Privacy Policy

Last updated: March 11, 2026

AdPilot ("we," "us," or "our") operates the website adsinfo.co and the AdPilot ad management platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

1.1 Account Information

When you create an AdPilot account, we collect:

• Name
• Email address
• Password (stored as a salted bcrypt hash — we never store plaintext passwords)

1.2 Ad Platform Credentials

To manage your advertising campaigns, you provide:

• Meta (Facebook) Marketing API access tokens and Ad Account IDs
• X (Twitter) Ads API consumer keys, access tokens, and Account IDs

These credentials are encrypted using AES-256-GCM before storage and are used solely to interact with the respective advertising platforms on your behalf.

1.3 Advertising Data

When you connect your ad accounts, we access and display data from those platforms, including:

• Campaign, ad set, and ad performance metrics (impressions, clicks, spend, CPC, CTR)
• Audience demographics and targeting data
• Ad creatives (images, text, headlines)
• Ad delivery status and review feedback

This data is fetched in real-time from the advertising platforms' APIs and is not permanently stored on our servers, except for AI analysis results which are saved to provide ongoing recommendations.

1.4 Usage Data

We collect standard server logs that may include your IP address, browser type, pages visited, and timestamps. This data is used for security monitoring and service reliability.

2. How We Use Your Information

Purpose	Data Used
Account authentication	Email, password hash
Managing your ad campaigns	Ad platform credentials, campaign data
AI-powered campaign analysis	Campaign performance metrics (sent to Moonshot AI for processing)
Competitor intelligence	Public data from Meta Ad Library
Service improvement	Aggregated usage data
Security and abuse prevention	IP address, request logs

3. Third-Party Services

We integrate with the following third-party services to provide our functionality:

• Meta (Facebook) Marketing API — to manage and analyze your Meta ad campaigns. Subject to Meta's Privacy Policy.
• X (Twitter) Ads API — to manage your X advertising campaigns. Subject to X's Privacy Policy.
• Moonshot AI (Kimi K 2.5) — to provide AI-powered campaign analysis and ad generation. Campaign performance data (no personal information) is sent for analysis. Subject to Moonshot AI's Privacy Policy.

We do not sell, rent, or trade your personal information to any third party.

4. Data Security

We implement the following security measures to protect your data:

• AES-256-GCM encryption for all stored API credentials
• Bcrypt password hashing with salt rounds
• HTTPS/TLS encryption for all data in transit
• JWT-based authentication with token expiration
• Rate limiting on authentication and API endpoints
• HTTP security headers via Helmet
• CORS restrictions to authorized origins

5. Data Retention

We retain your data as follows:

• Account data: Retained while your account is active. Deleted upon account deletion request.
• Ad platform credentials: Retained while connected. Removed immediately when you disconnect an account.
• AI analysis results: Retained while your account is active to provide historical insights.
• Server logs: Retained for up to 30 days for security purposes.

6. Your Rights

All Users

Regardless of your location, you have the right to:

• Access your personal data held by us
• Correct inaccurate personal data
• Delete your account and all associated data
• Disconnect your ad platform accounts at any time
• Export your data in a machine-readable format

European Economic Area (GDPR)

If you are in the EEA, you additionally have the right to:

• Object to processing based on legitimate interest
• Restrict processing of your data
• Data portability
• Lodge a complaint with your local supervisory authority

Our legal basis for processing is: (a) contract performance (providing the Service), (b) legitimate interest (security, service improvement), and (c) consent (where specifically requested).

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information is collected and how it is used
• Request deletion of your personal information
• Opt out of the sale of personal information — we do not sell personal information
• Non-discrimination for exercising your privacy rights

7. Cookies and Tracking

AdPilot uses only essential, functional cookies required for authentication (JWT tokens stored in localStorage). We do not use third-party tracking cookies, advertising pixels, or analytics trackers on the AdPilot platform.

8. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will promptly delete that information.

9. International Data Transfers

Our servers are located in the United States. If you are accessing the Service from outside the US, your data will be transferred to and processed in the US. We ensure appropriate safeguards are in place for such transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, contact us at: