Marketing Window is operated by Next Collective LLC, a Wyoming limited liability company ("we", "us"), which is responsible for your personal data as its controller. This policy explains what personal data Marketing Window collects, why we collect it, who we share it with and the choices you have. It covers our website, the app, our creative studio and the public ads in our library, including the people who appear in them. We collect what we need to run your account and make what you order, and we never sell your data.
What we collect
What you give us
- Account details: your email address, and your name and profile picture if you add them or sign in with Google. Also your workspace name, its members and their roles.
- What you do in the app: searches, tracked brands, your swipe file and boards, notes and settings.
- Your orders: your brand kit (logo, colours, fonts, voice, claims, audiences, offers and brand assets), your products and their photos and other files you upload, the briefs and scripts you write, the character you pick, the messages you exchange with our team about an order, and the images and videos we deliver, each with a log of how it was made.
- Product pages you import: when you ask us to fill in a product from its page, the link you give us and what that page says about the product, including its images. We read that one page, once, when you ask.
- Your own character: if you order a character made from photos of a real person, those photos, the character we make, and the consent you give (who the person is, that they agreed, and when). See your own character below.
- Credits: your balance, what you spent credits on, and any packs you buy.
- Billing: once paid plans and credit packs launch, your billing name, address, tax details and payment history. Card details go straight to Stripe. We never see or store your full card number.
- When you sign up: what describes you (a brand, an agency or neither), your website, the brand and competitors you pick, and, if you tell us, how you heard about us and what you're here for. We use these to set up your workspace and to understand which channels bring people to us.
- Your trial: when it started and ends, the plan you chose, and whether you cancelled it.
- Forms and messages: what you send through our contact, newsletter and waitlist forms, and any emails you send us.
What we collect automatically
- Abuse protection: when you sign in or send a form, we store a salted, one-way hash of your IP address, not the address itself. For sign-in we also hash your email address. We use these only to stop spam and abuse.
- Server logs: our hosting provider processes your IP address, browser type and the pages you request so it can deliver the site and keep it secure.
- Cookies: only what's needed to sign you in, plus a few preferences (your theme, and the formats and brands you picked recently). See our cookie policy. We don't use analytics or advertising cookies.
How we use it
- to run your account and the app, and to make and deliver the images and videos you order
- to check what you type and upload, and what we make, for safety
- to send sign-in codes and password resets, news about your orders (received, questions from our team, delivered), credit notices, trial notices (when it starts, 2 days before it ends, and when it ends), and the alerts and digests you set up
- to answer your messages and give support
- to bill you, keep records and meet our tax obligations
- to keep the service secure and prevent abuse
- to improve the product, using aggregated information where we can
- to send our newsletter if you've subscribed (you can unsubscribe at any time)
Legal bases. If you're in the UK, EU or EEA, we rely on:
- contract, to provide the account and the orders you place
- legitimate interests, for security, preventing abuse, improving the product and running our ad library, where your rights don't outweigh those interests
- consent, for the newsletter and any optional cookies we add in future, which you can withdraw at any time
- legal obligation, for tax, accounting and lawful requests
We don't make automated decisions about you that have legal or similar effects. We don't sell personal data or share it for cross-context behavioural advertising.
Who we share it with
We use these service providers. They process data for us under contract.
| Provider | What for |
|---|---|
| Supabase | Database and sign-in. Hosted in the United States. |
| Vercel | Website hosting. |
| Cloudflare R2 | File and media storage, including your uploads and the files you make. |
| Resend | Sending email. |
| OpenAI | AI features: ad tagging, transcripts, the writing help in briefs and brand summaries, and safety checks on what you type and upload. |
| Production tools | The tools our team uses to make your orders, which can include AI image and video tools. We'll name the ones that receive your files here before they do. |
| Trigger.dev | Background jobs, such as collecting ads and processing media. |
| ScrapeCreators | Collecting public ad data. It receives no customer personal data. |
| Stripe | Payments, once paid plans and credit packs launch. |
| Sign-in, only if you choose to sign in with Google. |
- OpenAI. Most of what we send to OpenAI is public ad content. We send your own content, such as a brief, a script or product details, only when you use a feature that needs it, and only the parts that feature needs. We use OpenAI's business API, which under OpenAI's current terms doesn't use this data to train its models.
- Our studio team. Our team, and contractors who work for us under confidentiality obligations, see your orders, briefs, files and messages so they can make what you order. They see only the orders they work on, and only for that purpose.
- Production tools. A tool receives only what the part of an order it's used for needs, such as a product photo or a line of your script, and never a competitor's images or footage. We only use tools that agree not to train on your data.
- We may also share data if the law requires it, to protect people's safety or our rights, or with a buyer if our business is sold. This policy would keep applying to your data.
Your own character
Making a character from photos of a real person uses their likeness, so we handle it with extra care.
- Consent first. Before we accept an order, you confirm that the person is you, or that they've given you written permission to use their likeness in ads, that they're 18 or over and that they're not a public figure. We keep that confirmation, the name you give and the time, with the order.
- Only for your ads. We use the photos only to make that character and the ads you order with it. We don't use them to train AI models, we don't use facial recognition and we don't share the character with anyone else.
- Delete any time. Deleting the character in the app deletes its character sheet, photos and every file that shows them, including the files its order delivered. The person pictured can also ask us to delete it by emailing us.
- How long. We keep the photos you upload while the order is open and the character exists, then delete them. We keep the consent record for as long as we need it to show the likeness was used with permission.
International transfers. Most of our providers are in the United States, so your data may be processed outside your country. For data leaving the UK, EU or EEA, we rely on approved safeguards such as standard contractual clauses. Wherever you live, we take reasonable steps to make sure providers protect it to a comparable standard.
Ad data and sources
This section is for anyone who appears in, or is named in, an ad in our library.
- Where it comes from. Platforms publish ads in public ad libraries for transparency, such as Meta's Ad Library, TikTok's Creative Center, Google's Ads Transparency Center and LinkedIn's Ad Library.
- What we hold. The ad's images, video, text and landing page link; the advertiser's name; the dates, countries and platform where it ran; and tags, transcripts and summaries we generate. If you appear in an ad, this can include your face, voice or name. For Google and YouTube ads, we store the video ID and show YouTube's own player instead of copying the video.
- Why. To run a searchable research archive of public advertising. Our legal basis is legitimate interests. We don't use facial recognition, we don't try to identify the people in ads and we don't build profiles of them.
- Your rights. You can object, or ask us to remove an ad you appear in. Email us, or follow our takedown process. We remove ads within two business days of a complete request while we review it. See takedown requests.
Storage and security
How long we keep it
- Account and app data: for as long as your account is open, then deleted or anonymised within a reasonable period, unless the law requires us to keep it.
- Files we deliver: in your Library while your account is open, until you delete them.
- Order messages: with the order, for as long as your account is open.
- Product page imports: the images we read from a page you import are deleted after a day unless you save them to a product.
- Invoices, billing and credit records: for as long as we need them for tax, accounting and legal reasons.
- Safety checks: the results are kept for 90 days.
- Abuse-protection counters: these hashed counters are cleared after about a day.
- Newsletter: until you unsubscribe. We keep a note that you unsubscribed so we don't email you again.
- Forms and messages: for as long as we need to deal with them, then for a reasonable period after.
- Ads in the library: for as long as they're useful for research, including after they stop running, unless we remove them after a request. We keep a record of every takedown request.
How we protect it
- Each workspace's data is kept separate in our database using row-level security.
- Private files are served through signed links that expire.
- Data is encrypted in transit, and our database and storage providers encrypt it at rest.
- Our team and contractors see only what their role needs.
No system is perfectly secure. If a breach affects your data, we'll tell you, and the regulators, where the law requires.
Your rights
Depending on where you live, you can ask us to:
- give you a copy of your data
- correct it
- delete it
- stop or limit how we use it, or object to it
- send it to you or another service in a portable format
You can withdraw consent at any time, and we won't treat you differently for using your rights. Email us to make a request. We may need to check your identity first. We'll reply within the time the law requires, usually one month.
You can also complain to a privacy regulator, such as the ICO in the UK, your local data protection authority in the EU, the OAIC in Australia, the Privacy Commissioner in New Zealand or the Office of the Privacy Commissioner of Canada. We'd appreciate the chance to help first.
Children and changes
Marketing Window is for businesses and isn't meant for anyone under 18. We don't knowingly collect data from children. If you think a child has given us personal data, email us and we'll delete it.
We'll update this policy when our product or providers change. For significant changes, we'll tell you by email or in the app before they take effect.
Contact
For privacy questions, to use your rights or to ask us to remove an ad, email support@marketingwindow.com.