Three Meta ads, written and designed before you sign up.

01

Who we are

ROAScal Ltd ("ROAScal", "we", "us", "our") operates the ROAScal platform — an AI-powered advertising tool accessible at roascal.com. This Privacy Policy explains how we collect, use, and protect your personal data when you use our service.

For questions about this policy, contact us at privacy@roascal.com.

02

Data we collect

Account data

Name, email address, and password when you create an account. If you sign up via Google OAuth, we receive your Google profile name and email.

Usage data

URLs you analyse, campaign configurations, ad concepts generated, and interactions within the platform. We use this to improve our AI models and product experience.

Ad platform tokens

When you connect Meta Business Manager or Google Ads, we store OAuth access tokens and refresh tokens encrypted in Supabase Vault. These are used solely to manage campaigns on your behalf.

Payment data

Subscription payments are handled by Stripe. We do not store card numbers. We receive billing metadata (plan, status, invoice IDs) from Stripe webhooks.

Technical data

IP address, browser type, device type, and session data collected automatically when you use the platform.

03

How we use your data

·To provide and operate the ROAScal service
·To generate AI-powered ad analysis and copy using the Anthropic Claude API — URL content you analyse is sent to Anthropic for processing
·To manage your connected ad platform accounts (Meta, Google) and create campaigns on your behalf using the tokens you provide
·To process subscription payments via Stripe
·To send transactional emails (account, billing, security alerts)
·To improve our AI models and product features using anonymised usage data
·To comply with legal obligations

04

Third-party services

We share data with these third parties to operate the platform:

AnthropicAI analysis — URL content is processed to generate ad strategy reports. See Anthropic's privacy policy at anthropic.com/privacy.

SupabaseDatabase, authentication, and encrypted token storage. Data is stored in EU data centres.

Meta PlatformsWhen you connect Meta Ads, we use the Meta Marketing API to create and manage campaigns. We do not share your data with Meta outside of campaign operations you authorise.

GoogleWhen you connect Google Ads, we use the Google Ads API. We do not share your data with Google outside of campaign operations you authorise.

StripePayment processing and subscription management.

VercelPlatform hosting and edge functions.

05

Data retention

We retain your account data for as long as your account is active. Campaign data and analysis history are retained for 24 months or until you delete your account. OAuth tokens are deleted immediately when you disconnect a platform. On account deletion, all personal data is permanently removed within 30 days.

06

Your rights (UK GDPR / GDPR)

You have the right to:

·Access the personal data we hold about you
·Request correction of inaccurate data
·Request deletion of your data ("right to be forgotten")
·Object to or restrict processing
·Data portability — receive your data in a machine-readable format
·Withdraw consent at any time where processing is based on consent

To exercise any of these rights, email privacy@roascal.com. We will respond within 30 days.

07

Security

OAuth tokens are encrypted at rest in Supabase Vault. All data in transit is encrypted via TLS. We use Row-Level Security (RLS) on all database tables to ensure workspace data isolation. Payment card data is never stored on our systems.

08

Cookies

We use session cookies for authentication (managed by Supabase Auth). We do not use third-party tracking cookies or advertising pixels on our own platform. Analytics are collected via server-side logging only.

09

Changes to this policy

We will notify you by email of material changes to this policy at least 14 days before they take effect. Continued use of the platform after that date constitutes acceptance.

10

Contact

ROAScal Ltd
Email: privacy@roascal.com