Privacy policy

MAIRO is operated by BLING Marketing. Where this policy says “we”, it means BLING Marketing. We are the data controller for the information described below.

Only what the service needs to function. Specifically:

• Your account. Your name, email address, and a cryptographic hash of your password. We never store your password itself and cannot read it.
• Your business. Business name, website, industry, and time zone.
• What you tell us during onboarding. Your advertising goal, monthly budget, target audience, brand voice, competitors, and any notes you add.
• Your Meta connection. If you connect a Meta ad account, we store its ID, your Facebook Page ID, your business ID, and an access token issued by Meta that lets us act on your behalf.
• Your campaigns and results. The campaigns we create for you, their budgets and status, and the performance figures we read back from Meta.
• Your conversations. Messages you exchange with the AI specialists inside the app.
• Your leads. If your ads use a form we host, the details people submit to you — such as name, email and phone — so you can see and follow up your enquiries.
• Your store's orders. If you add our order webhook to your store, each order's value and time. Customer emails and phone numbers are hashed on arrival and never stored in the clear; the hashed details and the order value are passed to Meta to count conversions.
• Optional connections. If you connect Google Tag Manager, an access token from Google that lets us add your tracking tags. If you turn on text alerts, the phone number we text.

We do not collect payment card details. We do not use advertising cookies or third-party trackers on this site.

• To sign you in and keep your account secure.
• To build your monthly advertising plan from the goal and budget you gave us.
• To create, run, and adjust campaigns on the ad account you connected.
• To show you how those campaigns are performing.
• To answer your questions through the AI specialists.
• To contact you about your account or a problem with your campaigns.

We do not sell your information. We do not share it with advertisers, data brokers, or anyone building marketing lists.

When you connect a Meta ad account you grant us permission to manage and read ads on that account. We want to be precise about what that means.

• We only ever touch the ad account you explicitly connected. We do not access other accounts, even if your Facebook login can reach them.
• Everything we create stays in your account. You can see, edit, pause, or delete any of it in Meta Ads Manager at any time, with or without us.
• We read performance figures for your campaigns only, and show them back to you alone. We do not pool them with other businesses' data.
• We do not post to your Facebook Page, read your messages, or access your personal profile content.
• You can disconnect at any time from the Meta connection page in your dashboard. That deletes the access token immediately.

We use a small number of service providers to run the product. They process data on our instructions only:

• Meta Platforms — to create and read the ads we run for you.
• Anthropic — powers the AI that writes your plans, ad copy, and specialist replies. Your prompts and business context are sent to generate those responses.
• OpenAI — makes ad images in the Creative Studio. Your image requests, and any picture you upload to change, are sent to make them.
• Stripe — takes payment for your subscription. Your card details go to Stripe, never to us.
• Google — only if you connect Google Tag Manager or sign in with Google.
• Twilio — sends text alerts, only if you turn them on.
• Neon — hosts our database.
• Vercel — hosts and serves the application.

Account and campaign data is kept while your account is open, because the service can't work without it. Meta access tokens are deleted the moment you disconnect. When you close your account we delete your data within 30 days, other than anything we're legally required to retain.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. See the data deletion page for how, or email hellabxndz11@gmail.com. We respond within 30 days.

Passwords are hashed with bcrypt. Traffic is encrypted in transit. Meta access tokens are held server-side and never exposed to the browser. No system is perfectly secure, but if a breach affects your data we will tell you.

MAIRO is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.

If we change this policy in a way that materially affects you, we will update the date at the top and let you know by email before it takes effect.