We receive data from you, your organisation, Meta through OAuth, login providers, payment providers, and automatically when the service is used.

3. Purposes and legal bases

We also use aggregated, anonymised statistics derived from advertising performance data—for example, percentile distributions of CPM, CTR, CPC and frequency, and the relative effects of typical optimisation actions—to improve the service through benchmarks and recommendations, under our legitimate interests (Art. 6(1)(f)); these statistics are computed only across groups of several unrelated teams, are not personal data, contain no absolute figures for any single team, and cannot be used to recover any individual team’s or account’s figures.

Where we rely on legitimate interests, we balance those interests against your rights. You need not provide optional data, but account, authentication, and connected-ad-account data are necessary for the relevant service.

4. Service providers and disclosures

We disclose only what a provider needs to perform its function. Providers act under contract; Meta and payment providers may also act as independent controllers for their own services.

We may also disclose data when legally required, to protect rights and security, or in a corporate transaction subject to appropriate safeguards. We do not sell personal data.

Additional Meta diagnostics (MCP). A team owner or admin can enable an optional, off-by-default feature that connects Meta’s official Ads MCP Server (mcp.facebook.com) to the AdWitch chat. When it is enabled, our servers call Meta’s MCP server with the access token of one connected ad account that carries the ads_mcp_management permission; the token is sent only to Meta and is not shared with the AI provider or any other third party. Only read-only tools are available (account diagnostics, insights anomalies, benchmarks, Help Center and Ad Library lookups, activity log), and every request is checked against the tool’s declared resource selectors so that it only concerns ad accounts your team has connected — tools that list every account the token can see, tools whose resources cannot be tied to a connected account (catalogs), and every tool that can create or change ads, are excluded. Results are shown in the chat as reference data. Turn the feature off in Ad accounts to stop these requests.

5. International transfers

Some providers process data outside the EEA/UK. Where required, we use adequacy decisions, the EU Standard Contractual Clauses (and UK addendum), supplementary safeguards, or a provider’s valid EU–US Data Privacy Framework certification. Contact us for information about the applicable safeguard.

6. Retention

We delete or anonymise data when no longer needed, subject to these standard periods:

Legal holds and disputes may require longer retention. Backup copies age out through normal rotation.

7. Security

Measures include TLS in transit, password hashing, role-based access controls, encrypted Meta and provider tokens at rest, optional two-factor authentication, one-time recovery codes, account lockout after repeated failures, and an in-product session registry where devices can be reviewed and terminated. No system is completely secure; report suspected compromise immediately.

8. Your rights and choices

Depending on your location, you may request access, correction, portability, deletion, restriction, objection, or withdrawal of consent, and complain to the data protection authority of your country of residence (in the EU/EEA, the supervisory authority of your member state; in the UK, the ICO). You may also challenge solely automated decisions where applicable.

Exercise key rights directly in Profile → Security:

1. choose Export data to receive a portable copy;
2. review or terminate entries under Sessions;
3. choose Delete account and confirm by email.

You may also email privacy@adwitch.ai. We may verify your identity and normally respond within one month.

9. California (CCPA/CPRA)

In the preceding 12 months we may have collected identifiers; customer records; internet/network activity; approximate geolocation; commercial and payment records; professional/account information; audio-visual/creative content; and inferences from campaign and AI usage. Sources, purposes, and recipients are described above.

We do not sell personal information and do not share it for cross-context behavioural advertising, except that website visitors who opt in to marketing cookies allow Meta Pixel to measure our own advertising; you can withdraw this at any time via Cookie settings in the website footer. We do not knowingly use or disclose sensitive personal information beyond permitted service purposes. California residents may request to know/access, correct, delete, or obtain a portable copy and may use an authorised agent. We do not discriminate for exercising rights. Use Profile → Security or email privacy@adwitch.ai.

10. Cookies

The app (app.adwitch.ai) uses only strictly necessary storage: the HttpOnly session cookie and local settings such as language and sidebar state. The website (adwitch.ai) additionally offers optional analytics cookies (Google Analytics 4 / Tag Manager) and marketing cookies (Meta Pixel). These are set only after you opt in through the cookie banner; until then, and after you withdraw consent, the trackers are not loaded. Your choice is stored in the first-party aw_consent cookie for six months and can be changed at any time via Cookie settings in the website footer. Names, providers, purposes and lifetimes are listed in the Cookie Policy.

11. Children

The service is for people aged 18 or older. We do not knowingly collect personal data from children. Contact us if you believe a minor created an account.

12. Changes and version history

We may update this policy and will post the new date/version and give additional notice for material changes where required. Continued use after the effective date is subject to the updated policy.

Questions: privacy@adwitch.ai.