MrX Innovation Lab Pvt Ltd ("we", "us", "our") operates OnPromptAds Brands at https://brands.onpromptads.com/ (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service, including when you connect Meta (Facebook/Instagram), Google, or other third-party accounts.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

We collect information in the following categories:

• Account information: name, email address, profile photo (when provided via Google OAuth), organization membership, and role.
• Organization and brand data: organization name, brand profiles, product catalogs, prompt libraries, team members, and activity logs.
• Content you create: AI generation inputs and outputs, uploaded media, ad copy, social posts, and scheduling data.
• Meta/Facebook/Instagram data (when you connect): Page and Instagram Business account IDs, names, profile pictures, access tokens (encrypted at rest), posts, comments, direct messages, ad account details, campaign data, lead form submissions, and analytics/insights as permitted by the permissions you grant.
• Usage data: log files, IP address, browser type, device information, pages visited, and feature usage for security and product improvement.
• Payment data: billing details are processed by Stripe. We do not store full card numbers on our servers.
• Communications: messages you send through contact forms, support requests, and demo inquiries.

We use collected information to:

• Provide, operate, and maintain the Service, including AI content generation, social publishing, scheduling, inbox management, and Meta Ads management.
• Authenticate users and enforce organization-level access controls.
• Publish content to connected Facebook Pages and Instagram accounts on your instructions.
• Retrieve analytics, manage ad campaigns, and process lead form data from Meta on your behalf.
• Send service-related notifications, security alerts, and support responses.
• Improve the Service, troubleshoot issues, and develop new features.
• Comply with legal obligations and enforce our Terms of Service.

When you connect a Meta Business Portfolio, we receive data through the Meta Graph API according to the permissions you approve. This may include Page and Instagram account information, media, engagement data, messaging content, advertising data, and insights.

We use Meta platform data solely to provide the features you request within OnPromptAds Brands, such as publishing posts, viewing analytics, managing ads, responding to messages, and retrieving leads. We do not sell Meta platform data. We do not use Meta platform data to build unrelated user profiles or for advertising outside your organization's use of the Service.

You can disconnect Meta at any time from Social > Connections within your brand workspace. Disconnecting revokes our access to your Meta tokens and stops future data collection from Meta. See our Data Deletion page for full removal instructions.

Where applicable under GDPR, we process personal data based on: (a) performance of a contract with you or your organization; (b) legitimate interests in operating a secure B2B SaaS platform; (c) your consent where required (such as optional marketing emails); and (d) compliance with legal obligations.

We do not sell your personal information. We may share information with:

• Service providers (subprocessors) who help us operate the Service, listed on our Security page and in our DPA.
• Meta Platforms, Inc. when you use Meta-connected features, subject to Meta's terms and your authorization.
• Google when you sign in with Google OAuth, subject to Google's policies.
• Other members of your organization according to your assigned role and permissions.
• Law enforcement or regulators when required by law or to protect rights and safety.
• A successor entity in connection with a merger, acquisition, or asset sale, with notice where required.

We retain account and organization data for as long as your account is active or as needed to provide the Service. Meta tokens and social data are deleted or anonymized when you disconnect an integration or delete a brand. Generation history, audit logs, and backups may be retained for a limited period for security, billing, and legal compliance before deletion.

You may request deletion of your account and associated data at any time. See https://brands.onpromptads.com/data-deletion/ for instructions.

We implement administrative, technical, and organizational measures including TLS encryption in transit, encryption at rest for sensitive tokens, tenant isolation by organization ID, and access controls. Details are available at https://brands.onpromptads.com/security/.

Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also withdraw consent where processing is consent-based.

To exercise these rights, email brands@onpromptads.com or use the data deletion instructions at https://brands.onpromptads.com/data-deletion/. We will respond within the timeframe required by applicable law.

We may process and store information in India, the United States, and other countries where our subprocessors operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

The Service is intended for business users aged 18 and older. We do not knowingly collect personal information from children under 16.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Material changes may be communicated by email or in-app notice.

MrX Innovation Lab Pvt Ltd Email: brands@onpromptads.com Website: https://brands.onpromptads.com/