Privacy Policy

1. Introduction

Canda Digital ("Canda", "we", "our", or "us") operates pintone.ai ("Pintone"), an AI-powered campaign design and creation studio that helps marketing teams build, optimise, and publish campaigns using artificial intelligence.

Our platform integrates with a range of third-party AI model providers and advertising platforms, including Meta, to generate campaign content, provide creative suggestions, and enable the import and export of campaign assets between connected accounts.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website pintone.ai or use our platform (collectively, the "Service"). Please read this policy carefully. By accessing or using the Service, you agree to the practices described herein.

2. Information We Collect

2.1. Information You Provide Directly

We may collect the following personal information when you register for or use the Service:

• Account registration details, including name, email address, job title, and company name
• Billing and payment information (processed securely via third-party payment processors)
• Campaign briefs, creative inputs, prompts, and instructions you enter into the platform
• Communications you send us, including support requests, feedback, and inquiries
• Profile preferences and account configuration settings

2.2. Information Collected Automatically

When you access the Service, we automatically collect certain technical and usage data, including:

• IP address and approximate geolocation
• Browser type and version, operating system, and device identifiers
• Pages visited, features used, session duration, and interaction events
• Referral URLs and clickstream data
• Log files, error reports, and performance data

We use cookies and similar tracking technologies to collect this data. Please see Section 8 (Cookies) for more information.

2.3. Campaign Content and Client Data

As an AI campaign design platform, Pintone processes creative content and campaign data that you generate, upload, or import into the Service ("Client Data"). This may include:

• Campaign briefs, copy, creative assets, images, and templates
• Audience segment definitions and targeting parameters
• Campaign performance metrics and historical data
• Content imported from connected third-party platforms, including Meta accounts

You are the data controller for any personal data contained within Client Data. Pintone acts as a data processor when handling such data on your behalf. You are responsible for ensuring you have an appropriate legal basis for sharing any third-party personal data with us, and that doing so complies with applicable privacy laws.

2.4. Data Received from Third-Party Integrations

When you connect Pintone to third-party accounts and platforms, we may receive data from those services in accordance with the permissions you grant and their respective privacy policies. This includes:

Meta (Facebook and Instagram): When you link your Meta Business account, we may access and import campaign data, ad account information, audience data, creative assets, and performance metrics. We may also export completed campaign content and assets to your Meta account on your instruction. The scope of data access is governed by the permissions you grant via Meta's authorisation flow.

You can revoke our access to any connected account at any time via the settings of the relevant third-party platform.

3. How We Use Artificial Intelligence Services

Pintone uses third-party AI model providers to power its campaign design and content generation features. When you use AI-assisted features on the platform, such as generating copy, producing creative concepts, or receiving campaign recommendations, your inputs and relevant context may be transmitted to one or more of these providers for processing.

The AI providers we currently use or may use include:

• OpenAI (openai.com) — for large language model capabilities including content generation and creative suggestions
• Anthropic (anthropic.com) — for large language model capabilities including content generation and reasoning
• Fal AI (fal.ai) — for image and media generation capabilities

Data transmitted to AI providers may include the prompts, creative briefs, campaign content, and contextual instructions you provide. We do not intentionally transmit sensitive personal data to AI providers, but you should avoid including personal data about third parties (such as customer records) in your AI prompts or inputs.

Each AI provider processes data in accordance with their own privacy policy and data processing terms. Where we have entered into Data Processing Agreements with these providers, your data is protected accordingly.

We do not use customer inputs or outputs to train AI models. When using third-party providers such as OpenAI or Anthropic through their APIs, customer data is not used to train those providers' models by default. Providers may retain limited logs for security and abuse-monitoring purposes under their respective terms.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, maintain, and improve the Service
• To power AI-assisted campaign design and generation features on your behalf
• To enable connections with Meta and other third-party platforms, and to facilitate the import and export of campaign data as instructed by you
• To create and manage your account and authenticate your access
• To process payments and manage billing
• To send service-related communications, including onboarding emails, security alerts, and product updates
• To send marketing communications where you have provided consent (you may opt out at any time)
• To analyse usage patterns and improve platform performance and user experience
• To detect, prevent, and respond to fraud, abuse, and security incidents
• To comply with applicable legal obligations

5. Legal Bases for Processing

We process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide the Service you have requested or to fulfil our agreement with you
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving the platform, preventing fraud, and communicating with users, where these interests are not overridden by your rights
• Consent: Where you have given explicit consent, such as for marketing communications or certain cookies. You may withdraw consent at any time.
• Legal Obligation: Where processing is required to comply with applicable law

In relation to our use of third-party AI providers and the Meta integration, we process your data, and facilitate the processing of your Client Data, on the basis of contract performance and, where applicable, your explicit instructions.

6. Sharing of Your Information

We do not sell your personal information. We may share information in the following limited circumstances:

6.1. AI Model Providers

As described in Section 3, prompts and campaign content you enter into the platform are transmitted to third-party AI providers (such as OpenAI, Anthropic, and Fal AI) to generate outputs. These providers act as sub-processors on our behalf. We share only the data necessary to fulfil your request.

6.2. Meta and Connected Advertising Platforms

When you have connected your Meta Business account to Pintone, we share and receive campaign data with Meta as instructed by you. This includes importing existing campaign assets and audience data from Meta, and exporting completed campaign content to your Meta account. Data shared with Meta is subject to Meta's own Privacy Policy and Business Terms.

6.3. Service Providers

We share information with trusted third-party vendors who assist us in operating the Service, including cloud hosting providers, payment processors, customer support tools, and analytics platforms. These providers are bound by confidentiality obligations and are only permitted to use your data to provide services to us.

6.4. Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service if such a transfer occurs.

6.5. Legal Requirements

We may disclose your information where required by law, or where we have a good-faith belief that disclosure is necessary to comply with a legal obligation, protect our rights or property, prevent fraud, or protect the safety of our users or the public.

6.6. With Your Consent

We may share your information for other purposes with your explicit consent.

7. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service, resolve disputes, enforce our agreements, and comply with legal obligations.

AI-generated outputs and campaign content are retained in your account until you delete them or your account is closed. Upon account termination, we will delete or anonymise your personal data within 90 days, unless we are required to retain it by law.

Data imported from Meta and other connected platforms is retained only as long as necessary to deliver the requested functionality, and is subject to your instructions regarding deletion.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyse platform usage, and support marketing efforts. The types of cookies we use include:

• Strictly Necessary Cookies: Required for the Service to function. These cannot be disabled.
• Analytics Cookies: Help us understand how users interact with the platform. Used only with your consent where required.
• Functional Cookies: Enable personalised features such as saved preferences and session continuity.
• Marketing Cookies: Used to deliver relevant advertising. Used only with your consent.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

9. International Data Transfers

Pintone operates globally, and your information may be transferred to and processed in countries other than your own, including countries that may not provide an equivalent level of data protection to your home jurisdiction.

This includes transfers inherent in our use of AI model providers (such as OpenAI and Anthropic, which are based in the United States) and our integration with Meta. Where we transfer personal data from the EEA, UK, or Switzerland to third countries, we implement appropriate safeguards.

10. Data Security

We implement industry-standard technical and organisational security measures to protect your information. These include:

• Access controls, role-based permissions, and multi-factor authentication
• Employee training on data protection and information security practices

While we take data security seriously, no method of transmission over the internet or electronic storage is entirely secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and to protect your account credentials.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant authorities in accordance with applicable law.

11. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data, subject to certain legal exceptions
• Restriction: Request that we limit how we process your data in certain circumstances
• Portability: Receive your personal data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests or for direct marketing purposes
• Withdraw Consent: Withdraw consent at any time where processing is consent-based, without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at data@canda.digital. We will respond within the timeframe required by applicable law (typically 30 days).

If you are based in the EEA or UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

12. Your Meta Account and Data

When you connect your Meta Business account to Pintone, you authorise us to access certain data from your Meta account and to act on your instructions in relation to that data. Specifically:

• We access only the Meta account data and permissions you explicitly authorise during the connection flow
• We use your Meta data solely to provide the import, export, and campaign management features you have requested
• We do not use your Meta data for advertising or profiling purposes unrelated to the Service
• You can disconnect your Meta account from Pintone at any time via your Pintone account settings or through your Meta Business Settings

Upon disconnection, we will cease accessing your Meta account. Residual data already imported into the platform will be subject to our standard retention practices and can be deleted upon request.

13. AI-Generated Content and Your Inputs

When you use Pintone's AI-powered features, you provide inputs (such as campaign briefs, brand guidelines, audience descriptions, and creative directions) that are processed by third-party AI models to generate outputs.

Please be aware of the following:

• Do not include sensitive personal data about third parties (such as customer names, email addresses, or other personal identifiers) in your prompts or inputs to AI features
• AI-generated outputs are not guaranteed to be accurate, complete, or free from bias. You are responsible for reviewing all AI-generated campaign content before publication or use
• You retain ownership of the inputs you provide and the outputs generated for your account, subject to the terms of the applicable AI providers
• Canda Digital does not claim ownership of your campaign content or AI-generated outputs

14. Children's Privacy

The Service is intended for business users and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately and we will take steps to delete it.

15. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party platforms. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you use in connection with Pintone, including Meta, OpenAI, Anthropic, and Fal AI.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors, including changes to the AI providers or third-party platforms we integrate with. When we make material changes, we will notify you by email or by posting a prominent notice on the Service, with the updated effective date at the top of this page.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

17. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us: