Privacy Policy

1. Data we collect

• Account data: your name and email when you sign up or sign in (including via Google).
• Inputs: images and option selections you upload or choose to generate creative.
• Generated output: the creative we produce for you, and related metadata.
• Connected-platform data (optional): if you connect a third-party account such as Meta (Facebook & Instagram) or Shopify, we collect only the data needed to perform the actions you ask us to take on that platform — see section 4.
• Usage data: basic logs (such as IP address and request times) needed to operate, secure and rate-limit the Service.

2. How we use data

We use your data to provide and improve the Service, generate creative, authenticate you, publish and measure the campaigns you ask us to create on connected platforms, prevent abuse, and communicate with you about your account.

3. Service providers / processors

We share data with vendors who process it on our behalf, including:

• AI model providers (e.g. Google Gemini, OpenAI) to generate creative from your Inputs.
• Authentication and database (Supabase) to manage your account and store generations.
• Hosting (our cloud platform) to run the Service.
• Commerce / ad platforms (e.g. Shopify, Meta) only when you choose to connect them.

We do not sell your personal data, and we do not use data obtained through a connected platform for advertising of our own, to build profiles, or for any purpose other than providing the feature you requested.

4. Connecting your Meta (Facebook & Instagram) account

Connecting Meta is entirely optional and only happens when you click to connect and grant permission through Meta's own authorization screen. When you connect a Meta account so that Tadka can publish and measure ad creative on your behalf, we access — strictly to provide that feature and only for the accounts and Pages you select:

• Your basic profile (name and ID) to show which account is connected (public_profile).
• Your businesses and ad accounts so you can choose where to publish (business_management).
• The Facebook Pages you manage so you can choose which Page your ads run from (pages_show_list, pages_read_engagement).
• Ad campaigns and their delivery metrics (impressions, clicks, CTR, spend) for the campaigns you create through Tadka, to power performance insights and our creative learning loop (ads_read).
• Permission to create and manage campaigns, ad sets and ads that you explicitly ask us to publish — created in a paused state for your review (ads_management).

We act only on your behalf, only on the assets you authorize, and only to carry out actions you request. We never access data belonging to other businesses, and we never post organic content to your Page. Access tokens are encrypted at rest (AES-256-GCM). Our use of information received from Meta complies with the Meta Platform Terms and Developer Policies.

5. AI processing of your inputs

Inputs you submit are sent to third-party AI models to produce Output. Those providers process the data under their own terms; we send only what is needed to fulfill your request.

6. Revoking access and deleting your data

You are always in control of a connected platform:

• Disconnect in Tadka: remove any connected platform from your account settings at any time. This deletes the access tokens we hold for it and stops all further access.
• Revoke from Meta's side: go to Facebook → Settings & privacy → Settings → Business Integrations and remove Tadka. This immediately revokes our access.
• Request deletion: deleting your Tadka account from settings removes your account data and any connected-platform data we stored. You can also email support@tadkai.io with the subject “Data deletion” and we will delete the data we obtained from Meta (and any other connected platform) within 30 days, except where we must retain it to comply with law.

7. Retention

We keep account and generation data for as long as your account is active or as needed to provide the Service, then delete or anonymize it within a reasonable period, unless a longer period is required by law. Connected-platform data is deleted when you disconnect the platform or delete your account, as described in section 6.

8. Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can delete your account and associated data from your account settings, or contact us to exercise these rights.

9. Security

We use reasonable technical and organizational measures to protect your data, including encrypting third-party access tokens at rest. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

10. Cookies

We use a small number of cookies and similar technologies as described in our Cookie Policy.

11. International transfers

Your data may be processed in countries other than your own. Where required, we use appropriate safeguards for such transfers.

12. Children

The Service is not directed to children under the age required by your jurisdiction, and we do not knowingly collect their data.

13. Changes

We may update this policy; we will revise the date above and, for material changes, provide notice.

14. Contact

Privacy questions or requests? Email support@tadkai.io.