Privacy policy

This policy explains what downseason (“we”, “us”) collects when you use our website and app, how we use it, who we share it with, and the choices you have. If anything here is unclear, write to admin@centralcoms.com.

What we collect

Information you give us

• Account details: your name, email address and password, or your Google profile if you sign in with Google.
• Onboarding answers: your website, objective, role and approximate ad spend.
• Brand material: your website content, logos, product images, videos, copy and anything else you upload or ask us to read.
• Prompts and messages you send to the in-app agent, and the ads, scripts and media it produces for you.
• Your phone number, if you opt in to text messages (see SMS terms).
• Messages you send us for support.

Information from connected accounts

When you connect Meta (Facebook and Instagram), you choose which permissions to grant. With them we can read your ad accounts, campaigns, ad sets, ads, creatives and performance insights; list the Pages and Instagram accounts you manage; and create, edit, pause and launch ads on your behalf when you ask us to. We store the access token Meta issues to us, encrypted, and use it only to do what you ask in the app. We do not read your personal profile, friends, or private messages.

Information collected automatically

• Log data: IP address, browser, device, pages visited and timestamps.
• Cookies we need to keep you signed in and to remember your session. We do not use advertising cookies.

Payment information

Payments are handled by Stripe. We receive your subscription status and the last digits of your card, never the full card number.

How we use it

• To run the service: research your market, generate ads in your brand, launch them when you approve, and report results.
• To manage your account, trial and subscription.
• To send service messages: sign-in links, receipts, alerts about your ads, and texts you opted in to.
• To keep the service secure, prevent abuse and fix problems.
• To improve the product, using aggregated or de-identified usage.

We do not sell your personal information, and we do not use your brand material or Meta data to train AI models for anyone else.

Who we share it with

We share information only with service providers that help us run downseason, under contracts that limit their use of it:

• Hosting, database and authentication (Supabase and our cloud hosts).
• AI model providers (such as Anthropic, OpenAI and Google) that process your prompts and brand material to generate output. They do not use it to train their models under our agreements.
• Payments (Stripe).
• Messaging providers that deliver our email and text messages.
• Meta, when you connect your account and ask us to read or launch ads.

We may also disclose information if the law requires it, to protect our rights or users’ safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties.

How long we keep it

We keep your information for as long as your account is open. When you delete your account or ask us to, we delete your personal information and content within 30 days, except what we must keep for legal, tax or fraud-prevention reasons. Backups roll off within a further 30 days.

Your choices and rights

• Access, correct, export or delete your information by writing to admin@centralcoms.com.
• Disconnect Meta at any time from Integrations in the app, or from your Facebook settings under Business Integrations.
• Stop text messages by replying STOP.
• Unsubscribe from marketing email with the link in any email.

Depending on where you live (for example California, the EU or the UK), you may have further rights, including to object to or restrict processing and to complain to your data protection authority. We will not treat you differently for exercising them. See data deletion for how to have your data removed.

Security

We encrypt data in transit and at rest, keep access tokens encrypted, and limit staff access to what is needed. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

Children

downseason is for businesses and is not directed to anyone under 18. We do not knowingly collect children’s data.

International transfers

We are based in the United States and process information there. Where the law requires, we rely on standard contractual clauses for transfers from the EU and UK.

Changes

We will post any change here and update the date at the top. If a change is material, we will tell you by email or in the app before it takes effect.

Contact

downseason · admin@centralcoms.com