Privacy Policy — AdStream

AdStream is a product of Polsia. This policy explains how we collect, use, and protect your information when you use AdStream to generate and publish advertising content.

1. Who We Are

AdStream ("we," "us," or "our") is an AI-powered advertising automation platform built by Polsia. We help small businesses generate and publish ad content to social media platforms including Facebook and Instagram.

2. Information We Collect

Account Information

When you create an account, we collect:

Email address
Password (stored as a secure hash — we never store your plain-text password)
Name (optional)

Business Profile

To generate relevant ads, we collect information about your business:

Business name and description
Website URL
Industry and target audience
Products and services
Brand voice preferences

Connected Social Accounts (Facebook & Instagram)

When you connect your Facebook or Instagram accounts via OAuth, we receive and store:

Your Facebook Page name and Page ID
Your Instagram Business Account name and ID
OAuth access tokens (encrypted at rest) that allow us to publish on your behalf
Basic profile information provided by Meta's API

We request only the permissions needed to publish content: pages_manage_posts, pages_read_engagement, instagram_content_publish, and instagram_basic. We do not access your personal Facebook profile, your friends list, your messages, or any data beyond what is needed to publish ads.

Generated Content

We store the ad content we generate for you (ad copy, headlines, calls to action) so you can review, edit, and re-use it.

Usage Data

We automatically collect:

Pages visited within AdStream
Features used and actions taken
Error logs for debugging
Anonymous visitor IDs (stored in your browser's localStorage)

3. How We Use Your Information

To provide the service: Generate ad content using your business profile, publish posts to your connected Facebook Pages and Instagram accounts when you request it.
To manage your account: Authenticate you, enforce subscription limits, process payments.
To improve AdStream: Analyze usage patterns to make the product better.
To communicate with you: Send service updates, subscription notices, and support responses to your email address.

We do not sell your data. We do not use your business information or ad content to train AI models without your explicit consent.

4. How We Share Your Information

Meta (Facebook & Instagram)

When you publish posts, we transmit your ad content to Meta's Graph API on your behalf using your authorized access token. This is the core function of the service. Meta's use of that data is governed by Meta's Privacy Policy.

Service Providers

We use the following third-party services to operate AdStream:

OpenAI / Polsia AI Proxy: Ad content generation. Your business profile and ad request are sent to generate copy.
Stripe: Payment processing. We never store your full credit card details.
Render: Cloud infrastructure hosting.
Neon: Database storage.

These providers are bound by data processing agreements and may not use your data for their own purposes.

Legal Requirements

We may disclose your information if required by law, court order, or to protect the rights and safety of our users.

5. Data Retention

We retain your account and business data for as long as your account is active. Generated ads are retained for 12 months. You may delete your account at any time by contacting us, which will delete your personal data within 30 days.

We retain aggregated, anonymized analytics data indefinitely for product improvement purposes.

6. Security

We take security seriously:

Passwords are hashed using bcrypt
OAuth tokens are encrypted at rest using AES-256-GCM
All data is transmitted over HTTPS (TLS)
Database access is restricted and authenticated
We do not log or store full access tokens in plaintext

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at privacy@adstream.polsia.app.

7. Your Rights

You have the right to:

Access: Request a copy of the data we hold about you.
Correction: Update your account and business information at any time in Settings.
Deletion: Request deletion of your account and personal data.
Portability: Request an export of your data in a common format.
Disconnect platforms: Revoke AdStream's access to your Facebook or Instagram account at any time through Meta's security settings or within AdStream's Settings page.

To exercise these rights, email privacy@adstream.polsia.app.

8. Facebook & Instagram Data Deletion

Per Meta's Platform Terms, you have the right to request deletion of any data AdStream has stored from your Facebook or Instagram account connection. This includes:

OAuth access tokens — used to publish posts on your behalf
Facebook Page ID and Page name
Instagram Business Account ID
Pending scheduled posts on Facebook or Instagram that have not yet been published

How to request deletion:

Within AdStream: Go to Settings → Connected Platforms and click "Disconnect" next to Facebook. This immediately removes your tokens and page data.
Via Facebook: Visit Facebook → Settings → Business Tools, find AdStream, and remove its access. Meta will notify us automatically and we will delete your data within 30 days.
Direct request: Email privacy@adstream.polsia.app with your account email. We will delete your Facebook-related data within 30 days and send confirmation.

When a deletion is processed via Meta's automated callback, you will receive a confirmation code you can use to check the status at https://adstream-d7ek.polsia.app/api/meta/data-deletion-status/[code].

9. Cookies & Local Storage

We use browser session cookies to keep you logged in. We use localStorage to store an anonymous visitor ID for analytics. We do not use third-party tracking cookies or advertising cookies.

10. Children's Privacy

AdStream is not directed at individuals under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us immediately.

11. Changes to This Policy

We may update this policy as the product evolves. We will notify you by email or via the app when we make material changes. The "last updated" date at the top of this page will always reflect the current version.

12. Contact

Questions about this policy or your data:

privacy@adstream.polsia.app