Elvison AI – Privacy Policy

Last updated: 9 November 2026

This policy explains how Elvison ("we", "us") handles data in Elvison AI (ai.elvison.com), an advertising management tool. It lets our team and authorized clients connect their advertising accounts on Meta (Facebook and Instagram), TikTok, Pinterest and Google, and publish, manage and report on campaigns and creatives from one place.

1. Who we are

Elvison, elvison.com, the Netherlands. Contact: roelof@elvison.com.

2. Data we access

When an authorized account holder connects a platform account through that platform's official login (OAuth), we access only the data needed to provide the service:

• Basic profile of the person connecting (name, user ID, email if granted) to identify the connection.
• Business and advertising assets the account holder can access: business accounts, ad accounts, Pages, Instagram and Pinterest business profiles, boards, catalogs.
• Campaigns, ad sets / ad groups, ads, creatives, Pins and audiences in those accounts.
• Advertising performance metrics and insights.
• Lead form submissions from lead ads run by the account holder, used only to deliver those leads to that account holder.

We do not access personal data of other platform users beyond what the advertiser's own lead forms collect, and we never ask for or store platform passwords.

3. How we use data

• Creating, editing, pausing and resuming campaigns, ad sets / ad groups, ads and Pins on behalf of the account holder. New campaigns are created paused for human review.
• Uploading creative assets (images, video, copy) supplied or approved by the account holder.
• Reporting campaign performance to the account holder.
• Delivering lead-ad leads to the advertiser that collected them.

We do not sell data, use it to build advertising profiles of individuals, or use platform data to train AI models.

4. Sharing and service providers

Data is shared only with service providers needed to run the tool, under confidentiality and data-processing terms: cloud hosting and database (Railway), file storage for creatives (Google Drive of the account holder), and AI service providers used to draft ad copy and creative variations. AI providers receive only the creative briefs and copy needed for that task, not lead data or user profile data. We disclose data to authorities only when legally required.

5. Storage and security

OAuth access tokens are stored encrypted and used only to perform actions requested by the account holder. Access to the tool is limited to authorized Elvison team members and the account holder's own users. Connections are made over HTTPS.

6. Retention and deletion

We keep tokens and platform data only while the connection is active. Lead data is kept only as long as needed to deliver it to the advertiser and no longer than 90 days. You can disconnect at any time in the platform's settings (for example Facebook Settings → Business integrations, TikTok Business Center → Authorized apps, Pinterest Security → Connected apps) or by emailing us. We then delete stored tokens and associated data within 30 days. See Data deletion.

7. Your rights

Under the GDPR you may request access to, correction or deletion of your personal data, restrict or object to processing, and lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Contact roelof@elvison.com.

8. Platform policies

Our use of data from Meta, TikTok, Pinterest and Google complies with their developer and platform terms, including the Meta Platform Terms, TikTok API for Business terms, Pinterest Developer Guidelines and the Google API Services User Data Policy (including its Limited Use requirements).

9. Changes

We may update this policy. The date above shows the latest version.