Privacy Policy

Account information. When you sign up, we store your email address, name (if provided), and the password hash used to authenticate you.

Facebook ad account data. When you connect via Facebook Login, we receive ad-account IDs, the names and statuses of the ad sets you choose to include, and the read/write access token your Facebook user grants. We only request the marketing-API scopes we need and never see your Facebook password.

Ad metrics. Each daily sync pulls spend, impressions, clicks, conversions, and resulting ROAS per ad set so the rule engine can compare against the floor you set.

Billing information. Subscription charges run through Stripe; we store the Stripe customer ID and subscription ID on your account so we can reconcile status. Card numbers, CVCs, and bank details stay with Stripe — we never see them.

Operational logs. We keep server logs (IP address, user agent, request path) for 30 days for security and abuse detection.

Ad optimization.The core product — our rule engine reads your daily ad metrics, compares each ad set's ROAS against your floor, and writes budget changes back to Facebook via the Marketing API.

Billing. We use your Stripe customer record to know whether your subscription is active; while a payment is past due, the agent pauses on the next daily sync.

Support and security. We use your email to deliver receipts, security alerts, and responses to support requests. We use operational logs to investigate abuse, failed syncs, and unauthorized access.

We do not sell your data, and we do not run advertising retargeting against it. Aggregated, anonymized benchmarks may be derived from ad-metric data (e.g. to suggest a default ROAS floor), but they are stripped of identifying attributes before they leave the production database.

Stripe.Payment processing, fraud detection, and tax calculation. Stripe's own privacy policy governs the data they collect.

Facebook Marketing API.Reads spend, impressions, clicks, conversions, and ROAS; writes budget changes back to the ad sets you selected. Meta's data policy governs the data they collect when you connect.

Hosting and infrastructure. Application hosting, database hosting, and transactional email delivery are operated by vendors under contractual data-processing agreements.

We choose vendors that publish a SOC 2 report or equivalent independent security audit where one is available, and we constrain what each vendor can access to the minimum needed for its purpose.

Account data. Kept for the lifetime of your account. If you delete your account, we remove your email, profile fields, and stored tokens within 30 days. Aggregated, anonymized analytics are retained.

Ad metrics. Kept for 24 months so the rule engine can compare day-over-day deltas; older rows are aged out on a rolling basis.

Operational logs. Retained for 30 days, then deleted.

Billing records. Stripe invoice copies are kept for 7 years to satisfy tax-law retention requirements in the jurisdictions where we operate.

To request a copy of everything we hold on you, or to ask us to delete it, email profitmind@polsia.app. We action verified requests within 30 days.

The person responsible for data-protection requests at ProfitMind can be reached at profitmind@polsia.app. We respond to every request, usually within two business days.

If we update this policy in a material way, we will surface a banner in the dashboard and email active subscribers before the change takes effect. The date at the top of this page records the current version.