1. Information We Collect

When you use the Services, we may collect the following categories of personal information:

• Account Information: Your name, email address, password (stored in encrypted form), and any other information you provide when creating or managing your account.
• Usage Information: Information collected passively through your use of the Services, including IP address, browser type, operating system, pages visited, session duration, and standard web log data.
• Financial Data (Sensitive): If you connect a bank account or financial institution through the Services, we collect financial account information including account details, account numbers (masked), transaction history, account balances, investment holdings, and related financial data. This information is collected through Plaid Inc. ("Plaid") and is subject to both this Privacy Policy and Plaid's Privacy Policy. By connecting your financial accounts, you authorize us to retrieve this information through Plaid on your behalf. We are not a financial institution, and we do not receive or store the sign-in credentials for financial accounts you connect through Plaid.
• Third-Party Integration Data: If you connect third-party services such as Google, Microsoft, or other platforms, we collect data from those services as authorized by you during the connection process. You control what you share and may revoke access at any time.
• AutoPull Sign-In Details and Retrieved Content: If you use AutoPull to have us sign in to a website and retrieve documents on your behalf, we collect the sign-in details you choose to save for that website (username, password, and authenticator-app setup key); the steps you record on the website, which can include text you type such as a username or search terms (passwords and verification codes are never captured in a recording); the verification-code emails you forward to us; and the reports, documents, and page content we retrieve, which may include personal information about you or about others, such as your customers or vendors. We also keep a record of your confirmation that you are authorized to use each website, including who confirmed it, when, and for which website.
• Payment Information: When you subscribe to the Services, payment card information is collected and processed by Stripe Inc. We do not store raw payment card data on our systems.
• Communications: Any information you submit through the Services, including messages, feedback, or support requests.
• Device and Technical Information: Device identifiers, browser settings, time zone, and similar technical data collected automatically when you access the Services.
• Supplemental Information: We may receive additional information about you from third-party sources and combine it with information we have collected directly.

We collect only the information reasonably necessary to provide and improve the Services. We do not knowingly collect personal information from children under the age of 16. If you are under 16, please do not submit any personal information through the Services. If you believe a child under 16 has provided personal information to us, please contact us at info@appadsmarketing.com and we will take appropriate action, including deletion of that information.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Services;
• Process and analyze financial data you connect to the Services, including using AI-assisted tools to surface insights from your data;
• Sign in to websites and retrieve documents and page content on your behalf when you use AutoPull, on the schedule you set or when you ask;
• Read the verification-code emails you forward to us, solely to complete an AutoPull sign-in;
• Notify the team members you designate, by in-app notification, email, or text message, when an AutoPull needs a person to finish it;
• Authenticate your identity and manage your account;
• Process transactions and manage your subscription;
• Respond to your requests, resolve disputes, and provide customer support;
• Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity;
• Send service announcements, administrative messages, and other communications related to your use of the Services (you may opt out of non-essential communications);
• Comply with applicable laws, regulations, and legal obligations;
• Enforce our Terms of Service and other policies;
• Analyze usage patterns to improve the Services and develop new features.

We do not use your financial data for advertising purposes and do not sell or share your personal information with third parties for their own marketing use.

3. AI Processing of Your Data

The Services include AI-powered features that analyze your connected data to provide insights and assistance. This constitutes automated processing of your personal information. When your data is processed by AI systems, we apply the following protections:

• PII Tokenization: When you import files into Pulse AI, personally identifiable information in the imported data — including Social Security numbers, credit card numbers, email addresses, phone numbers, dates of birth, and bank routing numbers — is detected and replaced with opaque tokens before the data is sent to an AI provider to be organized. These tokens are reversed before your data is saved. Tokenization does not apply to other AI processing, such as your messages to Pulse AI and the results of the data queries it runs for you, or to the document processing described below.
• Document Processing: When you use document processing features — including templates that read documents with AI, documents you send to us by email, and AutoPull — the document's content, including images of its pages, is sent to our AI providers so they can read it and extract its data. If you turn on the AI summary for an AutoPull, the retrieved content is also sent to an AI provider to summarize it. This content is sent in identifiable form, because the provider must read it to extract the data.
• Data Minimization: Only data necessary to fulfill your specific AI-assisted request is transmitted. We do not send your entire data set to AI providers by default.
• Third-Party AI Providers: We use Anthropic and OpenAI as AI service providers. These providers process data only as necessary to return a response and are bound by data processing agreements that restrict further use of your data.
• No Autonomous Decisions: AI outputs in the Services are informational and analytical in nature. We do not use automated AI processing to make decisions that produce legal or similarly significant effects about you without human review.

4. How We Share Your Information

We do not sell your personal information. We do not share your personal information with third parties for their own marketing or advertising purposes. We may share your information only in the following circumstances:

• Service Providers: We share information with trusted third-party vendors who assist us in operating the Services under contractual obligations to protect your data. These include:
  • Plaid Inc. — financial data connectivity (plaid.com/legal)
  • Stripe Inc. — payment processing (stripe.com/privacy)
  • SmarterASP.NET — primary web application hosting, Microsoft SQL Server database hosting, and email hosting (including the mailboxes that receive the documents and verification-code emails you send or forward to us)
  • Amazon Web Services (AWS) — cloud storage
  • Cloudflare Inc. — content delivery and cloud storage
  • DigitalOcean LLC — cloud infrastructure for supplemental application services
  • Twilio Inc. — communications and SMS notifications
  • Browserbase — hosted browser sessions used to sign in to websites and retrieve content on your behalf (AutoPull). Sign-in details you save are entered into the website inside a Browserbase session. Browserbase keeps a video recording of each session for up to 31 days, along with technical session logs.
  • Anthropic PBC / OpenAI — AI-assisted features and document processing (see Section 3 for when PII tokenization applies)
• Legal Requirements: We may disclose information where required by law, court order, or government authority, or where necessary to protect the rights, property, or safety of App Ads Marketing, our users, or others.
• Business Transfers: If App Ads Marketing is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may share your information for other purposes with your explicit prior consent.

5. Cookies and Tracking

We use cookies and similar tracking technologies to operate and improve the Services. Cookies are small files stored on your device that help us maintain your session, remember your preferences, and analyze usage.

Analytics Tools: We do not use third-party analytics services (such as Google Analytics, Mixpanel, or similar tools) to track your activity across the Services. Usage data collected by the Services is processed internally and is not shared with analytics providers.

Do Not Track: Some browsers offer a "Do Not Track" (DNT) signal. The Services do not currently respond to DNT signals as no uniform standard for DNT compliance has been adopted. We will revisit this position if a standard is established.

You may configure your browser to refuse cookies, but doing so may limit your ability to use certain features of the Services. We are not responsible for cookies placed by third-party services embedded in or linked from the Services.

6. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of sensitive data at rest using AES-256-GCM with account-specific keys;
• Encryption of all data in transit using TLS 1.2 or higher, with HTTP Strict Transport Security (HSTS) enforced;
• Role-based access controls limiting access to your data within the Services;
• Multi-factor authentication (MFA) support for user accounts, which we strongly encourage you to enable;
• Application-layer security controls including CSRF protection and session expiration;
• AutoPull sign-in details (username, password, and authenticator-app setup key) encrypted at rest with AES-256-GCM using account-specific keys, never displayed back in the Services, and decrypted only on our servers while a retrieval is running;
• Passwords and verification codes kept out of AutoPull recordings and masked in diagnostic records;
• Requests to our hosted-browser provider to delete saved browser data, such as cookies, when an AutoPull recording ends and when you delete an AutoPull;
• Live views of AutoPull browser sessions available only to users with the corresponding permission.

No method of transmission over the internet or electronic storage is 100% secure. While we implement commercially reasonable security measures, we cannot guarantee the absolute security of your information.

7. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Investigate and contain the breach as promptly as practicable;
• Notify affected users without unreasonable delay and, where required by applicable law, within the legally specified timeframe (typically 30–72 hours for regulatory notifications and as soon as reasonably possible for individual notifications);
• Notify relevant third-party partners (including Plaid and Stripe) as required by our agreements with them;
• Provide information about the nature of the breach, the data affected, steps taken, and recommended actions you can take to protect yourself.

To report a suspected security issue, contact us immediately at info@appadsmarketing.com.

8. Data Retention

We retain your personal information for as long as your account is active or as necessary to provide the Services, subject to the following general guidelines:

• Account data: Retained for the duration of your account. Upon closure, personal data is removed from active systems within a reasonable period, typically within 90 days.
• Financial transaction data: Retained for up to 7 years where required or advisable under applicable financial recordkeeping laws and regulations.
• Application logs and error records: Retained for up to 12 months for security and debugging purposes.
• Communications and support records: Retained for up to 3 years to resolve disputes and maintain service quality.
• Payment records: Retained as required by Stripe and applicable tax and financial regulations.
• AutoPull sign-in details: Retained until you remove them, delete the AutoPull, or your account data is deleted.
• AutoPull recordings, run history, and authorization records: Retained until you delete the AutoPull or your account data is deleted. Documents and data retrieved by AutoPull are retained like your other documents, until you delete them or your account data is deleted.
• Forwarded verification-code emails: Deleted from our mailbox after the code is used. Messages that do not match an AutoPull, and anything else left in the mailbox, are deleted within 24 hours. We keep a log of each message's sender, recipient, subject, and outcome — and, when no code can be found in a message, a copy of the message — for up to 7 days to diagnose problems.

We may retain certain information beyond these periods where required by law, to resolve disputes, prevent fraud, or fulfill our contractual obligations. When data is no longer required, we delete or anonymize it securely.

9. Your Rights and Choices

Depending on where you reside, you may have certain rights with respect to your personal information. To exercise any of these rights, contact us at info@appadsmarketing.com. We will respond to verifiable requests within 45 days, or as otherwise required by applicable law.

• Access: You have the right to request a copy of the personal information we hold about you.
• Correction: You have the right to request that we correct inaccurate or incomplete personal information. You may update most information directly through your account settings.
• Deletion: You may request deletion of your personal information. We will honor such requests subject to any legal retention obligations. Note that some information may need to be retained to comply with law or resolve outstanding matters.
• Data Portability: You have the right to receive a copy of your personal information in a structured, commonly used, machine-readable format, where technically feasible.
• Opt-Out of Communications: You may opt out of non-essential communications at any time through your account settings or by contacting us.
• Restrict or Object to Processing: In certain circumstances, you may have the right to restrict or object to our processing of your personal information.
• Financial Account Disconnection: You may disconnect any linked financial account at any time through the Services. Upon disconnection, we will cease retrieving new data from that account. Previously retrieved data is subject to our retention policy above.

We do not discriminate against users who exercise their privacy rights.

10. California Residents — Additional Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following additional rights:

• Right to Know: You have the right to know the categories and specific pieces of personal information we collect, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Data Portability: You have the right to receive your personal information in a portable format.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information and do not share it with third parties for cross-context behavioral advertising. You therefore have nothing to opt out of under this provision, but you may confirm this practice at any time by contacting us.
• Right to Limit Use of Sensitive Personal Information: We collect financial data and, if you use AutoPull, website sign-in details (account log-ins with passwords), both of which qualify as sensitive personal information under CPRA. We use sensitive personal information only to provide the Services you have requested. We do not use it for inferring characteristics about you unrelated to the Services or for secondary commercial purposes.
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California rights, contact us at info@appadsmarketing.com. We will verify your identity before processing your request and respond within 45 days (with one possible 45-day extension where reasonably necessary).

Authorized Agents: California residents may designate an authorized agent to submit requests on their behalf. We will require written proof of authorization and may verify your identity directly.

11. Other U.S. State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states with enacted consumer privacy laws may have rights similar to those described above, including rights to access, correct, delete, and port personal information, and to opt out of certain processing activities. We extend these rights to all U.S. residents to the extent required by applicable state law.

Right to Appeal: If we decline to take action on your privacy rights request, you may appeal that decision by contacting us at info@appadsmarketing.com with the subject line "Privacy Rights Appeal." We will review your appeal and respond within 60 days. If your appeal is denied, we will provide information about how to contact your state's attorney general or applicable regulatory authority.

12. Account Protection

Your account password is the key to protecting your personal information. Use a strong, unique password and do not share it with others. You are responsible for all activity that occurs under your account. If you believe your account has been compromised, contact us immediately at info@appadsmarketing.com and change your password. The Services support multi-factor authentication (MFA) via authenticator app, email code, or SMS code, which we strongly encourage you to enable.

13. Third-Party Links and Services

The Services may contain links to or integrations with third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you connect to or access through the Services. We are not responsible for the privacy practices or content of third-party services.

14. Cross-Border Data Transfers

The Services are operated and hosted in the United States. If you access the Services from outside the United States — including from Canada — your personal information will be transferred to, stored, and processed in the United States and in other countries where our service providers maintain infrastructure. Data protection laws in these countries may differ from those in your home country. By using the Services, you acknowledge and consent to this transfer and processing.

Our primary infrastructure providers and the countries in which they operate include:

• SmarterASP.NET — United States (primary web application and SQL Server database hosting)
• DigitalOcean — United States (supplemental application infrastructure)
• Amazon Web Services (AWS) — United States (cloud storage)
• Cloudflare — United States and global edge network (content delivery)
• Stripe — United States (payment processing)
• Browserbase — United States (hosted browser sessions for AutoPull)
• Anthropic / OpenAI — United States (AI processing; see Section 3 for when PII tokenization applies)

We take steps to ensure that personal information transferred across borders receives a comparable level of protection to that required in your home jurisdiction, including through contractual safeguards with our service providers.

15. Canadian Residents — Additional Rights (PIPEDA and Quebec Law 25)

If you are a resident of Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you are a resident of Quebec, under Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). The following additional information applies to you.

Cross-Border Transfers and Comparable Protection: Your personal information is transferred to and processed in the United States. PIPEDA permits such transfers provided that comparable protections are in place. We ensure this through contractual agreements with our service providers. Please be aware that once your information is in the United States, it may be subject to lawful access by U.S. government authorities under applicable U.S. laws.

Consent: We rely on your consent as the legal basis for collecting, using, and disclosing your personal information. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us at info@appadsmarketing.com. Withdrawal of consent may affect our ability to provide the Services to you.

Your Rights Under Canadian Law: In addition to the rights described in Section 9 above, Canadian residents have the right to:

• Access: Request access to the personal information we hold about you and receive an explanation of how it has been used or disclosed.
• Correction: Challenge the accuracy or completeness of your personal information and request that it be corrected.
• Withdraw Consent: Withdraw consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual limitations.
• Complain to a Regulator: Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or, for Quebec residents, with the Commission d'accès à l'information du Québec (CAI) at cai.quebec.ca.

Quebec Residents — Additional Requirements (Law 25):

• Privacy by Default: We apply privacy-protective defaults when collecting and using personal information. We collect only the minimum information necessary to provide the Services.
• Automated Decision-Making: Where the Services use automated processing (including AI-assisted features) to analyze your personal information, you have the right to be informed of this fact, to request that a person review any automated decision that significantly affects you, and to submit observations regarding such a decision.
• De-indexation / Deletion: Quebec residents have the right to request that personal information collected online be de-indexed or that any hyperlink enabling access to that information be suppressed, where continued dissemination causes serious injury to you.
• Data Portability: Quebec residents have the right to receive personal information held about them in a structured, commonly used technological format and to request that it be communicated to any person or body authorized to collect such information.
• Cross-Border Transfer Assessment: Before transferring personal information outside Quebec, we conduct a privacy impact assessment (PIA) to ensure the information receives adequate protection in the destination jurisdiction, as required under Law 25.

To exercise any of your Canadian privacy rights, please contact us at info@appadsmarketing.com with the subject line "Canadian Privacy Request." We will acknowledge your request within 10 business days and respond fully within 30 days, or as otherwise required by applicable law.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on this page with a revised effective date and, where appropriate, by sending an email notification at least 14 days before the changes take effect. Your continued use of the Services after any changes constitutes your acceptance of the updated policy. We will not materially reduce your rights under this policy without your explicit consent.

Prior versions of this Privacy Policy are available upon request.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: