Privacy Policy

Last updated: October 21, 2026

1. Introduction

Durum Marketing LLC ("DURUM.ai", "we", "our"), a limited liability company registered in Wyoming (USA), operates the DURUM.ai platform. This privacy policy describes how we collect, use, store and protect your personal information when you use our service.

By using DURUM.ai, you agree to the practices described in this policy. If you have any questions, contact us at info@durum.ai.

2. Data we collect

2.1 Account information

When you sign up, we collect your name, email address, company name and role. This information is required to create and manage your account.

2.2 Data from third-party platforms

With your explicit authorization, we sync data from the tools you connect: Google Ads (campaign structure, spend, clicks, conversions, keyword performance), Meta Ads (see section 2.6), TikTok Ads (campaign structure, spend, performance metrics), your CRM (GoHighLevel, Pipedrive or iClosed: contacts, opportunities, sales pipeline), Calendly (appointments), Stripe (transactions), and the other integrations you enable. DURUM.ai is not a CRM: it connects to the CRM you already use.

This data is used to power your workspace, generate your reports and run the Studio features you use (see section 5 for the providers involved).

2.3 Usage data

Our hosting providers may keep technical logs under their own policies.

2.4 Google Ads data and compliance with Google policies

When you connect a Google Ads account to DURUM.ai, we access your advertising data through the Google Ads API using OAuth 2.0 and the https://www.googleapis.com/auth/adwords permission. This permission is not read-only. We use it to read your campaign data and to pause, resume or change the daily budget of your existing campaigns, ad groups and ads, through a rule you have created and switched to apply mode (then run by our scheduled jobs), a proposal from the DURUM.ai agent that you approve, or a call to the DURUM.ai API or MCP connector made with your credential.

What we do:

We read performance data for your campaigns, ad groups, keywords and ads (impressions, clicks, cost, conversions, conversion value)
We store this data securely in our Supabase database (us-east-1 region, United States) to power your dashboards and attribution reports
We refresh this data through scheduled jobs

What we do NOT do:

We do not create or delete any campaign, ad group, ad or keyword, and we do not change keywords
We never share or resell your Google Ads data to third parties
We do not use your Google Ads data for internal marketing

DURUM.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The Limited Use requirements of the Google API Services User Data Policy read as follows (quoted verbatim from Google's official English text):

Limited Use: Your use of data obtained via the product's specified scopes must comply with the below requirements. These requirements apply to the raw data obtained from the scopes and data aggregated, anonymized, or derived from them.
Limit your use of data to providing or improving user-facing features that are prominent in the requesting application's user interface;
Transfers of data are not allowed, except:
To provide or improve your appropriate access or user-facing features that are visible and prominent in the requesting application's user interface and only with the user's consent;
For security purposes (for example, investigating abuse);
To comply with applicable laws; or,
As part of a merger, acquisition, or sale of assets of the developer after obtaining explicit prior consent from the user.
Don't allow humans to read the data, unless:
You first obtained the user's affirmative agreement to view specific messages, files, or other data, with the limited exception of use cases approved by Google under additional terms applicable to the Nest Device Access program;
It is necessary for security purposes (for example, investigating a bug or abuse);
It is necessary to comply with applicable law; or
The data (including derivations) is aggregated and used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements.
All other transfers, uses, or sales of user data are prohibited, including:
Transferring or selling user data to third parties like advertising platforms, data brokers, or any information resellers.
Transferring, selling, or using user data for serving ads, including retargeting, personalized or interest-based advertising.
Transferring, selling, or using user data to determine credit-worthiness or for lending purposes.
You must ensure that your employees, agents, contractors, and successors comply with this Google API Services User Data Policy.

You can revoke DURUM.ai's access to your Google Ads account at any time from the permissions page of your Google account.

Closing your DURUM.ai account or revoking access does not trigger automatic deletion of the Google Ads data already received. To have it deleted, email info@durum.ai.

2.5 TikTok Ads data and compliance with TikTok policies

When you connect a TikTok ad account to DURUM.ai, we access your advertising data through the TikTok Marketing API using OAuth 2.0. You explicitly authorize each advertiser account from the TikTok interface, and you can revoke this authorization at any time.

Our TikTok Ads integration includes write permissions. We state it here so you know exactly what you authorize.

What we read:

The structure of your campaigns, ad groups and ads
Your performance metrics (spend, impressions, clicks, reach, conversions)
The list of your advertiser accounts, TikTok identities and pixels, so you can choose which ones to use
Your ad creatives (images, videos) and the information of your advertiser account and its region

What we write, on your action:

Creating campaigns, ad groups and ads when you launch a campaign from DURUM.ai. They are created PAUSED.
Uploading your creatives (images, videos) to your ad account, as part of that same publication
Pausing, resuming and changing the budget of campaigns, ad groups and ads, through a rule you have created and switched to apply mode (then run by our scheduled jobs), a proposal from the DURUM.ai agent that you approve, or a call to the DURUM.ai API or MCP connector made with your credential

What we do NOT do:

We never delete a campaign, ad group or ad
We never share or resell your TikTok data to third parties
We do not use your TikTok data for internal marketing

Your TikTok access tokens are encrypted (AES-256-GCM) and stored in our Supabase database (us-east-1 region, United States). You can revoke DURUM.ai's access at any time from the authorizations of your TikTok for Business account. Closing your DURUM.ai account or revoking access does not trigger automatic deletion of the TikTok data already received. To have it deleted, email info@durum.ai.

2.6 Meta data (Facebook, Instagram) and compliance with Meta Platform Terms

When you connect Meta to DURUM.ai, you sign in with Facebook and explicitly grant the permissions requested. Depending on the features you enable, these permissions are: ads_management, ads_read, pages_show_list, pages_read_engagement, instagram_basic and instagram_branded_content_ads_brand (Meta Ads and partnership ads), and, for Facebook lead forms, leads_retrieval, pages_manage_metadata, pages_manage_ads and business_management.

Data we receive from Meta:

Access tokens: the tokens issued by Meta when you connect. They are encrypted (AES-256-GCM) before storage and are never displayed in the interface.
Meta identity: the app-scoped Meta user ID of the person who connected and, for Facebook lead forms, the email address of that Meta account.
Ad accounts: the ad accounts, Pages and pixels you can access, so you can choose the ones linked to your workspace; the structure of campaigns, ad sets and ads; performance metrics (spend, impressions, clicks, leads, conversions).
Pages: the organic posts published by the Page you choose (text, link, image or video) and their engagement (reactions, number of comments, shares). We do not request the permission to read posts or comments published by visitors on the Page (pages_read_user_content).
Leads: when you turn on Facebook lead forms for a Page, the leads submitted through that Page's forms (form answers, form, ad and campaign identifiers). The form answers are erased from our intake log as soon as the lead is recorded in your workspace, where the lead is kept like leads from your other sources.
Instagram: for partnership ads, the Instagram account ID of your brand, the username and Instagram ID of the creator you choose, and the creator's approval status read from Meta. We do not request any Meta messaging permission and do not read private messages.

How we use it:

To show your dashboards and attribution reports, linking each lead to its ad source and to the sales outcome read from your CRM
To create campaigns, ad sets and ads when you launch them from DURUM.ai (created PAUSED), and to add ads to an ad set under a rule you have configured (paused, unless you set the rule to publish them active)
To pause, resume and change the budget of campaigns, ad sets and ads, through a rule you have created and switched to apply mode (then run by our scheduled jobs), a proposal from the DURUM.ai agent that you approve, or a call to the DURUM.ai API or MCP connector made with your credential
If you enable the Conversions API, to send your conversion events to your Meta pixel, with personal identifiers (email, phone) hashed with SHA-256 before sending

We never sell Meta data, never share it with data brokers or ad networks, and never use it for any purpose other than providing the service to the workspace that connected it.

Retention:

Tokens are kept while the connection is active. When you disconnect Meta, or when Meta notifies us that you removed DURUM.ai, the tokens are erased or the authorization is deleted (see below).
Advertising data and leads are kept while your DURUM.ai account is active. Closing the account does not trigger automatic deletion: they are deleted on request (see below).

Revoking access:

From DURUM.ai, by disconnecting Meta Ads or turning off Facebook lead forms in your integrations
From Facebook, in Settings and privacy, Settings, Business integrations (or Apps and websites), by removing DURUM.ai

Data deletion:

When you remove DURUM.ai from your Facebook account and request the deletion of your data, Meta sends a signed request to our data deletion callback URL (https://app.durum.ai/api/webhook/meta-deletion). We verify Meta's signature, then, for the Meta user identified in the request:

we revoke every Meta Ads connection linked to that user and erase its tokens;
we revoke and then delete the Facebook lead forms authorization of that user (encrypted token, email address and Meta user ID), and stop lead intake for the related Pages;
we return to Meta a confirmation code for your request, which we keep in our audit log, and the link to a public page (https://app.durum.ai/data-deletion-status?code= followed by the code) that shows the status of your request in French and English.

Leads received remain the advertiser's data. The Meta callback does not delete them, nor the advertising data already received: they are deleted at the advertiser's request. To request this deletion, or the deletion of any other data, email info@durum.ai.

3. How we use your data

Your data is used to:

Provide and maintain the DURUM.ai service
Generate your analyses, reports and alerts
Generate ad texts, images and videos in the Studio, at your request
Calculate your marketing and financial KPIs
Send you notifications related to the service (alerts, Slack reports)
Improve the platform and fix bugs
Answer your support requests

4. Hosting and security

4.1 Hosting

Your data is hosted by Supabase (database, us-east-1 region, United States) and Vercel (application and serverless functions, United States).

4.2 Encryption

Supabase states in its public security documentation (supabase.com/security) that all customer data is encrypted at rest with AES-256 and in transit via TLS. Vercel states in its public documentation that every deployment is served over HTTPS. Access tokens for Meta and TikTok are additionally encrypted by DURUM.ai (AES-256-GCM) before storage and are never displayed in the user interface.

4.3 Restricted access

Access to production systems is reserved for the people who need it to operate the service.

5. Data sharing and sub-processors

We do not sell personal data. We use the Meta Pixel and the Meta Conversions API to measure and optimize our own DURUM.ai advertising campaigns, with data about the visitors of our website and application and about our own sign-ups and subscribers (see section 8). The advertising account data and the leads of our clients are never used for our campaigns.

We share your data with the following sub-processors, which are required to operate the service:

Supabase Inc. (us-east-1 region, United States): database hosting and encrypted storage of OAuth tokens
Vercel Inc. (USA): deployment and hosting of the front end and serverless functions
Google LLC: when you connect Google Ads (receiving outgoing API requests)
Meta Platforms, Inc.: when you connect Meta Ads
TikTok Technology Limited (TikTok for Business): when you connect TikTok Ads
Your CRM (GoHighLevel, Pipedrive or iClosed): when you connect it, to read your contacts, opportunities and sales
Calendly: when you connect it, to read your appointments
Gladia (Gladia SAS): transcription of the call recordings you import or connect, and of the video ads you analyze
OpenAI, L.L.C.: transcription fallback (Whisper) of the call recordings when the main engine fails; and, when you connect ChatGPT ads, reading and managing those campaigns like the other ad networks
Google LLC (Gmail): when a Gmail account is connected, reading its labels and importing its messages, which are then classified with Anthropic
Zoom Video Communications, Inc.: when you connect Zoom, reading your account profile, your cloud recordings and the participants of past meetings, so the calls can be transcribed and analyzed
Slack Technologies, LLC: when you connect Slack, posting messages and files to the channels you choose and listing your channels and users so you can choose them
Google (Gemini model, through fal.ai): video generation from an image in the Studio
Anthropic, PBC: AI models used by the Studio and by analysis features (texts, summaries, reading of images); the prompts may include data from your workspace
fal.ai and Higgsfield: image and video generation in the Studio, from the prompts and visuals you provide
Resend, Inc.: transactional emails (welcome, alerts, account recovery)
Stripe, Inc.: payment processing for your subscription
Meta Platforms, Inc. (Conversions API of DURUM.ai): our servers send to our own Meta pixel the conversion events of our sign-up and payment funnel (from the website: Lead, including webinar registration, AddPaymentInfo and Purchase; from the application: StartTrial, at sign-up or at the start of a trial, and Subscribe), with the email address and, depending on the event, name, phone, country, city, postal code and customer identifier, hashed with SHA-256, and the IP address, browser user agent and Meta cookie identifiers (fbp, fbc) unhashed
Functional Software, Inc. (Sentry): monitoring of errors and performance in the application, loaded only after you accept analytics cookies; tokens are masked in the URLs it records
Twilio Inc.: when you enable the SMS channel, sending and receiving text messages and reserving or releasing the related phone numbers
Microsoft Corporation (Microsoft 365, OneDrive, Teams): when you connect Microsoft (permissions offline_access, User.Read, Calendars.Read, Files.Read), reading your profile, finding the recordings and transcripts of your meetings in your OneDrive (recording and transcript folders, OneDrive search, files shared with you, and Teams meeting transcripts when Microsoft grants access) and downloading them so they can be transcribed and analyzed; when you link a Teams conversation to DURUM.ai, receiving the messages you send to the DURUM.ai agent in Teams, replying in that conversation and reading the member who wrote, recognized by email address
HighLevel, Inc. (GoHighLevel), as DURUM.ai's own tool: our own GoHighLevel account receives the registrations to our webinars (first name, email, phone, webinar date, monthly ad spend, campaign parameters) as a contact and an opportunity in our sales pipeline, and the sign-ups from our checkout (email, monthly ad spend, language and offer), for our own sales follow-up
Apollo.io and Hunter.io, as DURUM.ai's own prospecting tools: for our own sales prospecting, they process public professional data of prospects (name, job title, company, company domain, professional email address and its verification); they do not process the data of the users of the application
DURUM.ai webhook (our own workspace): our website sends to app.durum.ai/api/webhook/lead, in DURUM.ai's own workspace, the webinar registrations (email, phone, first name, campaign parameters and ad identifiers, Meta click identifier, page), the checkout sign-ups (email, campaign parameters, offer, page, email validity, Meta event identifier) and declined card payments (email, offer, language, decline code and message), to attribute them to their source, follow up with them and, for valid sign-ups, send the conversion to our own Meta pixel

The complete and current list of sub-processors is available on request at info@durum.ai.

We may also share data when required by law: court order, subpoena or applicable law.

6. Data retention

Your data is kept while your account is active. Cancelling your subscription or closing your account does not trigger automatic deletion.

Your data is deleted on request: for Meta, through the data deletion callback described in section 2.6; for any data, by email to info@durum.ai. Leads received remain the advertiser's data and are deleted at the advertiser's request.

7. Your rights

Under applicable laws, you have the right to:

Access your personal data
Correct inaccurate data
Request the deletion of your data
Withdraw your consent to the collection of third-party data

To exercise these rights, including access to and deletion of your data, email info@durum.ai. This includes the rights of individuals under Quebec's Law 25.

8. Cookies and similar technologies

8.1 Essential cookies

DURUM.ai uses cookies and similar browser storage that are necessary for the service to work, in particular to keep your session signed in.

8.2 Measurement and advertising tools

The following tools are loaded by the website durum.ai and the application app.durum.ai:

Meta Pixel (website and application): loaded without prior consent; sends Meta page views and sign-up funnel events (for example Lead, InitiateCheckout) and may set Meta cookies. On the sign-up and checkout pages of the application, the email address you enter is passed to Meta for matching.
DURUM.ai first-party tracker (application): records the session, campaign parameters (UTM), email address and engagement to attribute sign-ups to their source.
Campaign parameters and referral code (website): kept in your browser to attribute your visit and any referral.
Sentry (application): error monitoring, loaded only if you accept analytics cookies.

8.3 Contact

For any question about these tools, email info@durum.ai.

8.4 Managing cookies

You can set your browser to refuse cookies. Disabling authentication cookies will prevent you from using the service.

9. Changes

We may update this policy from time to time. Material changes will be communicated by email or through a notification in the platform. The last updated date at the top of this page reflects the current version.

10. Contact

For any question about this privacy policy, to exercise your rights, or to report an incident:

Email: info@durum.ai
Company: Durum Marketing LLC
Address: 312 West 2nd Street, Casper, WY 82601, USA