This Privacy Policy explains what information Havadis collects, how we use it, and the choices you have. We aim for plain-language transparency over dense legalese. If something here is unclear, write to us.
Data we collect
Account data: your name, email address and profile image when you sign in with Google, and your email address when you sign in with a code we email you. Workspace content you create inside Havadis: topics, brand profiles, generated posts, personas, analysis results. Data from the accounts you choose to connect to a brand, within the permissions you grant; each platform is covered in its own section below. Operational data such as log events, API usage, and error traces needed to run the service. When you create an account, we record with it how you found us on that visit: the name of the site that referred you, the first page you opened, any campaign tags in the link, and which assistant you opened, or whether you copied the question, in the “Ask AI about Havadis” section. We use no cookies or browser storage for this; it travels only with your sign-in request, which for Google sign-in passes through Google’s sign-in page. We do not buy personal data from third parties.
How we use your data
To authenticate you, provision your workspace, run the content and analysis pipelines you request, publish to your connected channels and send notifications at your instruction, prepare performance reports, recaps and Ulaq's answers, enforce plan limits and credits, understand how people find Havadis, answer support requests, and improve reliability and quality. We do not sell your data, and we do not use your workspace content to train foundation models.
AI processing of your content
When you run an analysis or a content job, we send the relevant inputs to our large-language-model providers (Google Gemini and Eachlabs) to generate outputs. These providers are bound by their own data-processing terms and, for our API tier, do not use request data to train their models. Model outputs are stored in your workspace; you can delete them at any time.
Ulaq data assistant
When you ask Ulaq a question, we compute the answer from the data Havadis stores from the accounts you connected: your Google Search Console and Google Analytics data, and the campaign, ad and search-term data of the ad accounts (Google Ads, Meta, ChatGPT Ads) for which you switched on “Ulaq data assistant” on the connection card. To write the answer, and the AI summary on the performance panel, we pass figures computed from this data to the language-model providers named above. They process it only on our behalf and only to produce the answer, and do not use it to train their models. Using ad data in Ulaq requires your consent for each ad account separately and is off by default. Team members whose role does not include ad spend do not see spend or cost figures in Ulaq's answers either. The same accounts' summary figures also appear on the performance panel, in the weekly recap and in the monthly report; report links you share never show spend or cost figures. When you switch the setting off or disconnect the account, we delete the ad data collected for Ulaq. Ulaq never changes your ad accounts; it only makes suggestions.
Third parties
We rely on: Google (authentication), LLM providers (content generation and Ulaq's answers), Stripe for payments, our email delivery provider for sending email, a managed database and object storage for persistence, and observability providers for logs and metrics. Each receives only the minimum data needed to perform its function. You enter your card details on Stripe's payment page; they are never stored on our servers. We send data to the platforms you connect (publishing, team and ad accounts) only at your instruction. How we handle data received from Google APIs, from Meta platforms, from TikTok and from ChatGPT Ads is covered in the sections below.
Google user data
When you sign in with Google we receive your basic profile (name, email address, profile image). If you choose to connect Google Search Console or Google Analytics to a brand, we access — with read-only scopes — your site's search performance data (queries, clicks, impressions, positions) and aggregated analytics metrics. We use this data for one purpose: showing you how your own content performs and surfacing search opportunities inside Havadis. If you choose to connect Google Ads to a brand, we access the campaigns, ad groups and ads in the ad account you select together with their performance metrics (spend, impressions, clicks, conversions); for accounts where you switched on “Ulaq data assistant”, campaign status, search impression share and the search terms that triggered your ads are added. The Google Ads connection also includes write access so that we can create ad drafts. We use this data to show you how your own ads perform, to write better ad copy and, for those accounts, to prepare Ulaq's answers. Every ad we send to Google Ads at your instruction is created PAUSED; where needed we also create the campaign and ad group, paused, with the budget you set, and we never set an ad live or change your existing campaigns. We do not sell Google user data, do not use it for advertising, do not use it to train AI or machine-learning models, and do not share, transfer, or disclose it to third parties except to the infrastructure providers that host Havadis (listed above) or where the law requires it. If you start a content job from a search query you selected, only that query text enters the normal content pipeline. You can disconnect Google Search Console or Google Analytics at any time from Settings — we delete the stored tokens immediately — and you can also revoke Havadis's access from your Google Account permissions page. Havadis's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Meta platform data
If you choose to connect Facebook (Meta Ads) or Instagram to a brand, we receive data from Meta only within the scopes you grant. For a Meta Ads connection that is: the connected Facebook user's name and id, the list of ad accounts they can reach, the campaigns, ad sets and ads in the account you select together with their performance metrics (spend, impressions, clicks, CTR, conversions), and the name of the Facebook Page you pick when creating a creative. We use this data for one purpose: showing you how your own ads perform, writing better ad copy and, for accounts where you switched on “Ulaq data assistant”, answering your questions about your ads (see the Ulaq data assistant section above). When we generate new ad copy we pass your account's recent ad copy to our language-model provider as input so we do not repeat something you already ran; those providers do not use request data to train their models. For an Instagram or Threads connection we receive your account name and id, and publish to your account only the posts you approve or schedule. We do not sell Meta platform data, do not use it for ad targeting, identity enrichment or surveillance, and do not share it with third parties other than the infrastructure providers that host Havadis (listed above) or where the law requires it. Every ad Havadis creates is created PAUSED; we never create campaigns, ad sets or budgets, never modify your existing ads, and never set an ad live — publishing is your decision in Ads Manager. You can disconnect at any time from Settings and we delete the stored tokens immediately; you can also revoke access from the Business Integrations page of your Facebook account.
TikTok data
When you connect a TikTok account to a brand, Havadis receives from TikTok only the data within the scope you approve: the account's TikTok id, display name and username, and the account settings shown on the posting screen (the privacy options offered, whether comments, duets and stitches are allowed, and the longest video the account can post). The profile picture is only shown on the posting screen and is not stored. Havadis uses this data for one purpose: to post the videos you create in Havadis to your TikTok account at the moment you approve or schedule, with the privacy, interaction and commercial content settings you choose, and to show the post's status and link on your content page. Havadis does not read other videos, followers, messages or statistics of your TikTok account. Videos generated with AI are labeled as AI-generated content on TikTok. TikTok data is not sold, not used for ad targeting or model training, and not shared with third parties other than the infrastructure providers that host Havadis (listed above) and where the law requires it. Access tokens are stored encrypted. You can remove the TikTok connection at any time from Connected accounts in Settings; Havadis then also revokes its access on TikTok and deletes the tokens it stored. You can also remove the access from the permission settings of the TikTok app.
ChatGPT Ads data
If you choose to connect ChatGPT Ads to a brand, you give us the API key you created in Ads Manager. We store the key encrypted and use it only for that ad account. With it we access the campaigns, ad groups and ads in the account together with their performance metrics (spend, impressions, clicks, conversions, sales value). We use this data to show you how your own ads perform, to write better ad copy and, for accounts where you switched on “Ulaq data assistant”, to answer your questions about your ads. Every ad we send at your instruction is created PAUSED; where needed we also create the campaign and ad group, paused, with the budget and bid you set, and we never set an ad live. We do not sell ChatGPT Ads data, do not use it for ad targeting, and do not share it with third parties other than the infrastructure providers that host Havadis or where the law requires it. When you disconnect, we delete the key and the ad data we pulled from the account; you can also revoke the key in Ads Manager.
Publishing and team channels
When you connect a publishing channel such as LinkedIn, your IdeaSoft store or your own site's webhook address, we send to it only the content you approve or schedule, and for that we receive the name and id of your account on that channel. When you connect Slack, Telegram or Microsoft Teams as a team channel, we send the notifications you pick and the weekly recap only to the channel or chat you name, and for that we store its name, its id and the connection details used to post messages. These messages carry content titles, summary figures and links back to Havadis, and everyone in the channel can see them; the channel's platform processes them under its own terms. When you use Havadis buttons and commands in Slack, we link your Slack user id to your Havadis account so the action is attributed to the right person. When you disconnect, we delete the access details we stored.
How we protect your data
All traffic between your browser, our servers, and third-party APIs is encrypted in transit with TLS. Data is stored on managed database and object-storage services that encrypt it at rest. Access details for connected accounts (OAuth access and refresh tokens, Google's included, ChatGPT Ads API keys and Slack webhook addresses) are additionally encrypted at the application level before they are written to the database, are never sent to the browser, and are deleted when you disconnect the account. We request the narrowest scopes that make each feature work (read-only wherever possible), and access to production data is limited to the small set of operators who run the service.
Data retention
Workspace content is retained while your account is active. When you delete a resource it is removed from the live database and purged from backups within the backup rotation window. Daily results pulled from connected ad accounts are deleted automatically 400 days after the day they describe, and of the search terms collected for Ulaq we keep only the latest period. If you close your account, we delete or anonymize your data within 30 days, except where we are required to retain records for legal or billing reasons.
API and developer surface
When you create an API key for your account, we keep a record of the calls made with it: the operation invoked, the key's identity (only its public prefix, never the secret), the outcome, the duration, and the IP address the call came from. We store the IP address so we can detect abuse of a leaked key and protect your account. These records delete themselves after 7 days for MCP server calls and 30 days for REST API calls. We also count each key's daily credit spend; those counters are deleted within 7 days. If your key is detected in a public code repository (GitHub secret scanning partnership), it is automatically suspended to protect your account, and the event is logged.
Your rights
You can access, correct, export, or delete your workspace content from inside the product. For requests that cannot be completed in-app — including deletion of your account — contact us and we will respond within a reasonable time. If you are in the EU or UK, the GDPR gives you additional rights that we honor.
Deleting your data
You can delete your account and the data we hold about you at any time. You can remove most content directly in the app, and disconnect linked accounts (Facebook (Meta Ads), Instagram, Threads, TikTok, LinkedIn, Google Search Console, Google Analytics, Google Ads, ChatGPT Ads, IdeaSoft, Slack, Telegram, Microsoft Teams and your site's webhook connection) from Connected accounts in Settings to revoke their access and delete their stored tokens. When you remove an ad account, we also delete the ad data we pulled from it. To request full deletion of your account and all associated data — including content you generated, ad and performance data pulled from connected accounts, account details, and access tokens — email [email protected] and we will process the request within a reasonable time and confirm once it is complete.
Contact
Privacy questions, data-subject requests, and complaints: contact the team via the email address associated with your account or the support channel shown in your workspace.