Privacy Policy

This Privacy Policy describes how App Ads Marketing ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the Pulse platform and related services (collectively, the "Services"). By using the Services, you agree to the terms of this Privacy Policy. This policy is governed by the laws of the State of Michigan, U.S.A.

If you do not agree with this Privacy Policy, you must discontinue use of the Services.

1. Information We Collect

When you use the Services, we may collect the following categories of personal information:

• Account Information: Your name, email address, password (stored in encrypted form), and any other information you provide when creating or managing your account.
• Usage Information: Information collected passively through your use of the Services, including IP address, browser type, operating system, pages visited, session duration, and standard web log data.
• Financial Data (Sensitive): If you connect a bank account or financial institution through the Services, we collect financial account information including account details, account numbers (masked), transaction history, account balances, investment holdings, and related financial data. This information is collected through Plaid Inc. ("Plaid") and is subject to both this Privacy Policy and Plaid's Privacy Policy. By connecting your financial accounts, you authorize us to retrieve this information through Plaid on your behalf. We are not a financial institution and do not store raw account credentials.
• Third-Party Integration Data: If you connect third-party services such as Google, Microsoft, or other platforms, we collect data from those services as authorized by you during the connection process. You control what you share and may revoke access at any time.
• Payment Information: When you subscribe to the Services, payment card information is collected and processed by Stripe Inc. We do not store raw payment card data on our systems.
• Communications: Any information you submit through the Services, including messages, feedback, or support requests.
• Device and Technical Information: Device identifiers, browser settings, time zone, and similar technical data collected automatically when you access the Services.
• Supplemental Information: We may receive additional information about you from third-party sources and combine it with information we have collected directly.

We collect only the information reasonably necessary to provide and improve the Services. We do not knowingly collect personal information from children under the age of 16. If you are under 16, please do not submit any personal information through the Services. If you believe a child under 16 has provided personal information to us, please contact us at info@appadsmarketing.com and we will take appropriate action, including deletion of that information.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Services;
• Process and analyze financial data you connect to the Services, including using AI-assisted tools to surface insights from your data;
• Authenticate your identity and manage your account;
• Process transactions and manage your subscription;
• Respond to your requests, resolve disputes, and provide customer support;
• Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity;
• Send service announcements, administrative messages, and other communications related to your use of the Services (you may opt out of non-essential communications);
• Comply with applicable laws, regulations, and legal obligations;
• Enforce our Terms of Service and other policies;
• Analyze usage patterns to improve the Services and develop new features.

We do not use your financial data for advertising purposes and do not sell or share your personal information with third parties for their own marketing use.

3. AI Processing of Your Data

The Services include AI-powered features that analyze your connected data to provide insights and assistance. This constitutes automated processing of your personal information. When your data is processed by AI systems, we apply the following protections:

• PII Tokenization: Before any data is transmitted to external AI providers, personally identifiable information — including Social Security numbers, credit card numbers, email addresses, phone numbers, dates of birth, and bank routing numbers — is detected and replaced with opaque tokens. These tokens are reversed after the AI response is returned, so your data is never exposed to AI providers in its identifiable form.
• Data Minimization: Only data necessary to fulfill your specific AI-assisted request is transmitted. We do not send your entire data set to AI providers by default.
• Third-Party AI Providers: We use Anthropic and OpenAI as AI service providers. These providers process data only as necessary to return a response and are bound by data processing agreements that restrict further use of your data.
• No Autonomous Decisions: AI outputs in the Services are informational and analytical in nature. We do not use automated AI processing to make decisions that produce legal or similarly significant effects about you without human review.

4. How We Share Your Information

We do not sell your personal information. We do not share your personal information with third parties for their own marketing or advertising purposes. We may share your information only in the following circumstances:

• Service Providers: We share information with trusted third-party vendors who assist us in operating the Services under contractual obligations to protect your data. These include:
  • Plaid Inc. — financial data connectivity (plaid.com/legal)
  • Stripe Inc. — payment processing (stripe.com/privacy)
  • SmarterASP.NET — primary web application hosting and Microsoft SQL Server database hosting
  • Amazon Web Services (AWS) — cloud storage
  • Cloudflare Inc. — content delivery and cloud storage
  • DigitalOcean LLC — cloud infrastructure for supplemental application services
  • Twilio Inc. — communications and SMS notifications
  • Anthropic PBC / OpenAI — AI-assisted features (PII tokenization applied before transmission)
• Legal Requirements: We may disclose information where required by law, court order, or government authority, or where necessary to protect the rights, property, or safety of App Ads Marketing, our users, or others.
• Business Transfers: If App Ads Marketing is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may share your information for other purposes with your explicit prior consent.

5. Cookies and Tracking

We use cookies and similar tracking technologies to operate and improve the Services. Cookies are small files stored on your device that help us maintain your session, remember your preferences, and analyze usage.

Analytics Tools: We do not use third-party analytics services (such as Google Analytics, Mixpanel, or similar tools) to track your activity across the Services. Usage data collected by the Services is processed internally and is not shared with analytics providers.

Do Not Track: Some browsers offer a "Do Not Track" (DNT) signal. The Services do not currently respond to DNT signals as no uniform standard for DNT compliance has been adopted. We will revisit this position if a standard is established.

You may configure your browser to refuse cookies, but doing so may limit your ability to use certain features of the Services. We are not responsible for cookies placed by third-party services embedded in or linked from the Services.

6. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of sensitive data at rest using AES-256-GCM with account-specific keys;
• Encryption of all data in transit using TLS 1.2 or higher, with HTTP Strict Transport Security (HSTS) enforced;
• Role-based access controls limiting access to your data within the Services;
• Multi-factor authentication (MFA) support for user accounts, which we strongly encourage you to enable;
• Application-layer security controls including CSRF protection and session expiration.

No method of transmission over the internet or electronic storage is 100% secure. While we implement commercially reasonable security measures, we cannot guarantee the absolute security of your information.

7. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Investigate and contain the breach as promptly as practicable;
• Notify affected users without unreasonable delay and, where required by applicable law, within the legally specified timeframe (typically 30–72 hours for regulatory notifications and as soon as reasonably possible for individual notifications);
• Notify relevant third-party partners (including Plaid and Stripe) as required by our agreements with them;
• Provide information about the nature of the breach, the data affected, steps taken, and recommended actions you can take to protect yourself.

To report a suspected security issue, contact us immediately at info@appadsmarketing.com.

8. Data Retention

We retain your personal information for as long as your account is active or as necessary to provide the Services, subject to the following general guidelines:

• Account data: Retained for the duration of your account. Upon closure, personal data is removed from active systems within a reasonable period, typically within 90 days.
• Financial transaction data: Retained for up to 7 years where required or advisable under applicable financial recordkeeping laws and regulations.
• Application logs and error records: Retained for up to 12 months for security and debugging purposes.
• Communications and support records: Retained for up to 3 years to resolve disputes and maintain service quality.
• Payment records: Retained as required by Stripe and applicable tax and financial regulations.

We may retain certain information beyond these periods where required by law, to resolve disputes, prevent fraud, or fulfill our contractual obligations. When data is no longer required, we delete or anonymize it securely.

9. Your Rights and Choices

Depending on where you reside, you may have certain rights with respect to your personal information. To exercise any of these rights, contact us at info@appadsmarketing.com. We will respond to verifiable requests within 45 days, or as otherwise required by applicable law.

• Access: You have the right to request a copy of the personal information we hold about you.
• Correction: You have the right to request that we correct inaccurate or incomplete personal information. You may update most information directly through your account settings.
• Deletion: You may request deletion of your personal information. We will honor such requests subject to any legal retention obligations. Note that some information may need to be retained to comply with law or resolve outstanding matters.
• Data Portability: You have the right to receive a copy of your personal information in a structured, commonly used, machine-readable format, where technically feasible.
• Opt-Out of Communications: You may opt out of non-essential communications at any time through your account settings or by contacting us.
• Restrict or Object to Processing: In certain circumstances, you may have the right to restrict or object to our processing of your personal information.
• Financial Account Disconnection: You may disconnect any linked financial account at any time through the Services. Upon disconnection, we will cease retrieving new data from that account. Previously retrieved data is subject to our retention policy above.

We do not discriminate against users who exercise their privacy rights.

10. California Residents — Additional Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following additional rights:

• Right to Know: You have the right to know the categories and specific pieces of personal information we collect, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Data Portability: You have the right to receive your personal information in a portable format.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information and do not share it with third parties for cross-context behavioral advertising. You therefore have nothing to opt out of under this provision, but you may confirm this practice at any time by contacting us.
• Right to Limit Use of Sensitive Personal Information: We collect financial data, which qualifies as sensitive personal information under CPRA. We use sensitive personal information only to provide the Services you have requested. We do not use it for inferring characteristics about you unrelated to the Services or for secondary commercial purposes.
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California rights, contact us at info@appadsmarketing.com. We will verify your identity before processing your request and respond within 45 days (with one possible 45-day extension where reasonably necessary).

Authorized Agents: California residents may designate an authorized agent to submit requests on their behalf. We will require written proof of authorization and may verify your identity directly.

11. Other U.S. State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states with enacted consumer privacy laws may have rights similar to those described above, including rights to access, correct, delete, and port personal information, and to opt out of certain processing activities. We extend these rights to all U.S. residents to the extent required by applicable state law.

Right to Appeal: If we decline to take action on your privacy rights request, you may appeal that decision by contacting us at info@appadsmarketing.com with the subject line "Privacy Rights Appeal." We will review your appeal and respond within 60 days. If your appeal is denied, we will provide information about how to contact your state's attorney general or applicable regulatory authority.

12. Account Protection

Your account password is the key to protecting your personal information. Use a strong, unique password and do not share it with others. You are responsible for all activity that occurs under your account. If you believe your account has been compromised, contact us immediately at info@appadsmarketing.com and change your password. The Services support multi-factor authentication (MFA) via authenticator app, email code, or SMS code, which we strongly encourage you to enable.

13. Third-Party Links and Services

The Services may contain links to or integrations with third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you connect to or access through the Services. We are not responsible for the privacy practices or content of third-party services.

14. Cross-Border Data Transfers

The Services are operated and hosted in the United States. If you access the Services from outside the United States — including from Canada — your personal information will be transferred to, stored, and processed in the United States and in other countries where our service providers maintain infrastructure. Data protection laws in these countries may differ from those in your home country. By using the Services, you acknowledge and consent to this transfer and processing.

Our primary infrastructure providers and the countries in which they operate include:

• SmarterASP.NET — United States (primary web application and SQL Server database hosting)
• DigitalOcean — United States (supplemental application infrastructure)
• Amazon Web Services (AWS) — United States (cloud storage)
• Cloudflare — United States and global edge network (content delivery)
• Stripe — United States (payment processing)
• Anthropic / OpenAI — United States (AI processing, with PII tokenization applied)

We take steps to ensure that personal information transferred across borders receives a comparable level of protection to that required in your home jurisdiction, including through contractual safeguards with our service providers.

15. Canadian Residents — Additional Rights (PIPEDA and Quebec Law 25)

If you are a resident of Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you are a resident of Quebec, under Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). The following additional information applies to you.

Cross-Border Transfers and Comparable Protection: Your personal information is transferred to and processed in the United States. PIPEDA permits such transfers provided that comparable protections are in place. We ensure this through contractual agreements with our service providers. Please be aware that once your information is in the United States, it may be subject to lawful access by U.S. government authorities under applicable U.S. laws.

Consent: We rely on your consent as the legal basis for collecting, using, and disclosing your personal information. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us at info@appadsmarketing.com. Withdrawal of consent may affect our ability to provide the Services to you.

Your Rights Under Canadian Law: In addition to the rights described in Section 9 above, Canadian residents have the right to:

• Access: Request access to the personal information we hold about you and receive an explanation of how it has been used or disclosed.
• Correction: Challenge the accuracy or completeness of your personal information and request that it be corrected.
• Withdraw Consent: Withdraw consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual limitations.
• Complain to a Regulator: Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or, for Quebec residents, with the Commission d'accès à l'information du Québec (CAI) at cai.quebec.ca.

Quebec Residents — Additional Requirements (Law 25):

• Privacy by Default: We apply privacy-protective defaults when collecting and using personal information. We collect only the minimum information necessary to provide the Services.
• Automated Decision-Making: Where the Services use automated processing (including AI-assisted features) to analyze your personal information, you have the right to be informed of this fact, to request that a person review any automated decision that significantly affects you, and to submit observations regarding such a decision.
• De-indexation / Deletion: Quebec residents have the right to request that personal information collected online be de-indexed or that any hyperlink enabling access to that information be suppressed, where continued dissemination causes serious injury to you.
• Data Portability: Quebec residents have the right to receive personal information held about them in a structured, commonly used technological format and to request that it be communicated to any person or body authorized to collect such information.
• Cross-Border Transfer Assessment: Before transferring personal information outside Quebec, we conduct a privacy impact assessment (PIA) to ensure the information receives adequate protection in the destination jurisdiction, as required under Law 25.

To exercise any of your Canadian privacy rights, please contact us at info@appadsmarketing.com with the subject line "Canadian Privacy Request." We will acknowledge your request within 10 business days and respond fully within 30 days, or as otherwise required by applicable law.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on this page with a revised effective date and, where appropriate, by sending an email notification at least 14 days before the changes take effect. Your continued use of the Services after any changes constitutes your acceptance of the updated policy. We will not materially reduce your rights under this policy without your explicit consent.

Prior versions of this Privacy Policy are available upon request.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: