Privacy Policy

Controller

The controller for personal data processed on this website and in the Trailmaker SaaS platform under the GDPR is the legal entity identified in our Imprint. For privacy requests, contact office@trailmaker.app. Imprint.

What data we process

We process personal data in the following categories:

• Account data (email, hashed password, display name, workspace membership)
• Brand and product data you actively enter (name, URL, positioning, angle briefs, uploaded performance exports)
• Usage data (login timestamps, feature usage, engine run logs — solely for product improvement and billing)
• Billing data on paid plans (payment via Stripe — we do not store credit card data)
• Meta integration data — when you connect a Facebook or Instagram ad account: encrypted long-lived OAuth access tokens, ad-account IDs, ad/campaign/adset IDs, and aggregated performance metrics (impressions, reach, clicks, spend, conversions). Used solely to render your performance dashboard. If you switch on the Media Buyer (Beta), additionally: the campaigns, ad sets and ads Trailmaker creates, your approvals and consents, and the videos and thumbnails you upload for Quick Deploy (see "Media Buyer (Beta)" below).
• Google sign-in data — only if you choose "Continue with Google": the e-mail address and its verification status, your name and the Google account ID, which Google sends us for sign-in. Google may also send a profile picture link; we do not use it.

Purpose

To provide the product, perform creative strategy analyses (including transfer of prompt data to our sub-processor Anthropic for LLM generation), handle billing, meet legal obligations, and communicate with you.

Onboarding emails

After you sign up, we send you a short series of automated emails: a welcome email right away and a check-in on day three with setup hints based on your current account state. If you upload an export, a few offers follow over the next days — the Profit Leak Report, the Operator plan and, later, a 14-day Pro trial that requires a card. If you start that trial, we remind you before the first charge. Workspaces that started on an earlier free trial may also get a reminder before that trial ends and a note once it has ended.

Legal basis: the welcome and day-3 emails are necessary for performance of the contract (Art. 6(1)(b) GDPR) — they enable use of the free plan you signed up for, and so is the reminder before a trial charge. The offer emails and the trial-end emails are based on our legitimate interest (Art. 6(1)(f) GDPR) in telling you about paid options for the product you use.

Right to object: every email contains a 1-click unsubscribe link. You may object to the offer and trial-end emails at any time without giving reasons and without disadvantage. An objection to all emails including the contract-fulfilment ones is possible; in that case important account information will also be suppressed.

Email delivery is handled by our processor Resend (Resend, Inc., USA; we use its EU sending region in Ireland — see sub-processor list). Because Resend's primary processing takes place in the United States, the transfer rests on the EU Standard Contractual Clauses and on Resend's certification under the EU-U.S. Data Privacy Framework.

Meta Marketing API integration

If you connect your Facebook or Instagram ad account to Trailmaker, we receive an OAuth access token from Meta with the ads_read permission. We use this token solely to fetch aggregated ad performance metrics — impressions, reach, clicks, spend, and conversions — from the ad accounts you have explicitly authorised. We do not access end-customer personal data, message content, audience-targeting attributes of individuals, or any data outside the scope of ads_read.

What we store: access token (encrypted at rest with AES-256-GCM), ad-account IDs, campaign/ad-set/ad IDs, and performance metrics keyed to those IDs.

What we never do: we do not sell, license, transfer, or share Meta Platform Data with any third party other than the strictly necessary sub-processors listed in our subprocessor overview. We do not use Meta Platform Data to build user profiles, train machine-learning models for unrelated purposes, perform identity ascertainment or surveillance, or for any purpose Meta's Developer Data Use Policy prohibits.

Disconnection and deletion: in Trailmaker, "Disconnect Meta" (Connectors) deletes the stored access token and everything synced from Meta through that connection — insights, campaign, ad-set and ad records, and the per-ad results we derived from them — from our live systems immediately (encrypted database backup copies: see Retention), and Trailmaker revokes its authorization at Meta (this is skipped while the same Facebook login is still connected in another Trailmaker workspace, and is best-effort if Meta cannot be reached; the local deletion happens either way). "Remove" next to a single ad account deletes that account's synced data in the same way. Ads you imported from a CSV export yourself are not Meta Platform Data and stay until you delete them or your account. You can also remove Trailmaker yourself on Facebook (Settings & privacy → Settings → Apps and Websites). Removing the app there does not by itself notify us: Meta sends us a data-deletion request only if you additionally click "Send Request" for the removed app. On that request we delete every token and all data synced from Meta for your Facebook user, in all workspaces, and give you a status page and confirmation code. If you only remove the app on Facebook, the token stops working and the connection shows as revoked in Trailmaker; the data we already synced is deleted when you disconnect in Trailmaker or, at the latest, when it ages out after 13 months. You may also delete your account inside Trailmaker (account menu → Settings → Profile → Delete account, or "Account & privacy" at the top of the setup page if you have not finished setup) or email office@trailmaker.app.

Media Buyer (Beta): write access, videos and Slack

The Media Buyer is optional and off by default. Only if you switch it on for an ad account and connect Meta again for it do we additionally request the ads_management, pages_read_engagement and pages_show_list permissions. We use them only within the opt-in you accept in the app: to create campaigns, ad sets and ads from videos you upload, to pause ads Trailmaker created, and, after you approve each change, to change their budgets or turn them back on. Campaigns Trailmaker did not create are not changed. If Meta does not grant ads_management, the connection stays read-only.

What we store for it: your opt-in and your beta and liability consent (text version, time, user and ad account), the daily budget maximum and spending limit you set, every approval or rejection with who gave it and when, and the IDs of the objects Trailmaker created at Meta. These records are deleted together with your workspace at the latest.

Videos and thumbnails you upload for Quick Deploy go to a private storage bucket (Supabase, USA) and from there to Meta, which runs the ads under your own agreement with Meta. An hourly clean-up deletes them once Meta no longer needs them: a video as soon as Meta reports it ready or rejects it, and 24 hours after the upload at the latest while Meta is still processing it; a thumbnail, or a file whose hand-over outcome is unclear, 6 hours after Meta fetched it; files that were never sent 24 hours after the upload. If a thumbnail is taken from your video, this happens in your browser; the video is not uploaded for it.

Slack (optional): if you connect Slack for approvals and reports, we store an encrypted bot token, your Slack workspace ID and name, the channel you picked and its name, and for each team member who links their Slack account the Slack user ID ("Sign in with Slack" with the openid scope only; we do not request e-mail or profile data). Messages contain what you also see in Trailmaker: the ad or ad set, the old and new value, the reason and the run summary. Recipient: Slack (see the sub-processor list). Disconnecting Slack in Trailmaker stops all messages; messages already posted stay in your Slack workspace under your agreement with Slack. The Slack connection is deleted with your workspace; a linked Slack user ID is deleted with your Trailmaker account.

Sign-in with Google

You can sign in or register with your Google account instead of an e-mail address and password. This is optional; the e-mail and password sign-in remains available. If you choose "Continue with Google", we send you to Google, where you sign in to your Google account. Google then sends us, through our authentication provider Supabase (see sub-processor list), your e-mail address, whether Google has verified it, your name and your Google account ID. Google may also send a profile picture link; we do not use it. We use the e-mail address and name to create or recognise your Trailmaker account, exactly as for a sign-up with e-mail and password. We do not receive your Google password, and we do not request access to your Google contacts, calendar, mail or other Google services.

Legal basis: performance of the contract, i.e. registration and sign-in (Art. 6(1)(b) GDPR). If the Google e-mail address is verified and matches an existing Trailmaker account, the Google sign-in is linked to that account.

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC (USA, parent company) receives access on the basis of its certification under the EU-U.S. Data Privacy Framework. When you sign in to your Google account, Google processes your data under its own privacy policy: https://policies.google.com/privacy. If you do not want this, use the e-mail and password sign-in instead. During the Google sign-in we set short-lived cookies that serve only that sign-in: the sign-in security cookie of our authentication provider Supabase, and a cookie that carries your cookie-banner choice for the Meta Pixel from the click on the button to the end of the sign-in (valid for at most 10 minutes, not readable by scripts, deleted when you return from Google). When Google creates a new account for you, one more one-time cookie (valid for at most 10 minutes, deleted on the first page you see afterwards) hands a registration event reference to your browser; it is not set if your browser sends the Global Privacy Control signal, and whether the registration is reported to our analytics and advertising services still depends on your choice in the cookie banner.

Legal bases

• Art. 6 (1) (b) GDPR — contract performance (Trailmaker terms of use)
• Art. 6 (1) (f) GDPR — legitimate interest (product improvement, security, abuse protection)
• Art. 6 (1) (a) GDPR — consent (newsletter, optional cookies, Meta ad-account connection, Media Buyer write access, Slack connection)

Where your data is stored and international transfers

Our production database (Supabase, AWS region us-east-1, N. Virginia), our application servers (Vercel, Washington, D.C.) and our analysis engine (Google Cloud Run, us-east4) are located in the United States. Our own systems that hold customer data are located in the United States, with one exception: our encrypted backup copies of the production database (AES-256) are kept on our own storage in Austria. If you are in the EU/EEA, the UK or Switzerland, your personal data is therefore transferred to the United States. We rely on the European Commission's Standard Contractual Clauses (2021), together with the UK Addendum and the Swiss addendum where they apply — for Supabase these are part of its Data Processing Addendum (section 12), which applies on acceptance of the agreement — and, for providers that hold it, on their certification under the EU-U.S. Data Privacy Framework. The sub-processor list shows the mechanism per provider; not every provider is certified under the Framework. Firecrawl, which reads the public pages of the websites you give us, publishes neither a data processing agreement nor a transfer mechanism; it receives only the public web addresses and the public page content, never account data.

Processors and recipients

We use carefully selected sub-processors. The full list is at Subprocessor overview.

Security

All Customer Data and Meta Platform Data is encrypted in transit (TLS 1.3) and at rest (AES-256). OAuth access tokens are stored as ciphertext in our database with a server-only key; even an attacker with row-read access cannot recover the token. We enforce row-level security on all multi-tenant tables, multi-factor authentication on every administrative system, and we maintain audit logs of security-relevant events for 90 days. To report a security vulnerability email security@trailmaker.app — we acknowledge reports within two business days and will not pursue legal action against good-faith research.

Retention

Account and brand data are stored for the duration of the contract plus statutory retention periods (e.g. Austrian UGB § 212 / BAO § 132 for billing records, typically 7 years). After account deletion, non-billing personal data is erased from the live systems within 30 days. Encrypted backup copies of the database are currently kept without automatic expiry, so erased data can remain in them; they are used only to restore the service, and erasures are re-applied after any restore. Specific retention windows per data category:

Your rights

Under the GDPR you have the following rights:

• Access to your stored data (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure of your data, unless statutory retention obligations apply (Art. 17 GDPR)
• Data portability in a structured, common format (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

To delete your account and all associated data: sign in, open the account menu → Settings → Profile → Delete account. If you have not finished the setup yet, use "Account & privacy" at the top of the setup page (trailmaker.app/account) — you can delete your account without creating a brand first. You can also email office@trailmaker.app. Deletion starts immediately and we erase all account, brand, tracking and Meta-integration data from our live systems within 30 days at the latest (encrypted backup copies: see Retention); statutory billing records are retained for 7 years per Austrian UGB § 212 / BAO § 132.

For all privacy requests you can reach us at office@trailmaker.app

If we contacted you about your ads and you are not a Trailmaker user

We sometimes write to founders and marketing leads of e-commerce brands, and to freelance media buyers and small agencies, with a short note about their brand's public Meta ads and an offer to check them. This section explains what we hold about you, where it came from and how to stop it (Art. 14 GDPR).

What we hold: your name, your role, the company or brand you work for, the public business channel we used to reach you (for example your X or LinkedIn profile or your brand's contact page), and short notes on our contact (date, channel, whether you replied). About your brand, not about you personally, we note what public sources show, such as the number of active ads in the Meta Ad Library and offers shown in those ads.

Where it came from: only publicly accessible sources: the Meta Ad Library, your brand's website, and public business profiles on X, LinkedIn or Instagram. We do not buy contact lists and we do not log in to any service to collect this data.

Purpose and legal basis: to contact you about our service and, if you reply, to continue that conversation. The legal basis is our legitimate interest in direct marketing to businesses (Art. 6(1)(f) GDPR, Recital 47). We do not use this data for anything else, we do not build profiles from it, and we do not sell or share it. We do not make automated decisions about you.

Who processes it: we keep our notes on our own systems in Austria; some earlier notes are also stored in a private repository at GitHub (GitHub, Inc., USA). We prepare the analysis of your brand's ads and our message with AI tools from Anthropic (Anthropic, PBC, USA), so the data listed above can reach Anthropic in the United States in that process. Messages you exchange with us on X, LinkedIn or Instagram are also processed by that platform under its own privacy policy.

How long: if you do not reply, we delete your entry 6 months after our last message. If you tell us not to contact you again, we keep only your name and the channel on a do-not-contact list so that we can respect that. If you become a user, the rest of this policy applies.

Your right to object: you can object at any time without giving reasons. Reply "stop" to our message or email office@trailmaker.app, and we will not contact you again (Art. 21(2) and (3) GDPR). You also have the rights to access, rectification, erasure and restriction (Art. 15–18 GDPR) and the right to lodge a complaint with a supervisory authority; ours is the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

If you are in the United States: we do not sell or share this data, and you can use the rights described under "California (CCPA / CPRA)" and "Other US states" below for it as well. Any marketing email we send follows the CAN-SPAM rules described at the end of this policy.

Cookies and tracking

Trailmaker uses only technically necessary cookies for authentication (Supabase session cookie), CSRF protection and remembering your cookie choice (tm_consent). If you use Google sign-in, short-lived cookies for that sign-in are added (see "Sign-in with Google"). Marketing or analytics cookies are set only after explicit consent via our consent manager — these include Google Analytics 4, Bing UET, Vercel Analytics, Meta Pixel with Conversions API (CAPI), PostHog product analytics, and two Trailmaker cookies kept for up to 90 days: an anonymous visitor ID (tm_aid, with analytics or advertising consent) and the campaign parameters of the visit that brought you here (tm_attr, with advertising consent). Both are deleted when you withdraw that consent.

California (CCPA / CPRA)

If you reside in California, the California Consumer Privacy Act (CCPA, as amended by the CPRA in 2023) grants you the following rights with respect to Trailmaker:

• Right to Know - what personal information we have collected about you, where it came from, and who we shared it with.
• Right to Delete - have your data deleted (subject to statutory exceptions).
• Right to Correct - have inaccurate personal information corrected.
• Right to Opt-Out of Sale/Share - we do not sell personal information, but our advertising and analytics pixels constitute "sharing" under the CPRA. You can opt out at any time via the Cookie Settings button, a GPC browser signal, or our "Do Not Sell or Share" page at /legal/do-not-sell; we apply your opt-out and instruct our advertising partners accordingly.
• Right to Limit Use of Sensitive Personal Information - we do not intentionally collect sensitive personal information (health, biometric, precise geolocation, religious or philosophical belief, sex life). Our third-party analytics and advertising pixels may receive device-level data such as your IP address, which yields only coarse, city-level location and not precise geolocation; we do not use it to infer sensitive characteristics.
• Right to Non-Discrimination - exercising any of these rights will never lead to degraded service or different pricing.

We honour the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale/sharing of personal information (California Code of Regulations Title 11 Section 7025). GPC is in addition to - not a substitute for - our "Do Not Sell or Share My Personal Information" page at /legal/do-not-sell. When a GPC signal is detected, your opt-out is applied to your browser and, where you are signed in, to your account.

Submit a request by email at office@trailmaker.app. We confirm receipt within 10 business days and provide a substantive response within 45 calendar days of receipt; where reasonably necessary we may extend by up to a further 45 days (90 days total) and will tell you why. You may use an authorised agent, who must provide proof of your authorisation. /legal/do-not-sell.

Other US states

Residents of US states with comprehensive privacy laws - including California, Virginia, Colorado, Connecticut, Texas, Oregon, and others - have rights of access, correction, and deletion, and the right to opt out of targeted advertising and the sale or sharing of personal information. Several states (such as Colorado and Connecticut) additionally require opt-in consent before sensitive personal information is processed; these rights are not identical across states. We extend the strongest protections available under any applicable US state privacy law to all US users, and we determine your state of residence from your account information rather than asking you to self-identify. To exercise any right, contact office@trailmaker.app.

Children's data (COPPA)

Trailmaker is a business tool intended for users aged 18 or over and is not directed at children under 13. We do not knowingly collect personal information from children under 13 and operate no child-directed features; we rely on an actual-knowledge standard. If we learn that we have collected data from a child under 13, we delete it promptly. Parents or guardians can reach us at office@trailmaker.app to review or request deletion of a child's information.

Marketing email (CAN-SPAM Act)

Marketing emails (such as our day-3 and day-6 onboarding emails) include our real sender identity, a subject line that is not false or misleading, our physical postal address in the footer, and a working unsubscribe link that stays active for at least 30 days and requires nothing beyond your email address. We honour unsubscribes within 10 business days. Purely transactional email (login codes, invoices) is exempt under CAN-SPAM; where an email mixes transactional and promotional content we treat it as marketing.