Privacy Policy

This Privacy Policy explains what personal data we collect when you use d2cinsight, why we collect it, how we protect it, and the choices and rights you have. It includes specific detail about the data we access through the Meta (Facebook) Marketing API when you connect your own Meta Ads account.

1. Who we are

d2cinsight (ConsumableAI) is an ad-creative-intelligence SaaS product (“we”, “us”, “our”).

For the purposes of the EU/UK General Data Protection Regulation (GDPR), we are the data controller of the personal data described in this policy (and, under India’s Digital Personal Data Protection Act, 2023, the Data Fiduciary). Where we process ad data on your behalf as part of providing the service, we act as your data processor for that data.

• Product: https://d2cinsight.com
• Privacy & grievance contact: contact@consumableai.com

2. Data we collect

We collect two broad categories of data: (a) account and usage data you give us directly or that is generated when you use d2cinsight, and (b) data we access from Meta (Facebook) when you choose to connect your own Meta Ads account.

2a. Account and usage data

• Account details you provide when you sign up, such as your name, email address, and password credentials (stored in hashed form).
• Workspace information, such as your organization name and the settings you configure.
• Usage and device data generated automatically when you use the product, such as log data, IP address, browser type, pages viewed, and actions taken, used to operate, secure, and improve the service.
• Content you upload, such as ad creatives and files you add to your workspace for analysis.
• Support communications you send to us.

2b. Meta (Facebook) data

When you choose to connect your Meta (Facebook) Ads account, you sign in through Facebook Login (OAuth) and grant d2cinsight the ads_read and public_profile permissions. This connection is strictly read-only. We never create, edit, pause, or delete campaigns, and we never post anything to Meta on your behalf.

Through the Meta Marketing API, and only for the ad accounts belonging to the person who connects, we read:

• Your Meta user ID and name (via public_profile) — used only to label the connection so you can see which account is linked.
• Your list of ad accounts — including each account’s ID, name, currency, and status.
• Your ads and creatives — including images, video thumbnails, and ad copy / headlines.
• Your ad-level performance metrics — including spend, impressions, clicks, CTR, CPM, CPC, frequency, purchases, ROAS, and 3-second / ThruPlay video view rates.

We only ever access your own ad accounts and their data. We do not access other people’s ad accounts, and we do not use Meta data to build profiles of any individual.

3. How and why we use your data

We use your data to provide and operate d2cinsight:

• To provide the core service. We import your own ads and their performance into your d2cinsight workspace, download the associated creative files, run automated creative analysis and neural scoring on them, and show the results back to you.
• To label your connection, using your Meta user ID and name so you can identify the linked account.
• To operate, secure, and improve the product, including troubleshooting, preventing abuse, and maintaining reliability.
• To communicate with you about your account, service changes, and support requests.
• To meet legal and regulatory obligations.

4. Legal bases for processing (GDPR)

Where GDPR applies, we rely on the following legal bases:

• Performance of a contract (Article 6(1)(b)) — to create and manage your account and to deliver the analysis service you have signed up for, including importing and analyzing your own ads.
• Consent (Article 6(1)(a)) — for connecting your Meta Ads account through Facebook Login. You give this consent through Meta’s OAuth screen, and you can withdraw it at any time by disconnecting the account (see Section 8). Withdrawing consent does not affect processing carried out before withdrawal.
• Legitimate interests (Article 6(1)(f)) — to secure our systems, prevent fraud and abuse, and improve the product, balanced against your rights and freedoms.
• Legal obligation (Article 6(1)(c)) — where we must process data to comply with the law.

5. Storage and security

• Your Meta access token is encrypted at rest (AES encryption via Fernet) and is scoped to your workspace so it is only usable to serve your own account.
• Imported ad data, creative files, and computed scores are stored on Google Cloud (Google Cloud Platform), in data centres located in the United States.
• We apply technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and scoping of data to the owning workspace.

No system is perfectly secure, but we work to protect your data against unauthorized access, loss, or misuse.

6. Who we share data with (sub-processors)

We do not sell your personal data. We share it only with service providers (“sub-processors”) that help us run d2cinsight, and only to the extent needed to provide the service. Each is bound by contractual data-protection obligations.

Keeping this list current is our responsibility; if we add or change a sub-processor that handles personal data, we will update this page.

7. Retention

• We retain your account data and imported Meta data (ads, creatives, and computed scores) for as long as your account is active.
• When you disconnect your Meta account, we delete the stored access token promptly (see Section 8).
• When you close your account, or request deletion of your imported Meta data, we delete that data within 30 days. Residual copies held in encrypted backups are purged within a further 90 days as those backups rotate.
• We may retain limited records where we are legally required to do so.

8. Your rights and choices

Disconnecting your Meta account

You can disconnect your Meta (Facebook) Ads account at any time using the Disconnect button in the app. This deletes the stored Meta access token. Full instructions, including how to request deletion of imported data, are on our dedicated Data Deletion page.

GDPR rights (EU / UK users)

Subject to legal conditions, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability — receive your data in a structured, commonly used, machine-readable format;
• withdraw consent at any time (for example, by disconnecting your Meta account);
• lodge a complaint with your local data protection authority.

India (Digital Personal Data Protection Act, 2023)

If you are in India, you have the right to access, correct, update, and erase your personal data, to nominate another person to exercise your rights, and to raise a grievance about how we handle your data. To exercise these rights or raise a grievance, contact our Grievance Officer at contact@consumableai.com.

California rights (CCPA / CPRA)

If you are a California resident, you have the right to:

• know what personal information we collect and how we use it;
• access and delete your personal information;
• correct inaccurate personal information;
• opt out of the “sale” or “sharing” of personal information.

We do not sell or share your personal information, and we do not sell or share Meta data, so there is nothing to opt out of. We will not discriminate against you for exercising your rights.

To exercise any of these rights, email contact@consumableai.com. We will verify your request and respond within the timeframes required by law.

9. International data transfers

We are based in India, and we and our sub-processors process data in India and in other countries, including the United States. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), together with additional measures where needed. Personal data of users in India is handled in accordance with India’s Digital Personal Data Protection Act, 2023.

10. Children

d2cinsight is a business product and is not directed to children. We do not knowingly collect personal data from anyone under 18.

11. Compliance with Meta Platform Terms

Our use of information received through the Meta (Facebook) APIs adheres to the Meta Platform Terms and Developer Policies, including their limited-use and data-handling requirements. In particular:

• We access Meta data only with your explicit authorization through Facebook Login, and only for your own ad accounts.
• We use Meta data solely to provide the analysis features to the user who connected the account.
• We do not sell Meta data, do not use it for advertising, and do not build cross-user profiles from it.
• We delete Meta data when you disconnect or request deletion, as described in this policy and on our Data Deletion page.

12. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to run d2cinsight — for example, to keep you signed in and to serve your media securely. Our hosting provider (Vercel) may also collect aggregate, privacy-preserving usage analytics. We do not use advertising or cross-site tracking cookies.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above and, where changes are material, notify you through the product or by email.

14. Contact us

If you have questions about this policy or want to exercise your rights, contact us at:

d2cinsight (ConsumableAI)
Privacy & Grievance Officer: contact@consumableai.com