Privacy Policy

This Privacy Policy explains how Marketing Machine, LLC, doing business as BrandCTRL AI (“BrandCTRL,” “we,” “us,” or “our”), handles information when you visit brndctrl.ai, use the BrandCTRL application, or connect an advertising or marketing account to our services (collectively, the “Services”).

Information we collect

Depending on how you use the Services, we may collect:

• Account and contact information, such as your name, business name, email address, role, and account credentials.
• Business and campaign information, such as brand materials, audiences, offers, creative assets, campaign settings, advertising budgets, approvals, and instructions you provide.
• Connected-platform data, including account, business portfolio, Page, ad account, campaign, ad set, ad, Pixel, and similar identifiers; permissions granted; advertising performance, spend, conversion, and delivery data; and access tokens used to operate the connection.
• Communications, including support requests, feedback, wait-list submissions, and other messages you send us.
• Usage and device information, such as IP address, browser and device type, pages or features used, timestamps, and security or diagnostic logs.

How we use information

We use information to:

• provide, maintain, secure, troubleshoot, and improve the Services;
• authenticate users and connect the third-party accounts they authorize;
• create, update, deliver, monitor, report on, and optimize marketing campaigns at a customer’s direction;
• show performance results, detect delivery issues, and recommend budget or campaign changes;
• communicate about the Services, onboarding, support, security, and administrative matters;
• prevent fraud, misuse, or violations of our terms; and
• comply with law and enforce or protect legal rights.

Meta Platform Data

If you connect Meta, we receive Meta Platform Data only for the business assets and permissions you approve. We use that data to manage ads and associated Page activity, retrieve advertising insights, provide reporting, and support campaign optimization for your business. We do not use Meta Platform Data to build profiles for unrelated advertising, and we do not sell it.

A connected Meta access token is treated as a credential, restricted to authorized systems and personnel, and used only to make requested or approved calls to Meta. You may disconnect Meta or request deletion as described in our Data Deletion Instructions.

How we disclose information

We may disclose information:

• to hosting, database, security, analytics, communications, and other vendors that process it for us under appropriate obligations;
• to Meta, Google, and other platforms when you direct us to connect an account or carry out an action;
• to authorized members of your organization and service providers you designate;
• when required by law or reasonably necessary to protect rights, safety, and the integrity of the Services; or
• in connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to customary safeguards.

We do not sell personal information for money.

Retention and deletion

We retain information for as long as needed to provide the Services, maintain legitimate business and security records, resolve disputes, and satisfy legal obligations. Connected-platform tokens and account data are deleted or de-identified after disconnection or a valid deletion request, except where limited retention is required by law, needed to prevent fraud, or present temporarily in protected backups that age out under our backup practices.

Your choices and privacy rights

You may ask to access, correct, or delete information about you, or object to or restrict certain processing where applicable. You may also disconnect a third-party account to stop future access. We may need to verify your identity and authority before completing a request. Authorized agents may submit requests where permitted by law.

Security

We use administrative, technical, and organizational safeguards designed to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The Services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13.

International use

BrandCTRL is based in the United States. If you use the Services from another country, information may be transferred to and processed in the United States and other countries where our providers operate.

Changes to this policy

We may update this policy as our Services or legal obligations change. We will post the updated version here and change the date above. We will provide additional notice when required by law.

Contact us

For privacy questions or requests, email privacy@brndctrl.ai.