Privacy Policy

1.1 Account Information

When you create an account, we collect your name, email address, company name, and password. If you sign up with Google, or with Apple in our iOS app, we receive basic profile information such as your name and email address from that provider, in line with the permissions you grant. We also store the sign-in tokens those providers issue to us. Sign-in tokens stored on or after October 22, 2026 are encrypted at rest.

1.2 Ad Platform Data

When you connect your advertising accounts (Meta, Google, TikTok, LinkedIn, Reddit, Apple, Bing, ChatGPT, Snapchat, and others we support), we import and continuously collect the advertising objects and metrics those platforms make available. This includes campaign, ad set/ad group, and ad configuration (budgets, bidding, targeting, schedule, objective, and the raw platform payload), ad copy (headlines, body, descriptions, CTAs, destination URLs), creative assets (images, videos, thumbnails), and performance statistics at each of those levels (impressions, clicks, conversions, spend, revenue, CTR, CPC, CPA, ROAS, reach, frequency, video quartile views, conversion-action breakdowns, and other platform-specific metrics). We store daily snapshots so you can analyze custom date ranges and so we can improve the Service.

When you connect an ad platform we also store the access credentials it issues, encrypted at rest, and basic details of the connected profile and accounts. Depending on the platform, these can include the account holder's name or username (for example, your Facebook name, Instagram usernames, or LinkedIn member name), the email address and user ID of a Microsoft Advertising login, and the list of ad accounts, pages, and organizations you can access. For Apple Search Ads and ChatGPT Ads, the credentials are the API key or private key you give us, encrypted at rest.

1.3 Usage Data

We automatically collect information about how you interact with our platform, including pages visited, features used, actions taken, timestamps, and referring URLs.

1.4 AI Interaction Data

When you use our AI features, we collect the prompts you provide, AI-generated outputs, your feedback on those outputs, and your chat history with the Lazy Ads assistant, which we keep with your account. We also record which model handled each request and how many tokens it used. We record which creatives were generated with AI, and we apply each platform's AI-disclosure setting when we publish them, where the platform offers one.

1.5 Payment Information

Payment processing is handled by Stripe. We do not store your full credit card number, CVV, or bank account details on our servers. Stripe provides us with limited information such as the last four digits of your card, card brand, expiration date, and billing address for record-keeping and support purposes.

1.6 Device and Browser Information

We collect device type, operating system, browser type and version, screen resolution, IP address, and general location data (city/country level) derived from your IP address.

1.7 Shopify

If you connect a Shopify store, we store the shop's domain, name, contact email, currency, and plan; its product catalog; and aggregate order metrics such as revenue, average order value, and order counts. We do not store individual order or customer records from Shopify.

1.8 Data You Send Us About Your Customers

If you install the Lazy Ads tracking pixel or send us conversion events, we receive information about your customers' purchases and sign-ups, such as the event, its value, the order ID, ad click IDs, and, when your site provides them, the customer's email address and phone number, IP address, and browser user agent. For events we receive on or after October 22, 2026, we hash the email address and phone number with SHA-256 when we receive them and store only the hashed values. We do not store IP address or user agent. When we forward an event to the ad platforms you have connected (Meta, Google, TikTok), email address and phone number are sent hashed with SHA-256. Click IDs, browser IDs, IP address, and user agent are sent unhashed, as those platforms require. We process this data on your behalf as your processor under our Data Processing Agreement, and only to report and send your conversions. You are responsible for having a lawful basis and any required notice or consent from your customers.

We use the information we collect for the following purposes:

• Provide and maintain our services: To operate the Lazy Ads platform, manage your account, and deliver the features you request.
• AI-powered optimization: To generate ad copy, suggest campaign optimizations, predict performance, and continuously improve our AI models, including training and evaluating custom models on de-identified campaign, ad set, ad, creative, and performance data.
• Product research and commercial use: To analyze aggregated advertising performance, develop new products and benchmarks, and, where permitted, license or otherwise commercialize insights derived from campaign intelligence that is not personal data (for example, which creative structures or copy patterns perform well). We do not sell your name, email, or payment information.
• Billing and payments: To process subscriptions, manage invoices, and handle refunds through our payment processor (Stripe).
• Communication: To send service notifications, security alerts, billing reminders, product updates, and marketing or sales emails about Lazy Ads (for example, unpaid-account reminders and plan offers). You can turn each notification and marketing category on or off in Settings → Notifications; categories default to on when you create an account. You can also unsubscribe from marketing emails via the link in each message. Transactional messages (security, billing, essential account notices) may still be sent when needed to operate your account. Messages we send include a small image and rewritten links so we can count opens and which links were clicked. Those counts are visible to Lazy Ads operators and are not sold.
• Security and fraud prevention: To detect, investigate, and prevent unauthorized access, abuse, and other malicious activity.
• Analytics and improvement: To understand usage patterns, diagnose technical issues, and improve our platform's functionality and user experience.
• Legal compliance: To comply with applicable laws, regulations, and legal processes.

Permissions we request when you connect a platform. When you connect a platform, we ask only for the permissions listed here, and we use them only to provide the features you use.

• Google Ads: adwords (read and manage your Google Ads accounts).
• Meta: ads_management, ads_read, business_management, pages_show_list, pages_read_engagement, and pages_manage_ads.
• LinkedIn: r_ads, rw_ads, r_ads_reporting, r_basicprofile, r_organization_social, and w_organization_social. New connections no longer request rw_organization_admin. Connections made before October 22, 2026 keep the permissions granted at the time until you reconnect.
• Reddit: adsread, adsedit, and adsconversions.
• Microsoft Advertising: openid, offline_access, and msads.manage.
• Snapchat: snapchat-marketing-api and snapchat-offline-conversions-api.
• TikTok Ads: the advertiser permissions you approve on TikTok's authorization screen.
• TikTok Accounts: user.info.basic, user.info.username, user.info.stats, user.info.profile, user.account.type, user.insights, video.list, video.insights, and biz.spark.auth. biz.spark.auth is requested so you can later promote your own TikTok posts as Spark Ads; it is not currently used, and is never used for AI-generated creatives.
• Shopify: read_products, read_orders, and read_inventory.
• Apple Search Ads and ChatGPT Ads do not use these permission requests. They use the API credentials you give us, with the access set on your own account.

We do not sell your personal data. We share your information only in the following circumstances:

3.1 Advertising Platforms

At your direction, we transmit campaign data, ad creatives, and targeting parameters to advertising platforms (Google Ads, Meta Ads, LinkedIn Ads, TikTok Ads, Reddit Ads, Apple, Bing, ChatGPT, Snapchat, etc.) to manage your campaigns. This sharing is necessary to provide our core services.

3.2 Payment Processor (Stripe)

We share billing information with Stripe to process your subscription payments. Stripe acts as an independent data controller for payment data and is subject to its own privacy policy.

3.3 AI Providers

To generate ad copy, creatives, strategies, and recommendations, and to answer you in chat, we send the content each request needs to AI model providers. Text and chat requests go through OpenRouter, which routes them to model providers such as Anthropic, Google, DeepSeek, and OpenAI. OpenRouter also handles some image and video generation. We call Google (Gemini) directly to generate images and to run a policy check on generated images.

A chat request contains our system prompt; a snapshot of your account, such as your business profile, connected platforms, and a summary of your campaigns and ads; your chat history, with recent messages as you wrote them and a summary of earlier ones; and the results of tools the assistant uses, such as campaign, performance, pixel, conversion event, and audience details. Other AI features send the data that feature needs, which can include your business profile (including pricing, margins, and competitors), campaign, ad, and performance data, conversion settings, competitor ads from public ad libraries, reference images, and your product catalog.

We do not add your account email address or name, your ad account names, or your customers' personal data (such as leads, audience list members, or the email addresses and phone numbers in conversion events) to these requests. Anything you type in chat is sent as you wrote it. We have not turned on zero data retention with these providers, so they may keep request data under their own terms.

3.4 Analytics Providers

We use Google Analytics 4 (GA4) to understand platform usage and improve our services. GA4 collects usage data and is configured to respect applicable privacy regulations and your cookie choices. Advertising and conversion measurement is described separately in Section 3.7.

3.5 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.6 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

3.7 Advertising and Conversion Measurement

To measure the effectiveness of our own marketing and improve our advertising, we use measurement tools provided by Google (Google Analytics 4), Meta Platforms (the Meta Pixel and Conversions API), and TikTok (the TikTok Pixel and Events API). These tools may record actions such as page views, registrations, purchases, onboarding steps, and in-product funnel actions (ad-account connect, first campaign, pricing views), and may set cookies or similar identifiers.

For more accurate measurement, we also send event information to Meta and TikTok from our servers when you create an account: a CompleteRegistration event to both, and a Lead event to Meta. These events include your email address, phone number (if we have it), and Lazy Ads account ID, and for Meta your name, all hashed with SHA-256, plus your IP address, user agent, and ad click and browser IDs (Meta fbc and fbp, TikTok ttclid and _ttp), which are sent unhashed as those platforms require. When you are signed in, we also give Google Analytics your Lazy Ads account ID so it can link your sessions. We share this data only to measure and attribute conversions for our own advertising, and we do not sell it.

Where privacy law requires prior consent (notably the EEA, the United Kingdom, and Switzerland), advertising and analytics cookies, the server-side sign-up events described above, and the Lazy Ads account ID we give Google Analytics are all held until you accept them in our cookie banner. This uses Google Consent Mode and the equivalent consent controls for Meta and TikTok in your browser, and the same consent choice on our servers. Other visitors receive measurement by default, except that if we cannot determine your region, our first-touch attribution cookies also wait for your consent. You can decline or withdraw consent at any time through our cookie banner (when shown) or your cookie preferences. Your use of these providers is also subject to their respective privacy policies. To decide whether to show the cookie banner, we send your IP address to a country lookup service (country.is), which tells us only which country you are in.

3.8 Affiliate Attribution

If you visit Lazy Ads through an affiliate referral link, we store an httpOnly cookie (lazyads_ref) for 90 days so we can credit the affiliate if you create an account. We record a hashed visitor identifier (derived from IP address and user agent) to prevent click fraud. Affiliates see click counts, signup counts, and the subscription plan you choose, not your name or email. Payouts to affiliates are processed by Stripe Connect, which collects identity and tax information from the affiliate under Stripe's privacy policy.

We retain your account data and associated personal information for as long as your account remains active. Upon receiving an account deletion request, we delete or anonymize your personal data (account profile, authentication, billing identifiers, connected-account tokens, unused uploads, and similar records) within 30 days, except where retention is required by law (e.g., financial records for tax compliance). If you signed in with Apple, we also ask Apple to revoke our access when your account is deleted.

Disconnecting an ad platform or store. When you disconnect any ad platform, we delete its access credentials and the account names and email addresses we stored from it. We keep the campaign data described in Section 1.2. For Meta, Google, TikTok Ads, and Reddit, we also ask the platform to revoke our access where we can, and we always delete our stored tokens, even if the revoke request fails. If you also sign in to Lazy Ads with Google, we do not send that revoke request when you disconnect Google, because it would also sign you out of Lazy Ads; we delete our stored credentials, and you can remove Lazy Ads in your Google account settings. For other ad platforms we do not send a revoke request, so you can also remove Lazy Ads in that platform's own settings. When you disconnect a Shopify store, we ask Shopify to revoke our access and delete the store's details and catalog.

Campaign intelligence is retained after account deletion. Campaign, ad set, and ad configuration, ad copy, creative assets, and performance statistics (including daily snapshots and lifetime totals) are permanently stored and detached from your user account. We keep this data to operate analytics for remaining customers, train and evaluate AI models, produce benchmarks, and develop or commercialize advertising-intelligence products. After deletion we do not use your email address or login identity to label that data. For accounts deleted on or after October 22, 2026, the owner fields are cleared and the records keep only a random identifier, not your user ID, and a deletion date.

Aggregated and anonymized data that cannot reasonably be used to identify you may also be retained indefinitely for analytics and service improvement purposes.

Backup copies of your data may persist in our backup systems for up to 90 days after deletion from our primary systems.

Depending on your jurisdiction, you may have the following rights regarding your data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Deletion: Request deletion of your personal data, subject to legal retention requirements and the campaign-intelligence retention described in Section 4.
• Right to Export: Request your data in a portable, machine-readable format (data portability).
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@lazyads.ai. We will respond to your request within 30 days.

We use cookies and similar technologies for the following purposes:

• Essential cookies: Required for authentication, session management, and security (CSRF protection). These cannot be disabled.
• Analytics cookies: Help us understand how users interact with our platform (GA4). You can opt out of these via your cookie preferences.
• Advertising/measurement cookies: Set by Google, Meta, and TikTok measurement tools to attribute conversions and measure the effectiveness of our advertising (see Section 3.7). In consent-required regions these load only after you accept analytics cookies; elsewhere they are used by default and can be declined or withdrawn at any time.
• Preference cookies: Store your settings such as theme preference, language, and display options.

For detailed information, please see our Cookie Policy.

Your data is primarily processed and stored in the United States. If you are located outside the US, your information will be transferred to and processed in the US.

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, we rely on EU Standard Contractual Clauses (SCCs) and implement additional safeguards as necessary to ensure an adequate level of data protection.

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@lazyads.ai.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that data, our purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Opt Out of Sale: We do not sell personal information. If this changes, we will provide a “Do Not Sell My Personal Information” link.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Limit Use of Sensitive Data: You may direct us to limit our use and disclosure of your sensitive personal information.

To exercise these rights, contact us at privacy@lazyads.ai or call us. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

If you are located in the European Union or European Economic Area, you have the following additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your data based on: (a) your consent, (b) performance of a contract, (c) legitimate interests, or (d) compliance with legal obligations.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.
• Data Protection Officer: For GDPR-related inquiries, contact us at privacy@lazyads.ai.

Update effective October 22, 2026. We updated this policy to describe our practices more precisely. In summary:

• We name the AI providers we use (OpenRouter, which routes to model providers such as Anthropic, Google, DeepSeek, and OpenAI, and Google Gemini directly for images) and explain what we send them.
• We describe the account sign-up events we send to Meta and TikTok and the account ID we give Google Analytics. In the EEA, the United Kingdom, and Switzerland, these and our first-touch attribution cookies now wait for your consent.
• We describe the data we receive about your customers through our pixel and conversion events. Email addresses and phone numbers are now hashed when we receive them.
• We list the permissions we request from each platform. New LinkedIn connections request fewer permissions.
• Disconnecting an ad platform now deletes the account names and email addresses we stored from it, and for Meta, Google, TikTok Ads, and Reddit we also ask the platform to revoke our access where we can.
• When you delete your account, we now keep only a random identifier on retained campaign records.
• Sign-in tokens stored from this date are encrypted at rest.
• We added a section on Shopify store connections.
• We updated our Cookie Policy and our Data Processing Agreement to match.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email (sent to the email address associated with your account) or by placing a prominent notice on our website at least 30 days before the changes take effect.

We encourage you to review this page periodically for the latest information on our privacy practices. Your continued use of our services after any changes constitutes acceptance of the updated Privacy Policy.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: