Privacy Policy

Your data is stored in a PostgreSQL database with encrypted connections. Passwords are hashed using bcrypt with a cost factor of 12. Authentication tokens are signed with a secure secret using JWT.

We implement security headers including X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and strict Referrer-Policy to protect against common web vulnerabilities.

API routes are protected by authentication middleware, and all AI endpoints are rate-limited to 10 requests per minute per user to prevent abuse.

We use the following third-party services:

• Google AI (Gemini) — For AI image and text generation. Your prompts are sent to Google's API for processing. See Google's Privacy Policy.
• Pollinations.ai — As a fallback image generation provider. Prompts may be sent to Pollinations when Google AI is unavailable.
• Resend — For sending transactional emails (team invitations, password resets). Recipient email addresses are shared with Resend for delivery.
• Stripe — For payment processing on paid plans. Payment information is handled directly by Stripe and never stored on our servers.
• Google OAuth — For social sign-in. We receive your public profile information from Google when you choose to sign in with Google.
• Umami Analytics — Privacy-friendly website analytics, loaded only if you accept analytics in our cookie banner. It collects aggregated, anonymous usage data (such as page views and referrers) and records anonymised session replays and click heatmaps so we can see how pages are used. Text you type into form fields is masked and not recorded. It does not set tracking cookies and does not track you across other sites or store personally identifiable information.
• Google Ads — Conversion measurement for our own advertising, loaded only if you accept marketing cookies in our cookie banner. It lets Google tell us whether a visit or sign-up followed one of our adverts and sets Google advertising cookies for that purpose. We do not use it to build audiences for third parties. See how Google uses advertising data.

You have the right to:

• Access your personal data through your account settings and generation history
• Update your account information including name and password
• Delete your account and all associated data through the account settings page
• Export your email templates as HTML files
• Withdraw consent by closing your account at any time

Account deletion is permanent and removes all your data including templates, generation history, campaigns, and team memberships.

InstantCampaign uses essential cookies for authentication and session management. These cookies are required for the service to function and cannot be disabled.

• Session cookie (next-auth.session-token) — Stores your encrypted authentication session
• CSRF token (next-auth.csrf-token) — Protects against cross-site request forgery

Analytics (optional). With your consent we load Umami, a privacy-friendly analytics tool that helps us understand how the site is used. Umami does not set tracking cookies, does not collect personally identifiable information, and does not track you across other websites.

Marketing (optional). With your consent we load the Google Ads tag so that Google can tell us whether a visit or sign-up followed one of our own adverts. This sets Google advertising cookies (such as _gcl_au). We do not sell or share your data for third-party advertising, and nothing is loaded if you decline.

Analytics and Marketing stay off until you choose “Accept all” (or enable them individually) in our cookie banner. You can change or withdraw your choice at any time using the Cookie Preferences link in the footer.