Privacy Policy
This policy explains what data scale190 (Creative Intelligence) processes and why, who it is shared with, and how you can delete it.
1. Data controller
Controller: Derya Uludağ, Kordonboyu Mah. Turgut Özal Blv. Dumankaya B Blok No: 65 İç Kapı No: 43, Kartal / İstanbul.
For every privacy request: privacy@scale190.com.
2. What data we process
Account data: your e-mail address, account name and language. Your password is not stored by us; it is held, hashed, by our authentication provider (Supabase Auth). If you sign in with Google we receive the e-mail address Google gives us.
Meta advertising data (only if you connect your Meta account, and only with read access - ads_read):
- your ad account's ID, name, currency and time zone;
- names, objectives and statuses of campaigns, ad sets and ads;
- daily performance metrics (spend, impressions, clicks, conversions and so on);
- your ads' images, videos and ad copy;
- the access token Meta issues (stored encrypted) and your Meta user ID.
We never change anything in your ad account, publish or pause ads: we ask for read access only.
Usage data: session cookies, your preferences (theme, language), feedback you send, and the reason you pick when deleting your account (the reason does not identify you or your account); and records of how you use the product: which tabs you open, which features you use, and your AI, credit and storage usage. These records contain no ad content, copy or on-screen text.
3. Why we process it
To provide the service: analysing your ads' performance and creatives, and producing findings, recommendations, reports and alerts.
To keep your account secure and the service running.
To improve the product: measuring how much each feature is used.
We do not use your data for marketing, profiling or sale to third parties.
4. AI analysis
For the analyses, ad images, videos, ad copy and performance data are sent to AI providers (OpenAI, Anthropic, Google), only to produce the analysis result.
AI output can be wrong; use it alongside your own judgement before deciding.
5. Who we share it with
We do not sell your data. These service providers process it on our behalf to run the service:
- hosting: Railway;
- database, file storage and authentication: Supabase;
- AI analysis: OpenAI, Anthropic, Google;
- usage measurement: our product analytics provider (EU);
- e-mail delivery: Resend (when used).
We talk to Meta only to set up the connection and read your data. We may disclose information to authorities where the law requires it.
6. Transfers abroad
Our service providers use data centres outside Turkey, so your data is transferred abroad. By using the service and connecting your Meta account you give your explicit consent to that transfer; you can withdraw it by disconnecting and deleting your account.
7. Retention and deletion
We keep your data while your account is open.
If you disconnect Meta the access token is deleted and no new data arrives; data already synced stays in your account.
Delete your account (Profile → Delete account): the account, all your ad data, analyses, learnings, reports and uploaded files are deleted for good, together with your sign-in.
After you delete your account, usage statistics that do not identify you (counts and counters) may remain; they can no longer be linked to your account.
If you remove the app on Facebook, your Meta connection ends; data already synced stays in your account. If you separately send Meta a data deletion request, the data that came from Meta is deleted and Meta shows you a confirmation code. You can check the status with that code at https://app.scale190.com/creative-intelligence/meta/deletion-status.
Backups are deleted within our infrastructure providers' standard retention period.
8. Your rights
You can ask to access, correct or delete your personal data, to object to its processing and to receive it in a portable form (KVKK article 11, GDPR). Write to privacy@scale190.com; we answer within 30 days.
9. Security
Your access tokens are stored encrypted and connections use TLS. Each customer's data is kept apart from every other customer's, both in the application code and in the database itself: one account cannot read or change another account's data.
10. Cookies
We only use cookies that are strictly necessary for the service to work, so we do not ask for consent. All of them are scale190's own cookies:
- ci_session: keeps you signed in. Up to 400 days if you ticked "Keep me signed in", otherwise until you close the browser;
- ci_csrf: protects against cross-site request forgery; same lifetime as the session;
- ci_keep: remembers your "Keep me signed in" choice; same lifetime as the session;
- ci_pkce and ci_reset: complete Google sign-in and password reset securely; 15 minutes;
- ci_meta_nonce and ci_meta_popup: complete the Meta account connection securely; 15 minutes;
- ci_view: remembers the campaign view you chose (sales / other); 1 year.
Your theme, language and other interface preferences are also kept in your browser (local storage) and are not sent to our servers. We use no advertising or tracking cookies and set no third-party cookies. On the Google and Meta pages that open during Google sign-in and the Meta connection, those companies' own cookies apply.
11. Children
The service is not directed at anyone under 18.
12. Changes and contact
If we change this policy we update this page and announce important changes in your account. Questions: privacy@scale190.com.