Privacy Policy
This policy explains what personal data we collect when you use the AdCreator+ app for iPhone, iPad and Android and the website tryadcreator.com, why we collect it, who we share it with, how long we keep it and what rights you have. AdCreator+ turns a website, a photo or a short description into image and video ads with the help of AI.
1. Who we are
The data controller is Kawi Software AS, organisation number 933 580 873, Fredrik Meltzers gate 13 B, 5007 Bergen, Norway.
Questions and requests about privacy: support@kawisoftware.com.
2. The short version
- We use your business details, website, photos and instructions to make your ads, and we store your work so you can return to it on any device.
- AI models from Google (Gemini API and Vertex AI) make and check the ads. We do not use your content to train AI models, and the paid Google services we use do not train their models on it either.
- AI presenters in spokesperson videos are invented people. We never create a presenter from your face or voice, and we do not process biometric data.
- Payments go through Apple or Google. We never see your card details.
- App analytics only run if you allow them: on iPhone and iPad through Apple's tracking prompt, on Android through our own prompt (section 3.8).
- We do not sell your personal data and there are no ads in the app.
- You can delete your account and its data in the app at any time.
3. What we collect
3.1 Your account
- Guest account. When you first open the app we create a guest account with a random user ID, so your work can be saved. No name or email is needed.
- Signed-in account. If you sign in with Apple, Google or an email link, we receive your email address and, if Apple or Google share it, your name. With Sign in with Apple you can hide your real email address.
- Account settings. App language, notification settings and your onboarding answers (for example your goal and business type).
3.2 Your business and brand
What you enter or approve about the business you make ads for: business name, website address, description, business type, industry, audience, tone, language, logo, colours and fonts, and campaign details such as products, offers, events and calls to action. If you add contact details to show in your ads (address, phone number, email), we store those too. This is usually business information, but it is personal data when it identifies you, for example for a sole trader.
3.3 Website import (Brand DNA)
If you give us a website address, our servers visit that public website and read its text, page information, logo, product photos and colours to build your brand profile and write your first ads. We only read the address you give us and pages it links to for products. We do not log in anywhere, and we do not import social media profiles. Public websites can contain personal data (for example staff names or customer reviews). We use what we read only to make your ads, and you choose what to keep.
3.4 Photos and files you add
Product photos, logos, screenshots (for device mock-ups) and reference ads (for "Remix") that you choose from your photo library or take with the camera. The app only gets the photos you pick. We make cut-outs (background removal) and smaller copies of them. If you save ads to your phone, the app asks for permission to add photos to your library. We do not use your microphone and we do not read your contacts or your precise location.
3.5 What you create
Your instructions and edits (for example "make the background darker"), scripts for spokesperson videos, chat messages to the in-app assistant, the ads and concepts the AI makes, captions, voice-overs and the music chosen, the templates you save, share links you create, and templates you choose to publish to other users.
3.6 Purchases, subscriptions and credits
When you buy a subscription or a credit pack, Apple or Google take the payment. We and our subscription service RevenueCat receive the purchase details: the product and store, purchase, renewal and expiry dates, trial status, and whether the subscription is active. These are linked to your random user ID. We keep a credit ledger: credits added, spent and refunded, and the job they belong to. We also store which version of the onboarding and plan screens you saw (we test different versions). We never receive your card number or bank details.
3.7 Device, security and technical data
- App integrity checks. To protect the service and its free credits, the app uses Firebase App Check with Apple App Attest/DeviceCheck or Google Play Integrity. These confirm that a request comes from our genuine app on a genuine device. We may require this check before we give free credits.
- Push token. If you allow notifications, we store your device's push token and platform (iOS or Android).
- Notification context. Your time zone offset, app language and device region, so notifications arrive at a sensible time and in your language.
- Install ID. A random ID created when you install the app. We store only a scrambled (hashed) version. It is used to stop misuse of invite rewards.
- Server logs. When the app talks to our servers, our hosting records technical details such as your IP address, the time, the request and the app version. We use these for security and to fix problems.
- Usage limits. To stop abuse we limit how many requests an account or IP address can make in a period. Where we store these counts, we store accounts and IP addresses only in scrambled (hashed) form.
3.8 App analytics
We use Google Analytics for Firebase to understand how the app is used. It records events such as screens viewed, onboarding steps, plan screens shown, purchases, and ads created, exported and shared, together with your device model, operating system, app version, language, country (from your IP address) and an app-instance ID.
- iPhone and iPad: analytics are switched off until you tap "Allow" on Apple's App Tracking Transparency prompt. If you allow tracking, the data can include your device's advertising identifier (IDFA). We use it to measure our own marketing and to show AdCreator+ marketing to you in other companies' apps and websites. You can change your choice at any time in iOS Settings › Privacy & Security › Tracking. When tracking is not allowed, analytics stay off.
- Android: analytics are switched off until you tap "Allow" when AdCreator+ asks. If you allow them, Firebase Analytics can also use your device's advertising ID to measure our own marketing. If you choose "Don't allow", analytics stay off. You can change your choice at any time in the app's Settings. You can also reset or delete the advertising ID in your Android settings (Settings › Privacy › Ads, or Google › Ads).
We also record simple in-app usage events in our own database: which templates and formats are shown, opened, used, exported and shared, and your business type and industry. We use them to rank templates and to improve the app. They are linked to your user ID.
3.9 Error reports
When something goes wrong in the app, it sends us an error report: the error message, a technical trace, the part of the app where it happened, your platform and your user ID. Error reports do not contain your photos or your ads.
3.10 Support and bug reports
If you email us or send a bug report from the app, we receive what you write, your email address if you give it, any screenshots you attach, and device details: model, operating system, app version, language, subscription status, your subscription account ID and the screen you were on. If you use "Report this ad" on an AI-generated ad, we receive the reason, your note and which ad it is.
3.11 Notifications
If you allow notifications, we tell you when an ad is ready. We may also send tips such as seasonal campaign ideas and reminders about your plan or credits. These come at most twice a week and never during your quiet hours. You can turn each type off in the app (Account › Notifications), or turn off all notifications in your phone's settings.
4. How we use AI
To make your ads, our servers send the relevant parts of your brand profile, website content, photos, instructions and scripts to AI models. The current models are Google's Gemini models (through the Gemini API) for text, images, quality checks and video (Veo), and Google Cloud's Vertex AI and speech services for music, voice-overs and caption timing. The models write ad copy, create images and videos, label photos (for example "product photo" or "lifestyle scene"), and check that the text in an ad is spelled as you asked.
- We ask first. Before the app sends your content to Google's AI for the first time, it shows what is sent and why, and asks you to agree. We store your answer and when you gave it. If you choose "Not now", the features that need AI will not work until you agree.
- No training on your content. We do not train AI models. Under the terms for Google's paid AI services that we use, Google does not use your content to train or improve its models. Google may keep prompts and results for a limited time to detect abuse and to meet legal requirements.
- AI presenters are not real people. The presenters in AI spokesperson videos are invented, ordinary people generated by the model. We never build a presenter from your face or voice, and we do not use face recognition or create biometric data. Spokesperson videos carry an "AI-generated" label by default.
- Watermarks and labels. Images and videos made with Google's models may carry Google's invisible SynthID watermark. Ads made on the free plan carry a visible AdCreator+ watermark.
- Automated decisions. Automated checks can refuse a request, for example when content breaks our rules, when a device fails the integrity check for free credits, or when a usage limit is reached. These checks do not have legal or similarly significant effects on you. If you think a check got it wrong, contact us and a person will look at it.
5. Why we use your data and our legal basis
| Purpose | Main data used | Legal basis (GDPR) |
|---|---|---|
| Create your account and keep your work in sync on your devices | Account, brand, files, what you create | Contract (Art. 6(1)(b)) |
| Import your website and make, check, render and store your ads | Brand, website content, photos, instructions, outputs | Contract (Art. 6(1)(b)) |
| Sell and manage subscriptions and credits, refill allowances, refund credits for failed jobs, restore purchases | Purchase details, credit ledger, user ID | Contract (Art. 6(1)(b)); legal obligations for records we must keep (Art. 6(1)(c)) |
| Tell you when an ad is ready | Push token, notification settings | Contract (Art. 6(1)(b)), after you allow notifications |
| Send tips, campaign ideas and plan reminders | Push token, notification settings, language, region, time zone, plan status | Consent (Art. 6(1)(a)); you can withdraw it at any time |
| Keep the service secure, prevent fraud and misuse of free credits, invite rewards and usage limits | Integrity check result, user ID, hashed install ID, hashed IP, server logs | Legitimate interests (Art. 6(1)(f)): protecting our service and our users |
| Find and fix errors | Error reports, server logs, bug reports | Legitimate interests (Art. 6(1)(f)): a working app |
| Improve the app and rank templates | In-app usage events | Legitimate interests (Art. 6(1)(f)): a better product |
| App analytics and measuring our marketing on iPhone and iPad | Firebase Analytics data, IDFA | Consent (Art. 6(1)(a)), through Apple's tracking prompt |
| App analytics and measuring our marketing on Android | Firebase Analytics data, advertising ID | Consent (Art. 6(1)(a)), through the app's analytics prompt |
| Answer your questions and handle complaints | Your messages, email, account details | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Comply with the law, handle legal claims and answer authorities | What the case requires | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed our interest against your privacy, and you can object (section 10).
6. Who we share data with
We share personal data only as described here.
Service providers who process data for us (data processors under contract):
- Google Cloud and Firebase (Google): servers, databases, file storage, sign-in, App Check, push notifications (Firebase Cloud Messaging), error and usage records, app analytics, and website hosting.
- Google Gemini API and Vertex AI (Google): the AI models described in section 4.
- RevenueCat (RevenueCat, Inc., USA): manages subscriptions and purchase records.
- GitHub (GitHub, Inc., USA): our private bug tracker. In-app bug reports become issues there, without your email address.
- Our email provider, for support emails.
Companies that act on their own behalf (independent controllers, under their own privacy policies):
- Apple (App Store payments, Sign in with Apple, App Attest, Apple Push Notification service) and Google (Google Play payments, Google Sign-In, Play Integrity).
- Social networks, ad platforms or other apps you choose to share or post your ads to.
Other people, when you choose it:
- Share links. Anyone who has a share link to one of your ads can view that ad. Share links keep working until you delete your account, so only share them with people you want to see the ad.
- Community templates. If you publish a template, other AdCreator+ users can see and use it, including any pictures and text it contains. You can unpublish it at any time.
Other cases: we may disclose data when the law requires it, to protect rights, safety or our service, or as part of a merger, acquisition or sale of all or part of our business (in which case this policy still applies to your data).
We do not sell your personal data, and we do not share it with data brokers.
7. International transfers
We are based in Norway, in the European Economic Area (EEA). Our servers, database and file storage are in the United States (Google Cloud region us-central1 and the US multi-region "nam5"). Google's AI services, RevenueCat, GitHub, Apple and Google may also process data in the US and other countries. When personal data leaves the EEA, we rely on the EU-U.S. Data Privacy Framework for recipients that are certified under it (Google is). For other transfers we rely on the European Commission's Standard Contractual Clauses in our providers' data processing terms, together with their security measures. You can ask us for more information about these safeguards.
8. How long we keep data
| Data | How long |
|---|---|
| Your account, brand profile, uploaded files, ads, projects, templates and credit ledger | Until you delete your account. There is no automatic expiry. When you remove a single item in the app, it leaves your library; a file that one of your ads still uses can stay in storage until you delete your account. |
| Guest accounts that are never used again | Until you delete them. We may delete a guest account and its content after 24 months without any use. |
| Deleted files | Our file storage keeps deleted files in a recovery area for 7 days, then erases them. |
| Temporary video working files | 1 day |
| Server logs | 30 days |
| Error reports and in-app usage events | 12 months, also after you delete your account |
| App analytics (Firebase) | Up to 14 months |
| Purchase records at RevenueCat | As long as we use RevenueCat. We can delete them on request (section 10). Apple and Google keep their own purchase records under their own policies. |
| Bug report screenshots | 30 days |
| Support emails and bug reports | As long as needed to handle your request, and at most 24 months after that |
| Record of a deleted account (random user ID, deletion date, plan at the time) | 3 years, so a deleted account cannot be restored by mistake and so we can handle purchase questions |
| Invite records | Until you delete your account. Credits a person has already earned stay on their account. |
We may keep data longer if the law requires it or if it is needed for a legal claim.
9. Security
Your files are stored in private storage that blocks public access. The app shows them through short-lived links, and other people can only see an ad if you create a share link for it. Connections are encrypted (HTTPS). Our servers only answer app requests from a signed-in account (a guest account counts), and our staff can access your content only when this is needed to help you, to keep the service safe or to fix a problem. AI provider keys are kept on our servers, never in the app. No system is completely secure, but we work to protect your data and will tell you and the authorities about a breach when the law requires it.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong (you can edit most of it in the app);
- delete your data (see below);
- restrict how we use your data in some situations;
- data portability: receive data you gave us in a common, machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, for example in iOS tracking settings, the analytics choice in the app's Settings on Android, or the app's notification settings. This does not affect processing that happened before.
Delete your account: in the app, open Account and choose Delete account. This permanently removes your account, sign-in, brands, projects, uploaded photos, ads and exports, templates and credit ledger. If deletion is interrupted, our servers finish it in the background. Deleting your account does not cancel a subscription: cancel it in your App Store or Google Play subscription settings. If you no longer have the app, see ai-ads-app.web.app/delete-account or email us from the address you signed in with.
To use your other rights, email support@kawisoftware.com. We answer within one month. We may ask you to confirm that the account is yours, for example by writing from the email address you signed in with.
Complaints: you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the data protection authority where you live or work. We would appreciate the chance to fix the problem first.
11. Children
AdCreator+ is a tool for businesses and creators and is not directed to children. You must be at least 16 to use it (see our Terms of Use). We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Our website and cookies
tryadcreator.com has information about AdCreator+, free tools that work inside your browser (such as the ad resizer, the safe-zone checker and the ad mock-ups), invite pages and the page that passes an email sign-in link to the app. It sets no cookies, runs no analytics and loads nothing from other companies.
- Free browser tools. Images you add to these tools are processed on your own device. They are not uploaded to us.
- Sign-in links. When you open a sign-in link, the page reads the one-time code in the link inside your browser and hands it to the app. The page does not store the code or send it anywhere else.
- Invite and share links. An invite page reads the invite code from its address inside your browser. A share
link to an ad (
/o/...) sends your browser on to our servers, which show the ad. - Hosting. Our hosting provider (Google Firebase Hosting) processes your IP address and browser details to deliver the pages and protect them from abuse.
If we add cookies, analytics or other features to the website, we will update this policy first and ask for your consent where the law requires it.
13. Changes to this policy
We update this policy when the app or our use of data changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email before it takes effect.
14. Contact
Kawi Software AS
Fredrik Meltzers gate 13 B, 5007 Bergen, Norway
Organisation number 933 580 873
support@kawisoftware.com