Privacy Policy

• Your account: your name and email address, and the sign-in method (Google or email and password). Passwords are stored by our authentication provider as one-way hashes; we never see them.
• Accounts you connect: when you connect Google or Meta, we store the access tokens those services give us, plus the account name and ID. Tokens are encrypted before they are saved.
• Advertising account information we read through Meta: things like campaigns, ad sets, ads, creative details, lead form names and performance numbers for the ad accounts you choose to use in Dupley.
• Google Drive and Google Sheets content you point us at: the spreadsheets you link as sources and the creative files and documents they reference. We read them to build your ads, and we write to a spreadsheet only when you ask us to.
• What you create in Dupley: workspace settings, ad drafts, ad copy, an upload history (ad names, copy, destination links, which ad set they went to, and whether each upload succeeded), saved notes about a client, and your AI chat history.
• Technical data: our hosting provider keeps standard request logs (such as IP address, browser type and the pages requested) for security and troubleshooting.

We don't keep copies of your creative files (images and videos). They are passed to Meta to create your ads and are not stored by Dupley.

• To provide Dupley: sign you in, show your campaigns and ad sets, build drafts and create ads in your Meta ad account when you tell us to.
• To keep the service secure and working: prevent abuse, fix bugs, and investigate failed uploads.
• To contact you about your account, such as team invitations you or an admin send.

We don't use your data for advertising, and we don't sell it.

Dupley's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google sign-in to identify you (name and email). If you connect Google Drive and Sheets, we use that access only to read the files you select and to carry out actions you request inside Dupley. We don't use Google user data to train generalized AI or machine-learning models, we don't transfer it to others except as needed to provide Dupley (see “Who we share data with”), and no one at Dupley reads it except where needed for security, to comply with law, or with your consent.

When you connect Meta, we use the permissions you approve to read your ad accounts and to create ads and related items you ask for. We handle that data under Meta's Platform Terms and only to provide Dupley to you.

Dupley's AI assistant and copy tools send the content needed for your request (for example spreadsheet rows, ad copy, account details you ask about, and any brief files you attach) to Google's Gemini API to generate a response. Responses and your chat history are saved so you can reopen them; chat history is private to your user account.

We don't sell your data. We share it only with service providers that help us run Dupley, and only for that purpose:

• Google and Meta: the services you choose to connect (sign-in, Drive and Sheets, and your Meta ad accounts).
• An AI provider (Google's Gemini): to generate responses to your AI requests.
• Cloud infrastructure providers: hosting, database, authentication and network services.
• Email and web-reading providers: to send team invitations and to read public landing pages you ask us to look at.

Your data may be stored and processed in countries other than where you live. We may also disclose information if the law requires it. If we are ever involved in a sale or merger, we will tell you before your data is transferred or becomes subject to a different policy.

Workspaces belong to a team account, and members of that account can see its workspaces according to their role. Your upload history and AI chats are private to your own user account.

Connections use HTTPS. Connected-account tokens are encrypted in our database, and access to data is restricted so each user and team can only reach their own. No system is perfectly secure, but we work to protect your information and will tell affected users if a breach affects them.

We use only what's needed to run the site: sign-in session cookies, a short-lived cookie that carries an invitation while you sign up, and your browser's local storage to remember things like your current workspace and unsent drafts. We don't use advertising or analytics cookies.

• Disconnect: in Dupley, open Connections and choose Disconnect to remove our stored copy of a Google or Meta connection. You can also remove Dupley's access from your Google account (Security → Third-party access) or your Meta account (Settings → Business Integrations).
• Delete your data: email privacy@dupley.io from the address on your account and ask us to delete it. We will delete your account, drafts, upload history, AI chats and stored connections within 30 days.
• Access or correct your data: email us and we will help.

We keep your information while your account is active. When you ask us to delete it, we remove it as described above, except for anything we must keep to meet legal obligations. Routine backups are overwritten on the provider's normal schedule.

Dupley is for businesses and isn't directed at anyone under 18.

We may update this policy. The “Last updated” date above shows when it last changed, and we'll give notice of significant changes.

Questions or requests: privacy@dupley.io