Anneala Corporation
← Back to home

Privacy Policy

Last updated: May 15, 2026

1. Introduction

Anneala (“we,” “our,” or “us”), operated by Anneala Corporation, provides the Anneala application (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using the Service, you consent to the practices described in this policy.

2. Definitions

  • “Personal Information” means any information that identifies, relates to, or could reasonably be linked to you as an individual.
  • “Usage Data” means information collected automatically when you interact with the Service, including pages visited, features used, timestamps, and device information.
  • “Ad Account Data” means performance metrics, creative assets, and campaign information retrieved from your connected Meta ad account.
  • “Brand Data” means product details, visual identity preferences, copy strategy, and other configuration you provide during brand setup.

3. Information We Collect

Information You Provide Directly

  • Account Information: When you sign in with Facebook, we receive your name, email address, and profile information as authorized by you through Meta’s OAuth flow.
  • Brand Setup: Information you provide during brand setup, including product details, visual identity preferences, copy strategy, and compliance guardrails.
  • Communications: Any messages or feedback you send to us directly.

Information Collected Automatically

  • Meta Ad Account Data: With your permission, we access your Meta ad account data including ad performance metrics (spend, conversions, CPA, CTR), ad creative assets (images, copy), and campaign structure. This data is used solely to analyze your ad performance and generate new ad creative.
  • Usage Data: We collect information about how you interact with the Service, such as pages visited, features used, session duration, and referring URLs.
  • Device Information: Browser type, operating system, and IP address may be collected through standard server logs.

4. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

  • Essential Cookies: Required for authentication and session management. These cannot be disabled without losing access to the Service.
  • Functional Cookies: Used to remember your preferences and settings across sessions.

We do not use advertising or third-party tracking cookies. We do not engage in cross-site behavioral tracking.

5. How We Use Your Information

We use the information we collect to:

  • Authenticate your identity and maintain your session
  • Analyze your ad performance data to identify winning patterns and dimensions
  • Generate new ad creative (copy, image prompts, and strategy) tailored to your brand
  • Improve, optimize, and develop new features for the Service
  • Communicate with you about the Service, including support requests
  • Detect, prevent, and address security issues or abuse
  • Comply with legal obligations

6. AI Processing and Model Training

Your Ad Account Data and Brand Data are processed by third-party AI services (Anthropic and OpenAI) to perform analysis and generate ad creative. This processing occurs on-demand when you initiate an analysis or generation run.

We do not use your Ad Account Data or Brand Data to train, fine-tune, or improve our own or any third-party machine learning models. Your data is used solely to provide the Service to you.

7. Data Storage and Security

We implement industry-standard technical and organizational measures to protect your data:

  • Meta access tokens are encrypted using AES-256 encryption before storage
  • All data in transit is protected via HTTPS/TLS encryption
  • Sessions are managed with signed JWT tokens with automatic expiration
  • Database access is restricted and protected by network-level controls
  • Employee access to user data is limited to what is necessary for support

Your data is stored on secure servers hosted by Amazon Web Services (United States). Ad creative assets and generated images are stored on Cloudflare R2 (distributed globally). While we take reasonable precautions, no method of electronic transmission or storage is completely secure.

8. Sub-Processors

We use the following sub-processors to deliver the Service. Each processes your data only as necessary to perform its designated function on our behalf:

  • Meta Platform (Facebook): Authentication and ad account data access
  • Anthropic: AI-powered ad analysis including vision analysis, taxonomy extraction, and creative generation
  • OpenAI: Image generation and text embeddings for concept mapping

Each sub-processor maintains its own privacy policy governing its handling of your data. We encourage you to review them.

9. Data Sharing and Disclosure

We do not sell, trade, or rent your Personal Information to third parties. We may share your data only in the following circumstances:

  • Service Providers: With third-party service providers listed above, solely to operate and deliver the Service
  • Legal Requirements: If required by law, regulation, subpoena, court order, or other legal process
  • Protection of Rights: To protect our rights, privacy, safety, or property, or that of our users or the public
  • Business Transfer: In connection with a merger, acquisition, reorganization, or sale of assets, in which case your data may be transferred to the successor entity
  • Aggregated Data: We may share anonymized, aggregated data that cannot reasonably be used to identify you

10. Data Retention and Deletion

We retain different categories of data for different periods:

  • Account Information: Retained for as long as your account is active
  • Ad Account Data and Analysis Results: Retained for as long as the associated brand exists in your account
  • Server Logs: Retained for up to 90 days
  • Backup Data: Purged within 30 days of deletion from primary systems

You may request deletion of your account and all associated data at any time by contacting us or through Facebook’s data deletion controls. Upon deletion, we will remove your Personal Information, Meta access tokens, brand setup data, analysis results, and generated ad data from our active systems.

11. Your Rights

Depending on your location, you may have some or all of the following rights regarding your Personal Information:

  • Access: Request a copy of the Personal Information we hold about you
  • Correction: Request correction of inaccurate or incomplete data
  • Deletion: Request deletion of your Personal Information
  • Portability: Request your data in a structured, machine-readable format
  • Restriction: Request that we limit processing of your data in certain circumstances
  • Objection: Object to processing of your data for specific purposes
  • Withdraw Consent: Withdraw consent for data processing at any time, without affecting the lawfulness of processing performed before withdrawal
  • Revoke Platform Access: Revoke Meta permissions at any time through your Facebook settings

To exercise any of these rights, contact us at support@anneala.com. We will respond to verified requests within 30 days.

12. Children’s Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect Personal Information from children. If we become aware that we have inadvertently collected data from a person under 18, we will take steps to delete that information promptly. If you believe a child has provided us with Personal Information, please contact us immediately.

13. Do-Not-Track Signals

Our Service does not currently respond to Do-Not-Track (DNT) browser signals. However, as noted above, we do not use third-party advertising or behavioral tracking cookies.

14. International Data Transfers

Your data is processed and stored in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

By using the Service, you consent to this transfer. Where required by applicable law, we rely on appropriate legal mechanisms (such as Standard Contractual Clauses) to ensure adequate protection for transferred data.

15. Supplemental Regional Terms

For California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

  • Know what categories of Personal Information we collect and the purposes for collection
  • Request deletion of your Personal Information
  • Opt out of the sale or sharing of your Personal Information (we do not sell your data)
  • Not be discriminated against for exercising your privacy rights

In the preceding 12 months, we have collected the categories of information described in Section 3. We have not sold Personal Information to third parties.

For European Economic Area, UK, and Swiss Residents (GDPR)

Where we process your Personal Information under GDPR, we do so on the following legal bases:

  • Consent: When you connect your Meta account and authorize data access
  • Contract Performance: To provide the Service you have requested
  • Legitimate Interests: To improve and secure the Service, provided these interests do not override your rights
  • Legal Obligation: To comply with applicable laws

You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data in compliance with applicable law.

16. Meta Platform Data Use

Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including the Limited Data Use requirements.

17. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that significantly affect how we handle your data, we will make reasonable efforts to notify you (for example, by email or a prominent notice within the Service) before the changes take effect. We will always update the “Last updated” date at the top of this page.

18. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a security concern, please contact us at:

Anneala Corporation
Email: support@anneala.com

We aim to respond to all inquiries within 30 days.