1. Information we collect
We collect information you provide directly, information generated through your use of our service, and information from third-party platforms you connect.
Account Information
When you create an account we collect your name, email address, company name, job title, and password. If you sign in via Google OAuth, we receive your name, email, and profile picture from Google.
Campaign & Content Data
We store the briefs, copy, images, scheduling instructions, and performance data you create or import through CampaignMind. This content is necessary to deliver the service and power our AI features.
Connected Platform Credentials
When you connect social accounts (Facebook, Instagram, LinkedIn, X, TikTok), we store OAuth access tokens. We never store your social media passwords.
Usage & Technical Data
We automatically collect IP address, browser type and version, device type, operating system, pages visited, features used, session duration, and error logs to operate and improve the platform.
Billing Information
Payment card data is collected and processed directly by our payment processor (Stripe). We store only the last four digits, card type, billing name, and transaction references, never full card numbers.
2. Mobile app
The CampaignMind app for Android and iPhone asks for a permission only when you use the feature that needs it. You can turn any permission off in your phone’s settings.
| What | What it’s used for | Does it leave your phone? |
|---|---|---|
| Camera | Taking a photo or video to add to a post or brief. Asked for only when you tap the camera. | Only what you add to a post or brief. It is uploaded to our storage. |
| Microphone | Voice dictation, and sound when you record a video. Asked for only when you tap the microphone or record. | Recorded video goes to our storage when you add it to a post. We never receive dictation audio. |
| Voice dictation | Turning your speech into text in the composer, using your phone’s speech service. On Android this is usually Google’s speech service, and on iPhone it is Apple’s. | Your phone’s speech service may send the audio to Google or Apple to recognise it, under their privacy policies. We receive only the text you keep. |
| Photo library | Reading the photos and videos you pick, and saving AI images you choose to save to a “CampaignMind” album. | Only the items you pick, uploaded to our storage. Saved AI images stay on your phone. |
| Files you attach | Documents and images you attach to a support request or a brief. | Uploaded to our storage. A brief document may be sent to our AI providers to read it. |
| Google sign-in | Your name, email address and profile photo from Google, to create your account and sign you in. | Sent to our sign-in service and stored with your account. |
| Login tokens on the device | Keeping you signed in, along with your profile and selected workspace. Stored encrypted in the phone’s Keychain or Keystore. | Sent to our servers with each request to prove it’s you. Signing out removes them. |
The app does not include advertising or third-party analytics tools.
3. How we use your information
We use the information we collect to provide, maintain, and improve CampaignMind.
- Service delivery - Generating campaign strategy, copy, and schedules; publishing content to connected platforms; tracking performance analytics.
- AI personalisation - Including your brand profile and past content in AI requests so outputs match your voice, tone, and audience. We don't use your content to train AI models.
- Account management - Processing sign-ups, billing, password resets, and support requests.
- Product improvement - Analysing aggregated, anonymised usage patterns to improve features and fix bugs.
- Communications - Sending transactional emails (receipts, password resets), product updates, and, with your consent, marketing communications. You can opt out at any time.
- Security & compliance - Detecting fraud, abuse, and security incidents; complying with legal obligations.
4. AI and your content data
CampaignMind uses large language models and machine learning to generate marketing content on your behalf. Here is exactly how your data interacts with AI:
Your content stays yours. Content you create in CampaignMind, briefs, copy, images, brand guidelines, is your intellectual property. We do not claim ownership.
Your brand, in each request. When you brief CampaignMind, we include your brand profile and relevant past content in the request we send to the AI provider, so outputs match your voice. We don’t build or train a model for your account.
We don’t train AI models. We don’t use your content to train or fine-tune any AI model, for you or for anyone else.
Third-party AI providers. We send prompts and content to Anthropic for text and to fal.ai for images. Anthropic’s commercial terms prohibit it from training models on the content we send. fal.ai’s terms let it use anonymised or aggregated usage data, which may come from prompts, to improve its services and models.
6. Data retention and deletion
We keep your data while your account is open. When you ask us to delete your account, this is what happens.
How deletion works
- Ask on our account deletion page. You don’t need to sign in. We send a code to your email to check it’s you.
- For a 14-day cooling-off period your account becomes view-only, and scheduled posts in workspaces you own don’t publish. During that time you can change your mind and keep your account.
- After 14 days we permanently delete your account and data. Deletion is complete within 30 days of your request.
- If you own an account, we delete the account, its subscription, its workspaces and everything in them.
- If you’re a team member in someone else’s workspace, we delete your profile and remove you from the workspace. Content you made there stays with the workspace, credited to “Deleted user”.
- If your account is on an Enterprise contract, your account team handles the deletion under that contract.
What we keep after deletion, and for how long
| What | Why | How long |
|---|---|---|
| Payment and tax records | The Australian Taxation Office requires them | 5 years |
| A record that we deleted your account | Proves the deletion was done. Hashed, with no content | 5 years |
| A hashed copy of your email | So we never send you marketing email again | Indefinitely |
Payment and tax records are not linked to your deleted profile. We keep nothing else that identifies you.
Backups
We keep encrypted backups of our database and file storage so we can recover from failures. Deleted data stays in these backups for up to 14 days after deletion, until the backups that hold it expire.
What we keep without your name
- Records of published posts, approval history and publish receipts stay in the workspace’s audit trail, with your name replaced by “Deleted user”.
- Usage totals, such as credits and AI use, stay in our product statistics with no user ID.
- Error logs are kept with your name, email and user ID removed.
What we can’t delete for you
- Posts already published on LinkedIn, Facebook, Instagram, X or TikTok stay on those platforms. Remove them on each platform if you want them gone.
- We delete our access to every connected channel and revoke our access to LinkedIn. To remove Campaign Mind from Facebook, Instagram, X and TikTok, use each platform’s settings.
- Stripe holds your payment details under its own retention rules. We don’t store card numbers.
Download anything you want to keep before you ask for deletion.
7. Your rights
Depending on your location, you have some or all of the following rights regarding your personal data:
- Access - Request a copy of all personal data we hold about you.
- Correction - Ask us to fix inaccurate or incomplete data.
- Deletion - Ask us to delete your account and data on our account deletion page. You don’t need to sign in. We keep only the records listed in Data retention and deletion.
- Portability - Receive your campaign and account data in a machine-readable format (JSON or CSV).
- Restriction - Ask us to pause processing of your data in certain circumstances.
- Objection - Object to processing based on legitimate interests or for direct marketing.
- Opt-out of sale / sharing - We do not sell personal data. California residents may still submit an opt-out request under CCPA.
- Withdraw consent - Where processing is based on consent (e.g. marketing emails), withdraw it at any time without affecting prior processing.
To delete your account, use our account deletion page. For any other request, email privacy@campaignmind.ai. We will respond within 30 days.
8. Security
We implement industry-standard technical and organisational measures to protect your data:
- All data in transit is encrypted with TLS 1.2 or higher.
- All data at rest is encrypted using AES-256.
- Access to production systems is restricted to authorised personnel using MFA.
- Regular third-party penetration tests and security audits are conducted.
- We maintain a responsible disclosure programme, report vulnerabilities to security@campaignmind.ai.
No system is 100% secure. If you suspect unauthorised access to your account, change your password immediately and contact us at security@campaignmind.ai.
10. Third-party services
Our service integrates with or relies on the following categories of third-party services. Each has their own privacy practices:
- Social platforms - Facebook and Instagram (Meta), LinkedIn, X and TikTok, under their own terms and privacy policies.
- Sign-in with Google - Google, if you choose to sign in with your Google account.
- Hosting and storage - Supabase and Microsoft Azure store our database, sign-in service and uploaded files. Railway hosts the application.
- AI providers - Anthropic generates text, and fal.ai generates images. Your content is sent to them through their APIs. See AI and your content data for what each may do with it.
- Notifications - Google Firebase Cloud Messaging delivers alerts to phones, and your browser’s push service delivers browser alerts. Each receives the alert text and a device address.
- Background processing - Inngest runs our background jobs, which can include your content.
- Payment processing - Stripe. See stripe.com/privacy.
- Email - Resend sends our emails.
11. Children's privacy
CampaignMind is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) and display a banner in the product at least 14 days before the changes take effect. Continued use of CampaignMind after the effective date constitutes acceptance of the revised policy.
You can always view the current version at campaignmind.ai/privacy and a history of previous versions is available on request.
13. Contact us
CampaignMind, including the CampaignMind mobile app, is developed and operated by JRC Software. Questions, concerns, or requests regarding this Privacy Policy should be directed to:
JRC Software, CampaignMind Privacy Team
Email: privacy@campaignmind.ai
Response time: within 30 calendar days
If you are located in the European Economic Area and believe your rights have not been addressed, you have the right to lodge a complaint with your local data protection authority.