Privacy Policy

1. Introduction

Yolodex ("we", "us", "our") operates the Yolodex platform at personas.yolodex.ai. This Privacy Policy describes how we collect, use, and protect your information when you use our service.

2. Information We Collect

Account Information

When you sign up, we collect your name, email address, and profile picture via Google OAuth. We do not store your Google password.

Facebook/Meta Data

When you connect your Meta (Facebook) account, we access your ad account data with your explicit permission. Specifically, we collect:

• Ad account information (account name, ID, currency, status)
• Ad creative data (ad copy, images, videos) from your ad accounts
• Ad performance metrics (spend, impressions, clicks, conversions)
• Facebook Page information (page name, ID) for resolving video creatives that live on Pages you administer
• Public comments on your Facebook Page posts and ads, used to surface audience sentiment, recurring questions, and language patterns that inform persona analysis
• Public comments on posts and ads from Instagram business accounts linked to your Facebook Pages, used for the same audience-insight purposes as Facebook Page comments

We only access data from ad accounts and Pages you explicitly select during the connection process. We do not access your personal Facebook profile content, friends list, messages, private messages on Pages, or any data unrelated to advertising.

We process this data in accordance with the Meta Platform Terms and Meta's Developer Policies.

Handling of Commenter Data

Public comments we ingest may contain personal data of third parties (commenters' names, user IDs, and comment text). We process this data only in aggregate to derive themes, sentiment, recurring questions, and language patterns. We do not build individual-level profiles of commenters, do not enrich commenter data with information from other sources, and do not surface commenter identities to other Yolodex users beyond what is already publicly visible on the underlying Facebook or Instagram post. Commenter data is deleted alongside the connected account's data when you disconnect Facebook or delete your Yolodex account (see Section 6).

3. How We Use Your Data

We use the collected data to:

• Display your ad creatives and performance metrics within the Yolodex dashboard
• Analyze ad content using AI to identify audience segments, messaging themes, and creative patterns
• Generate audience persona recommendations based on ad performance and competitive analysis
• Provide semantic search across your ads and competitive intelligence

We do not use connected-account data for advertising to end users, individual-level profiling, or any purpose outside the audience-intelligence functionality of the Service.

4. Data Storage and Security

Your data is stored securely using industry-standard practices:

• Database: Neon Postgres with AES-256 encryption at rest and TLS 1.2+ in transit
• Media files: Vercel Blob storage with secure, non-guessable URLs
• Authentication tokens: Stored encrypted in our database, never exposed to client-side code
• Infrastructure: Hosted on Vercel with SOC 2 Type II compliance

5. Data Sharing

We do not sell, rent, or share your personal data or advertising data with third parties for their own commercial purposes. We use a limited set of sub-processors who act on our behalf under written data processing agreements (DPAs):

• AI processing:Ad content, reviews, and comment text are sent to AI providers (Google Gemini, OpenAI, Anthropic) for analysis. We use the providers' enterprise/API tiers, under which submitted data is not used to train their models and is retained only transiently for abuse-monitoring purposes as set out in their respective DPAs.
• Infrastructure providers: Vercel (hosting), Neon (database), and BrightData (public data collection) process data strictly as part of service delivery and under contractual confidentiality.
• Legal requirements: We may disclose data if required by valid legal process or to protect our legal rights, the rights of users, or the public.

We do not sell personal information as defined under the CCPA/CPRA.

6. Data Retention and Deletion

We retain your data for as long as your account is active. You can request deletion of your data at any time by contacting privacy@yolodex.ai.

Upon account deletion or Facebook disconnection:

• Your ad data, persona analyses, ingested comment data (including third-party commenter data), and media files are permanently deleted from primary systems within 30 days
• Your Facebook/Meta access tokens are revoked immediately on disconnect and purged from our systems within 7 days
• Encrypted backups containing your data are rotated and purged within 90 days
• Accounts inactive for 24 consecutive months are flagged for deletion, with prior email notice

7. Facebook Data Deletion

In compliance with the Meta Platform Terms, you can request deletion of all Facebook-related data stored by Yolodex in either of the following ways:

1. Self-service: Disconnect your Facebook account from the Yolodex settings page, which automatically initiates deletion of all associated data.
2. Manual request: Submit a deletion request via our data deletion instructions page at https://personas.yolodex.ai/data-deletion or by emailing privacy@yolodex.ai.

We will confirm deletion within 30 days and provide a confirmation code on request.

8. Your Rights

Depending on your jurisdiction, you may have rights under laws including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and similar regimes. These rights may include:

• Access to the personal data we hold about you
• Correction of inaccurate data
• Deletion of your data ("right to be forgotten")
• Restriction of, or objection to, processing
• Data portability (export in a structured, machine-readable format)
• Withdrawal of consent at any time, including revoking Facebook permissions through Facebook's settings
• The right not to be discriminated against for exercising any of these rights

To exercise any of these rights, contact privacy@yolodex.ai. We will respond within the statutory timeframe (generally 30 days under GDPR, 45 days under CCPA/CPRA).

9. Legal Bases for Processing (GDPR)

For users in the EU/UK, we rely on the following legal bases:

• Contract — to provide the Service you have signed up for
• Legitimate interests — to operate, secure, and improve the Service, and to analyze advertising and public comment data for audience-intelligence purposes
• Consent — for any optional processing where consent is required (you may withdraw at any time)
• Legal obligation — to comply with applicable law

10. International Data Transfers

Yolodex is operated from the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses (SCCs) and equivalent transfer mechanisms with our sub-processors.

11. Children's Privacy

The Service is not directed at children under 18 and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will delete it promptly.

12. Cookies

We use essential cookies for authentication and session management. We use PostHog for product analytics to understand how the platform is used and improve the experience. No advertising or third-party tracking cookies are used.

13. Contact

For privacy-related inquiries, data deletion requests, or questions about this policy, contact us at privacy@yolodex.ai.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email. The "Last updated" date at the top reflects the most recent revision.