Privacy Policy

Equaliser AI processes advertising platform metrics on your behalf. The data we collect is strictly limited to what is necessary for campaign analysis and reporting.

Platform metrics: spend, impressions, clicks, conversions, revenue, ROAS, CPA, and related performance data from connected advertising and commerce platforms (Google Ads, Meta Ads, Microsoft Advertising, TikTok Ads, OpenAI Ads, GA4, Google Merchant Center product feed data, and Shopify order and product data). A platform appears only where that client runs it.

Campaign structure: campaign names, ad group names, search terms, product feed attributes, and audience segments.

Account information: your name, email address, organisation name, and role, collected during registration.

Usage data: pages visited, features used, and actions taken within the application (stored in our audit log for security purposes).

We do not ingest customer PII fields, payment data, or click-stream data. Free-text fields such as search terms can incidentally contain personal data; a redaction layer strips common identifiers (emails, phone numbers, postcodes) before any prompt leaves our systems.

We process personal data on the following bases:

Performance of a contract (Art. 6(1)(b) UK GDPR): delivering the Equaliser AI service to the agency that holds your account, covering account provisioning, authentication, billing, and the AI-driven analyses, reports and recommendations that are the subject of that contract.

We also rely on legitimate interests (Art. 6(1)(f) UK GDPR) for product analytics that improve service quality (anonymised feature usage), security event logging in our immutable audit log, AI output quality scoring, and detection of fraud or abuse. The legitimate interests pursued are the secure, reliable and continuously improving operation of a paid-media intelligence platform. We have assessed that these interests do not override the rights and freedoms of data subjects given the nature of the data (we do not ingest identified end-user records, and incidental personal data in free text is redacted) and the safeguards applied (RLS isolation, encryption at rest, retention limits).

Compliance with a legal obligation (Art. 6(1)(c) UK GDPR) covers retaining billing records for the period required by HMRC (currently six years), responding to lawful requests from regulators including the Information Commissioner’s Office, and breach notification.

Consent (Art. 6(1)(a) UK GDPR) applies only where explicitly requested, such as inclusion in product research or beta features. Consent can be withdrawn at any time at contact@equaliser.co.uk without affecting the service.

Where you connect a paid-media account (e.g. Google Ads, Meta Ads), we process the data we ingest from that account on behalf of the agency that holds the connection: the agency is the controller for that data, and we act as a processor under our Data Processing Agreement.

Performance analysis: aggregating and analysing campaign metrics to surface insights, anomalies, and optimisation opportunities.

AI-powered reporting: generating narrative summaries, diagnostic reports, and strategic recommendations using large language models.

Trend detection: identifying patterns across time periods to support forecasting and budget allocation decisions.

Product intelligence: analysing product feed data to identify performance tiers and supplemental feed opportunities.

All analysis is advisory only. Equaliser connects with read-only scopes and does not execute changes on your ad accounts. If per-action execution ships in the future, every action will require explicit human approval, under scopes you grant at that point and can revoke.

Database: Supabase (eu-west-2, London), with Row-Level Security policies enforcing organisation-level data isolation. All data encrypted at rest with AES-256.

Data warehouse: Google BigQuery (europe-west2, London), used for metric aggregation and view materialisation. Data encrypted at rest and in transit.

Application hosting: Vercel, with serverless functions in the EU (Frankfurt) and US failover only under provider outage. Vercel serves static assets from a global edge network; application data does not persist outside the EU/UK except under failover. TLS 1.2+ is enforced in transit (connections negotiate TLS 1.3 in practice).

All infrastructure providers maintain SOC 2 Type II certification independently.

Access to production systems is restricted to authorised personnel with multi-factor authentication.

Equaliser AI uses third-party sub-processors for hosting, data warehousing, AI inference, ingestion, monitoring, billing, and email delivery. Every vendor handling customer data is listed in our sub-processor register at /trust/subprocessors with the data they see, the region it sits in, and the contractual safeguard (DPA / SCC / UK IDTA) in place.

The register is the canonical source: it is updated when a vendor is added, removed, or changes region. Customers receive 30 days’ notice before any change takes effect.

The register currently includes Vercel (hosting), Supabase (database and auth), Google Cloud (data warehouse), Anthropic (AI inference), Funnel (data ingestion), Stripe (billing), Resend (email), Sentry (error monitoring), Langfuse (AI observability), GitHub (source code, no customer data) and PostHog (product analytics).

No customer data is sold, rented, or shared with any third party for marketing or advertising purposes. AI inference vendors (currently Anthropic) operate under zero-retention contracts and do not train models on customer data.

Active accounts: your data is retained for the duration of your subscription. Historical aggregated metric data is retained for the life of your subscription to support year-on-year analysis, and deleted on termination as described below.

Cancelled accounts: data is retained for 30 days after account cancellation to allow for reactivation. Deletion from live systems then completes within 30 days of termination; encrypted backups roll off within a further 90 days (120 days in total), as set out in the Data Processing Addendum.

Audit logs: retained for 12 months for security and compliance purposes, then automatically purged.

AI-generated outputs (stories, reports, recommendations): retained for the duration of your subscription and deleted with your account.

Right of access: request a complete copy of all data we hold about you and your organisation at any time.

Right to export: download all your data in machine-readable JSON format from your account settings (Settings, then Security), or on request (GDPR Article 20, data portability).

Right to deletion: request complete deletion of your account and all associated data. We will comply within 30 days.

Right to rectification: request correction of any inaccurate data we hold about you.

Right to restrict processing: request that we limit how we process your data while a complaint is being resolved.

To exercise any of these rights, contact contact@equaliser.co.uk. We will respond within 30 days.

Equaliser AI sets only essential cookies: the ones the application cannot function without:

Authentication token: a secure, HTTP-only session cookie that keeps you signed in. Expires when you log out or after 7 days of inactivity.

Theme preference: a local storage value that remembers your light/dark mode choice.

Product analytics: we use PostHog (EU-hosted) in cookieless mode to understand which features are used. It sets no cookies and writes no persistent identifiers to your browser, and we do not use session recording. Analytics events carry your user and organisation IDs so we can support you; they are never shared for marketing.

We do not use advertising cookies, cross-site tracking, or any third-party cookie-based tracking.

Primary data stores are in the EU/UK (Supabase in London, BigQuery in London), with application functions in the EU (Frankfurt) and US failover only under provider outage. Anthropic API calls use the EU endpoint where available, US otherwise, under a zero-retention agreement. Application data does not persist outside the EU/UK except under failover.

All international transfers are protected by the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum (IDTA), plus supplementary technical measures including encryption in transit and at rest.

We will notify you of material changes to this privacy policy via email and an in-app notification at least 14 days before the changes take effect.

Continued use of the service after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, data requests, or complaints:

Email: contact@equaliser.co.uk

Data protection contact: contact@equaliser.co.uk; a named officer is being appointed.

Data Controller: Equaliser Ltd (company number 15428137), registered office: Suite F, The Towers, Towers Business Park, Wilmslow Road, Manchester M20 2SL, United Kingdom.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.