1. Information We Collect

Account details (name, email address, phone, role, and organization membership); data from connected advertising accounts (see sections 2–3); communication settings, recipients, and the history of messages sent to clients; AI-analyst chat history; and system logs and usage data (see section 5).

2. Information Received from Meta (Meta Marketing API)

When you connect a Meta account via OAuth, the system requests these permissions: ads_read, to read your ad accounts' campaign and performance data; business_management, to list the Business Portfolios and ad accounts you own or manage; ads_management, for the AI analyst's campaign assistant (see below); and public_profile — basic public profile, used to identify the connected account. The system accesses, through the Meta Marketing API, the list of Business Portfolios and ad accounts you own or manage, and their campaign data: campaign, ad set, and ad structure, and performance metrics (spend, impressions, clicks, conversions, leads). This data is used to display, analyze (including AI analysis), generate reports, and produce alerts for the accounts you connected. With ads_management, and only when an agency user asks for it in the AI analyst chat and confirms the change, the campaign assistant can create and edit campaigns, ad sets, and budgets on the ad accounts the agency connected. New campaigns are created paused. Strix does not spend money or switch campaigns on by itself. It is stored in our database (Supabase, United States); access tokens are encrypted with AES-256-GCM. The data is never sold and is not shared beyond the processors listed in section 6. Revoking the permission stops all further access to the data; data already stored is deleted when the account is deleted or on request (see the data deletion page).

3. Information Received from Google (Google User Data)

When you connect a Google Ads account via OAuth (scopes: openid, email, and https://www.googleapis.com/auth/adwords), the system receives your email address to identify the connected account, and accesses, through the Google Ads API, the list of Google Ads accounts accessible to you and their campaign data: campaign settings and performance metrics (spend, impressions, clicks, conversions). This Google user data is used solely to display, analyze, generate reports, and produce alerts inside the system; it is stored in Supabase (United States) and access tokens are encrypted with AES-256-GCM. Google user data is never sold, is not used for advertising, and is not read by humans except with your consent, for security purposes, or as required by law. You can revoke access at any time at myaccount.google.com.

Strix's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Information

Information is used to operate the service: displaying campaign data, analysis and insights (including processing via Anthropic's AI service), generating reports and delivering them to clients (WhatsApp/email), alerts, support, and system security. Information is never sold to third parties and is not used for targeted advertising.

5. Analytics, Cookies, and Session Replay

We use PostHog for product analytics (page views and usage events; URLs are stored without query parameters) and Microsoft Clarity for session replay with sensitive-content masking. These services use cookies and localStorage, alongside the system's essential authentication cookies. This collection also applies to the public pages — the marketing site, the login page, and the legal pages — not only to pages behind sign-in. On the login and signup pages the email and password fields are explicitly masked and are not captured in a recording.

6. Sharing with Third Parties

Information is shared only with processors necessary to operate the service: Supabase (database and authentication, United States), Vercel (hosting), Anthropic (AI analysis), PostHog (analytics), Microsoft Clarity (session replay), Google Workspace (email delivery from office@strixrise.com, and read-only Gmail API access to that mailbox to ingest ad-platform invoice emails so billing receipts can be attached to reports), and Meta and Google (the source of campaign data and WhatsApp message delivery via the WhatsApp Business Platform). Beyond that, information is disclosed only where required by law.

7. Data Security

Ad-platform access tokens are encrypted with AES-256-GCM; traffic is encrypted with HTTPS; full separation between organizations is enforced at the database level (RLS); access to data is restricted by role.

8. Data Retention and Deletion

Data is retained while the account is active. Account deletion by an agency admin immediately deletes all of the organization's data (password-verified, from within the system); deletion by any other user immediately deletes that user's own account, and any remaining personal data is deleted on email request (within 30 days) — see the data deletion page. Only minimal records required by law are retained.

9. Your Rights

You may request access to, correction of, or deletion of personal information at any time by contacting office@strixrise.com, and you may revoke the system's access permissions directly with Meta and Google.

10. Changes to This Policy

Material changes will be announced by email to the address linked to the account; continued use after a change constitutes consent.

11. Contact

Strix, email: office@strixrise.com.