Privacy Policy

1. What We Collect

When you connect your Meta ad account, we collect and store the following data from the Meta Marketing API:

• Ad account metadata (account name, ID, currency, timezone)
• Campaign, ad set, and ad structure and status
• Performance metrics (spend, impressions, clicks, conversions, ROAS)
• Demographic and platform breakdowns
• Creative assets (ad images and video thumbnails) and ad copy

We also collect your email address and name when you create an account, and the content you create in shmetrics, such as chat messages, messages to teammates, and ad screenshots you upload for analysis.

2. How We Use Your Data

Your data is used to provide shmetrics to you: to display advertising performance in your dashboard and to generate reports, charts, KPI summaries, and creative performance views for you, team members you invite, and report viewers you share a report with.

We also use it to run the service’s AI features: analysing creatives (hooks, styles, beat sheets, briefs and Brand DNA), writing and classifying the findings in your inbox, and answering questions in chat. These features use the AI providers described in section 4.

3. Data Storage & Security

• All data is stored in Supabase (PostgreSQL) with row-level security policies
• Meta access tokens are encrypted at rest using AES-256-GCM
• Creative images are cached in Amazon Web Services (S3) storage
• The service is hosted on Vercel
• All connections use HTTPS

4. AI Providers

Some features send data to AI providers, which process it on our behalf and return a result:

• Anthropic (Claude) and OpenAI (GPT) power creative analysis, briefs, Brand DNA, the written summaries in your inbox, and chat. For these we send ad images, sampled video frames, screenshots you upload, ad copy, and the performance metrics and campaign, ad set and ad names relevant to the request, along with your chat messages.
• typesafe.ai classifies creatives and inbox findings into categories. For this we send text only: written descriptions of creatives, ad copy, and the text and metrics of findings.

We send only what a feature needs for that request. Anthropic and OpenAI state that they do not use data sent through their commercial APIs to train their models by default. AI providers may keep the data for a limited period under their own terms, for example for safety and abuse monitoring.

If you add your own Anthropic or OpenAI API key in Settings, requests for those features are made with your key, through your own account with that provider, and that provider’s terms with you apply.

Automatic creative analysis can be switched off in Settings. Other AI features run when you use them, and the written summaries and classification in your inbox run automatically as part of the service.

5. Third-Party Sharing

We do not sell or rent your data. We share it only with the service providers that run shmetrics on our behalf: Supabase (database and authentication), Amazon Web Services (creative storage), Vercel (hosting), and the AI providers listed in section 4. Within shmetrics, your ad account data is only accessible to you, team members you explicitly invite, and report viewers you share a report with.

6. Data Retention

We retain your data for as long as your account is active. Cached performance data covers up to 37 months of history to match Meta’s reporting window. When you disconnect a Meta account or delete your account, associated data is removed within 30 days.

7. Your Rights

You have the right to:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Disconnect your Meta account at any time via Settings

To exercise these rights or request data deletion, see our Data Deletion page or contact us at the email below.

8. Contact

For privacy-related inquiries, contact us at: privacy@shmetrics.io