Privacy Policy

1. What we collect

Account: your email, name, language, time zone, the answers you give in onboarding (role, goals, how you found us) and your plan.

Brand: the website you give us and what we read on its public pages, your brand details, competitors, campaigns, ads, edits, uploads (photos, videos, logos) and scheduled posts.

Connected accounts: the access tokens of social accounts you connect, stored encrypted, and the post statistics they return.

Payments: plan and billing status from our payment provider. We never see or store full card numbers.

Technical: IP address (stored only as a one way hash for the free scan limit), browser, error logs and security logs.

We do not knowingly collect data from children, and we do not sell personal data.

2. Why we use it and on what basis

To run the service you asked for: scan your site, make and schedule ads, post to your accounts, keep your credits (contract).

To keep AudienceBeast safe, stop abuse and enforce our terms, and to improve it with aggregated statistics (legitimate interest).

To keep records the law requires, such as invoices (legal obligation).

To send product news only if you agree (consent, which you can withdraw at any time).

3. AI processing

To analyse your brand and write and make ads, the content you give us is sent to AI providers (currently Google Gemini; others may be added as backups). They process it for us under contract and, under their business terms, do not use it to train their public models.

AI is used to suggest, never to make decisions with legal or similarly significant effects on you.

4. Who we share it with

Only with providers that help us run AudienceBeast, under data processing agreements: hosting (Vercel or Railway), database and storage (Supabase), AI (Google), stock media (Pixabay), web data (Apify), email (Resend), payments (Stripe or Paddle) and the social networks you connect.

Some are outside the European Economic Area. When so, transfers rely on an adequacy decision (such as the EU US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

We may disclose data when the law requires it, to protect rights and safety, or in a merger or sale of the business, under the same protections.

5. How long we keep it

Account and brand data: while your account is open, then deleted within 30 days, except backups which roll off within 90 days.

Website scans: up to 7 days in cache for speed. Invoices and billing records: as long as tax law requires (10 years in Portugal). Security logs: up to 12 months.

6. Your rights

You can ask to access, correct, delete, restrict or port your data, and object to processing based on legitimate interest. Write to legal@audiencebeast.com; we answer within one month.

You can also complain to the Portuguese data protection authority (CNPD, www.cnpd.pt) or the authority where you live.

7. Cookies

We only use cookies needed for AudienceBeast to work: your login session, your onboarding progress, your language and your time zone. We do not use advertising or tracking cookies, so we do not ask for cookie consent. If we add analytics later, we will ask first.

8. Security

Data is encrypted in transit, access is limited by row level security so each user only reaches their own brand, social tokens are encrypted, and media sits in private storage. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

9. Changes and contact

We tell you about important changes in the app or by email. Questions: legal@audiencebeast.com, Gamitech, Lda., Rua Casais dos Morgados 34, 2500-926 Caldas da Rainha, Portugal.