Privacy Policy

• Account details: your name and email address, and your password stored as a one-way hash. If you sign in with Google, we store the name, email address and account id Google gives us.
• Workspace and brand data: workspace settings, members and guests you invite, brands and their brand kits, competitors, personas, research, concepts, creative, funnels, pages, canvases and the comments and approvals on them.
• Uploads: images, logos, PDFs, videos, text and review exports you add, and web pages you import into a canvas.
• Emails sent to your workspace inbox address, such as competitor newsletters you subscribe it to.
• Usage records: the metered actions you take, the activity log of who did what in a workspace, and the thumbs up or down and notes you leave on outputs. The activity log stores a hashed form of your IP address, never the address itself.
• Sign-in security records: when you last signed in, your two-factor secret (encrypted) and recovery codes (hashed), and short-lived counters that slow down repeated failed sign-ins.
• Payment records: your plan, its status and your Stripe customer reference. Stripe takes the payment on its own pages, so we never see or store full card numbers.

You choose which services to connect, brand by brand. Each one is optional.

• Meta: CTRL connects to your ad account to read ad performance, creative and spend, and uses that connection only for reading. The access token is encrypted before it is stored. A change happens only when a workspace admin queues it (or SIBT Autopilot, once an admin has switched it on), and our runner then makes it through Meta's official tools, with every step recorded in the brand's Meta changes list.
• Shopify: CTRL reads orders and products to show store performance. For each order it keeps totals, discounts and codes, refunds, line items, whether the customer was new or returning, and where the visit came from (tracking tags, landing page, referring site). It never requests or stores customer names, email addresses, phone numbers, postal addresses or customer ids. Disconnecting Shopify deletes the access token and the synced store data.
• Klaviyo: CTRL stores your private key or sign-in tokens encrypted. It stores campaign and flow results (names, subject lines, preview text, send times, audience names and totals such as recipients, opens, clicks and revenue), reads campaign content so SIBT can classify it, reads list and segment names and sizes, and creates drafts. It never reads or stores your subscribers' profiles. Disconnecting removes the key or tokens.
• Google sign-in: if you use it, Google tells us your name, email address and account id. We do not get access to anything else in your Google account.
• AI assistants: if you connect CTRL to an AI assistant or create an API key, we store a hashed form of each key and token, never the key itself, and you can revoke them in Settings.

When you publish a landing page with CTRL, we count views, clicks and orders for it. To do that we set small first-party cookies on that page that keep a visitor on the same version of an A/B test (for up to 60 days), note that they visited, and stop one order counting twice. They hold no name or contact details. Counts are kept per page and per day, never one record per person.

You are responsible for telling visitors to your pages about this, for example in your own privacy notice.

• To run CTRL for you: sign you in, store your work, run the actions you ask for and show you your numbers.
• To produce SIBT's outputs, by sending the prompts and content they need to AI model providers.
• To bill you and apply your plan's allowances.
• To keep CTRL secure, prevent abuse and fix problems.
• To send emails you need, such as address checks, password resets, invites and workspace notifications.
• To improve SIBT's prompts from the feedback you leave on outputs.

We do not sell personal data. We share it only with the services that run CTRL, and only what each one needs:

• Hosting and file storage: Vercel.
• Database: Supabase.
• Payments: Stripe.
• Email we send: Resend.
• AI model providers that process prompts and content to produce outputs.
• Services that receive email for your workspace inbox, read public web pages and the public Meta Ad Library, and take page screenshots.
• The services you connect yourself: Meta, Shopify, Klaviyo and Google.
• Our own team, when you buy a Deep VOC run, when our runner makes a Meta change you queued, or when you ask us for help.

We may also share data where the law requires it, or to protect our users, CTRL or the public.

CTRL uses only the cookies it needs to work: a session cookie that keeps you signed in (for up to 30 days), and short-lived cookies that protect two-factor sign-in, Google sign-in and connecting Klaviyo. Pages you publish use the counting cookies described above.

Your browser also remembers the AI model you last picked on a canvas, in its local storage. We do not use advertising cookies or third-party analytics on CTRL.

We keep your data while your account is open. You can delete much of it yourself:

• Delete a brand from My brands. This removes the brand, its brand kit, its uploaded files and its stored Meta performance data.
• Delete research, concepts, funnels, canvases, personas and generated creative one by one.
• Disconnect Meta, Shopify or Klaviyo on the brand's page.
• Remove members and guests, and revoke connected AI assistants and API keys, in Settings and on the brand's Sharing tab.

To delete your whole account and workspace, contact us (see below). The activity log is kept as an audit record while the workspace exists. Page view and click counts keep the last 120 days. Email links for address checks expire after 24 hours, and password reset links after one hour.

• Tokens and keys for Meta, Shopify and Klaviyo are encrypted at rest.
• Passwords, API keys, sign-in tokens and recovery codes are stored only as one-way hashes.
• Two-factor sign-in with an authenticator app is available to every user, and a workspace owner can require it.
• You can sign out of every device at once in Settings.
• Every workspace's data is kept separate, and guests can reach only the brand shared with them.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or limit how we use it, and to complain to a data protection authority.

You can correct your details and delete much of your data in the app. Concepts, collections and the activity log can be exported as CSV. For anything else, or a full copy of your data, contact us (see below). We may need to check who you are first.

The services that run CTRL operate in several countries, so your data may be stored or processed outside the country you are in. Where the law requires it, we rely on the safeguards those services provide for international transfers.

CTRL is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children.

We may update this policy. We will change the date at the top of this page, and tell you in the app or by email about significant changes.

Email us at hello@sibt.si.