Privacy Policy

MrX Innovation Lab Pvt Ltd ("we", "us", "our") operates OnPromptAds Brands at https://brands.onpromptads.com/ (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service, including when you connect Meta (Facebook/Instagram), Google, or other third-party accounts.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

If you use our Chrome extension OnPromptAds Ad Spy, see also the dedicated Ad Spy Privacy Policy at https://brands.onpromptads.com/ad-spy/privacy/, which describes extension-specific data practices in more detail.

OnPromptAds Ad Spy is a Chrome extension that helps you research creatives in Meta Ad Library and open Remix in OnPromptAds Brands. The extension may process a local install ID and settings, Ad Library creative metadata you view, usage events, IP address and similar technical data, and optional visible Facebook profile signals shown on the Ad Library page. It does not collect your Facebook password or Meta access tokens.

Full details, retention, and rights requests for Ad Spy are in the Ad Spy Privacy Policy: https://brands.onpromptads.com/ad-spy/privacy/. When you sign in to Brands or use Remix and other Brands features, this Brands Privacy Policy also applies.

If you connect a Shopify store and enable Ads features, we receive order data from Shopify (order id, totals, payment and fulfillment status, refunds, UTM parameters and landing page). We use it only to attribute sales to your own ad campaigns and to calculate profit metrics such as ROAS after returns.

Customer email, phone number and Shopify customer id are converted to SHA-256 hashes the moment an order reaches our servers. We store only these hashes, never the raw values, and send them only to your own Meta dataset through the Meta Conversions API (Purchase, Delivered and Return to Origin events) when you turn that feature on. We do not request customer names or addresses.

When Shopify sends a customer redaction request we delete the stored hashes for that customer. When a store uninstalls the app and Shopify sends a shop redaction request we delete all order data for that store. Order data is retained for up to 13 months for reporting.

If you connect a Meta ad account, we read campaign performance data and, only with your approval or within the automation limits you configure, create campaigns, change budgets and pause ads in that account. Every change is logged and can be reverted from your dashboard.

You can connect third-party AI assistants such as Claude, ChatGPT, Gemini, Cursor or Grok to the Service through our Model Context Protocol (MCP) server at https://mcp.brands.onpromptads.com/mcp. A connection is only created after you sign in and approve it on our consent screen, where you choose the workspace, the brand, the permissions the assistant receives, a daily credit limit and a daily ad budget cap. An assistant never receives more access than your own role in the workspace allows.

When you use a connected assistant, the assistant provider sends us the tool requests it makes on your behalf, and we return the data needed to complete them, such as brand details, product catalog entries, prompts, generated media links, social post status and ad performance. That data is then processed by the assistant provider under its own terms and privacy policy. We do not control how the assistant provider stores or uses conversation content.

We store the assistant's registered name and redirect address, the permissions and limits you approved, and access and refresh tokens. Tokens are stored only as one-way SHA-256 hashes. Access tokens expire after one hour and refresh tokens after 60 days of inactivity. We keep a log of each tool call (tool name, time, brand, success or error, a short summary of the result and estimated credits) so you can review activity; this log is deleted automatically after 180 days.

Publishing to social accounts, changing your Shopify store and any change that can spend ad budget always require a preview and a second, confirmed request. You can review activity and disconnect any assistant at any time from Settings in your workspace. Disconnecting immediately revokes all tokens for that connection.

We collect information in the following categories:

• Account information: name, email address, profile photo (when provided via Google OAuth), organization membership, and role.
• Organization and brand data: organization name, brand profiles, product catalogs, prompt libraries, team members, and activity logs.
• Content you create: AI generation inputs and outputs, uploaded media, ad copy, social posts, and scheduling data.
• Meta/Facebook/Instagram data (when you connect): Page and Instagram Business account IDs, names, profile pictures, access tokens (encrypted at rest), posts, comments, direct messages, ad account details, campaign data, lead form submissions, and analytics/insights as permitted by the permissions you grant.
• Usage data: log files, IP address, browser type, device information, pages visited, and feature usage for security and product improvement.
• Payment data: billing details are processed by Razorpay or PayPal. We do not store full card numbers on our servers.
• Communications: messages you send through contact forms, support requests, and demo inquiries.
• Store demo submissions: when you paste a store URL into the public demo, we store the domain, brand details we extract, product counts, niche, social handles, public email if available, source page, UTM parameters, and generated preview results. We may use this information to contact the business about the Service. Agency-page demo runs are excluded from outreach lists.
• Marketing cookies: with your consent, we may load a Meta pixel so we can show retargeting ads to people who ran a demo but did not sign up (for example, that their ads are still waiting). You can decline marketing cookies in the banner on our site.

We use collected information to:

• Provide, operate, and maintain the Service, including AI content generation, social publishing, scheduling, inbox management, and Meta Ads management.
• Authenticate users and enforce organization-level access controls.
• Publish content to connected Facebook Pages and Instagram accounts on your instructions.
• Retrieve analytics, manage ad campaigns, and process lead form data from Meta on your behalf.
• Send service-related notifications, security alerts, and support responses.
• Improve the Service, troubleshoot issues, and develop new features.
• Comply with legal obligations and enforce our Terms of Service.

When you connect a Meta Business Portfolio, we receive data through the Meta Graph API according to the permissions you approve. This may include Page and Instagram account information, media, engagement data, messaging content, advertising data, and insights.

We use Meta platform data solely to provide the features you request within OnPromptAds Brands, such as publishing posts, viewing analytics, managing ads, responding to messages, and retrieving leads. We do not sell Meta platform data. We do not use Meta platform data to build unrelated user profiles or for advertising outside your organization's use of the Service.

You can disconnect Meta at any time from Social > Connections within your brand workspace. Disconnecting revokes our access to your Meta tokens and stops future data collection from Meta. See our Data Deletion page for full removal instructions.

Where applicable under GDPR, we process personal data based on: (a) performance of a contract with you or your organization; (b) legitimate interests in operating a secure B2B SaaS platform; (c) your consent where required (such as optional marketing emails); and (d) compliance with legal obligations.

We do not sell your personal information. We may share information with:

• Service providers (subprocessors) who help us operate the Service, listed on our Security page and in our DPA.
• Meta Platforms, Inc. when you use Meta-connected features, subject to Meta's terms and your authorization.
• Google when you sign in with Google OAuth, subject to Google's policies.
• Other members of your organization according to your assigned role and permissions.
• Law enforcement or regulators when required by law or to protect rights and safety.
• A successor entity in connection with a merger, acquisition, or asset sale, with notice where required.

We retain account and organization data for as long as your account is active or as needed to provide the Service. Meta tokens and social data are deleted or anonymized when you disconnect an integration or delete a brand. Generation history, audit logs, and backups may be retained for a limited period for security, billing, and legal compliance before deletion.

You may request deletion of your account and associated data at any time. See https://brands.onpromptads.com/data-deletion/ for instructions.

We implement administrative, technical, and organizational measures including TLS encryption in transit, encryption at rest for sensitive tokens, tenant isolation by organization ID, and access controls. Details are available at https://brands.onpromptads.com/security/.

Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also withdraw consent where processing is consent-based.

To exercise these rights, email [email protected] or use the data deletion instructions at https://brands.onpromptads.com/data-deletion/. We will respond within the timeframe required by applicable law.

We may process and store information in India, the United States, and other countries where our subprocessors operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

The Service is intended for business users aged 18 and older. We do not knowingly collect personal information from children under 16.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Material changes may be communicated by email or in-app notice.

MrX Innovation Lab Pvt Ltd Email: [email protected] Website: https://brands.onpromptads.com/