Privacy Policy

1. Scope and roles

This Policy applies to Octane websites, applications, communications, waitlists, and services. Octane Creative AI and the Octane contracting entity identified on an order form or invoice are the controllers of account, website, commercial, and operational data described here.

For personal data contained in content that a business customer submits to the Service, the customer is generally the controller and Octane is its processor. In that case, the customer's privacy notice governs and our Data Processing Addendum applies where required. We do not knowingly collect personal data from children under 18.

2. Data we collect

Data you provide

• ·Account and profile data, including name, work email, company, role, login details, and account preferences.
• ·Waitlist and sales data, including company website, advertising spend range, creative volume, business needs, timeline, and messages.
• ·Customer Content, including prompts, ads, images, videos, brand assets, product information, URLs, campaign briefs, and files you upload.
• ·Commercial and support data, including plan, transaction, billing status, team membership, support requests, and feedback. Payment card details are handled by our payment processor rather than stored by Octane.

Data collected automatically

• ·Technical and device data, such as IP address, browser, operating system, device type, language, timestamps, and approximate country.
• ·Usage and security data, such as pages and features used, clicks, generated assets, credit events, errors, request identifiers, authentication events, and suspected abuse.
• ·Essential cookie and local storage data used for sessions, authentication, security, and interface preferences.
• ·Anonymous web performance data, including route, browser, device type, country, connection type, and Core Web Vitals.
• ·First-party product measurement events stored in our own database, including page paths with record identifiers removed, feature events, a session identifier, and a device category.
• ·Optional product analytics, collected only where you allow it. This covers in-product usage and session replay through PostHog, and marketing page visits through Google Analytics 4. Replay masks text entered into form fields, and we do not enable Google advertising features.

Data from other sources

• ·Public advertising libraries, public brand websites, landing pages, and publicly accessible social or commercial sources.
• ·Team owners, colleagues, referral sources, identity providers, payment providers, and service partners.
• ·Inferred data, such as brand categories, creative patterns, likely campaign attributes, scores, trends, and fraud or security signals.

3. Why we use data and our legal bases

• ·Provide and administer the Service: create accounts, authenticate users, process Customer Content, generate and analyze creative, manage workspaces, deliver support, and bill customers. The legal basis is performance of a contract or steps requested before a contract.
• ·Secure and improve Octane: prevent fraud and abuse, troubleshoot, monitor reliability and cost, develop features, evaluate models, and understand aggregate use. The legal basis is our legitimate interests in operating a safe and effective service.
• ·Communicate: send transactional notices, respond to requests, and contact waitlist applicants about requested access. The legal basis is contract steps or legitimate interests. We use consent where required for marketing.
• ·Comply and protect: meet legal, tax, accounting, sanctions, and regulatory duties; enforce agreements; and establish or defend claims. The legal basis is legal obligation or legitimate interests.
• ·Understand product use: measure which features are used, where people get stuck, and how the product performs, so we can decide what to build and fix. First-party measurement in our own systems relies on our legitimate interests in operating and improving the Service. Optional analytics through PostHog and Google Analytics 4 relies on your consent, and neither loads until you give it.
• ·With permission: use data for another purpose we clearly describe when asking for consent. Consent may be withdrawn at any time without affecting earlier processing.

We do not use Customer Content to train a general-purpose model for other customers unless we obtain express permission. We may use de-identified or aggregated information that can no longer reasonably identify a person or customer to measure and improve the Service.

4. AI processing and automated analysis

Octane uses machine learning and third-party AI providers to analyze and generate text, images, video, embeddings, classifications, and recommendations. Depending on the feature, prompts and relevant Customer Content may be sent to those providers. We configure providers and contracts to restrict their use of Service data where commercially available.

Octane may automatically score advertising creative, infer categories and audiences, screen content, prioritize processing, and detect abuse. These features support creative and operational decisions. Octane does not use them to make decisions that produce legal or similarly significant effects about individuals. A person can review or disregard creative recommendations.

5. When we disclose data

We disclose personal data only as reasonably necessary to the following recipients:

• ·Service providers: hosting, database, authentication, storage, AI inference, payments, email, customer support, security, and performance monitoring providers. Current providers appear on our Subprocessor List.
• ·Your organization: workspace owners and administrators may access and control organization accounts and content.
• ·Professional advisers: lawyers, auditors, insurers, accountants, and financial advisers under appropriate duties.
• ·Authorities and protected parties: when reasonably necessary to comply with law, respond to valid process, protect rights or safety, investigate abuse, or enforce agreements.
• ·Corporate transactions: a buyer, investor, lender, or successor involved in a financing, merger, reorganization, or sale, subject to appropriate confidentiality and continued protection.
• ·At your direction: third parties and integrations you choose to use.

We do not sell personal data for money. We do not share personal data for cross-context behavioral advertising. We do not use sensitive personal data to infer characteristics. If those practices change, we will update this Policy and provide legally required choices before the change applies.

6. International transfers

Octane and its service providers may process data in the European Economic Area, the United States, and other countries. Where required, we rely on adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may request information about applicable safeguards from privacy@octanestudio.ai.

7. Retention

We keep personal data only as long as reasonably necessary for the purpose collected, including to provide the Service, meet legal and accounting obligations, resolve disputes, prevent fraud, and enforce agreements. Retention depends on data type and context:

• ·Account, workspace, and Customer Content: while the account is active, then normally deleted or de-identified within 30 days after a verified deletion request or contract end, subject to backups and legal holds.
• ·Backups: isolated until overwritten under the backup cycle, normally within 90 days.
• ·Billing, tax, and transaction records: for the legally required accounting and tax period, commonly 7 to 10 years depending on jurisdiction.
• ·Security, fraud, and operational logs: normally 30 to 365 days, longer where needed to investigate an incident or defend a claim.
• ·Waitlist and sales records: up to 24 months after the last meaningful interaction, unless you ask us to delete them sooner or a relationship begins.
• ·Legal acceptance records and disputes: for the agreement term and the applicable limitation period.

Deletion from active systems does not require deletion of de-identified aggregate data. Data under a legal hold will be isolated and retained only as long as the hold requires.

8. Your rights and choices

Depending on where you live, you may have rights to access, know, correct, delete, or port personal data; restrict or object to processing; withdraw consent; opt out of certain disclosures; and appeal a denied request. You may also have the right not to receive discriminatory treatment for exercising privacy rights.

Submit a request from account settings or email privacy@octanestudio.ai with the subject "Privacy Request." We may verify identity and authority, ask for information needed to locate records, or decline requests where an exemption applies. Authorized agents must provide proof of authority. We aim to respond within 30 days and will follow shorter or longer statutory periods where applicable.

European Economic Area, United Kingdom, and Switzerland

You may object to processing based on legitimate interests and lodge a complaint with your local supervisory authority. If you are in Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados. Please contact us first so we can try to resolve the concern.

California and similar US state laws

Subject to legal applicability and exceptions, you may request the categories and specific pieces of personal information collected, sources, purposes, recipients, correction, or deletion. Because we do not sell or share personal information for cross-context behavioral advertising, there is no sale or sharing to opt out of. We will honor legally required browser-based opt-out preference signals if our practices change in a way that makes them applicable.

Communications

You can unsubscribe from marketing emails using the link in the message. We may still send account, security, billing, and service communications. Browser controls can manage cookies and local storage, though blocking essential storage may prevent the Service from working.

9. Security

We use administrative, technical, and organizational safeguards designed for the nature of the data and risk, including encryption in transit, access controls, authentication, logging, environment separation, backups, and vendor review. No method is completely secure. You are responsible for account security and for avoiding unnecessary sensitive data in prompts or uploads. Report suspected vulnerabilities to security@octanestudio.ai.

10. Third-party services and public content

The Service may link to third-party sites, platforms, ads, or integrations. Their privacy practices govern their services. Public advertising and brand data may include names, images, handles, or other information made public by advertisers, publishers, or platforms. We process that data to provide advertising research and market intelligence, based on legitimate interests and subject to applicable rights and source restrictions.

11. Children and restricted data

Octane is not directed to children and is limited to users 18 or older. Do not submit children's data, health data, biometric identifiers, government identifiers, payment card data, precise geolocation, or other highly sensitive or regulated data unless an authorized Octane order form expressly permits it. Contact us if you believe a child has provided personal data.

12. Changes and contact

We may update this Policy to reflect changes in law, technology, or our practices. The effective date will identify the current version. We will provide additional notice before a material change where required. We do not treat continued use as consent where law requires affirmative consent.

Privacy questions and requests: privacy@octanestudio.ai

Legal questions: legal@octanestudio.ai