Privacy policy
This policy explains what data we collect, why we collect it, who can see it and how to delete it, in plain language.
Last updated:
1. Controller
The controller for this website and the Intentos service is Ahmed Shahed Noori, Johannisthaler Chaussee 353, 12351 Berlin, Germany. Privacy questions: privacy@intentos.eu.
2. Information we collect
When you create an account we collect your name, email address and authentication credentials. When you use the service we store what you create in it: saved and captured ads, folders, boards, briefs, Creative Directions, generated images and videos, settings and ideal customer profiles. If you connect a messaging channel (WhatsApp Business or Instagram) we store the messages, the account name and the access credentials for that channel. If you connect a Meta ad account we store its identifiers, an access token and the performance figures we read from it. We do not collect data beyond what is needed to run the service.
3. Meta platform data (WhatsApp, Instagram, ads)
Intentos uses the official Meta APIs. For a connected WhatsApp Business or Instagram business account we access messages sent to that account, its name and identifier, and a Meta issued access token that lets us send the replies you write. Conversations are scored as leads for you inside your account. For a connected ad account we read campaign, ad set, ad and insight data to run the audit; changes to ads only happen through actions you approve. We do not use Meta platform data for advertising or profiling beyond these features and do not share it with third parties except the processors listed below. If you opt in to the Conversions API, events for qualified and won leads are sent to the dataset you choose; message text is never part of an event. You can disconnect any channel or ad account at any time.
4. Public ad and social media data
Intentos works with publicly available content: ads from the Meta Ad Library and public TikTok and Instagram profiles. This is the same content anyone can see. We do not access private accounts or private messages through these features.
5. The Intentos Chrome extension
The free extension "Intentos for the Ad Library" works only on Meta Ad Library pages (facebook.com/ads/library). It handles: (a) ad content you see there, which it sends to your Intentos account only when you save an ad, track a brand or when a tracked brand is captured; (b) the EU and UK reach, country, age and gender figures Meta publishes for an ad, requested in your own browser session when you check spend, which stay in your browser unless you save the ad; (c) a connection token that links the extension to your account, revocable at any time; your Facebook login and cookies are never read, stored or sent to us; (d) your name, email and profile picture from your Intentos account, shown in the extension panel; (e) the address of the Ad Library page when the extension reports that its page reading still works. It does not read other websites, track your browsing or log clicks or keystrokes, and its data is not used for advertising. The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
6. How we use your data
Your data is used only to deliver the service: storing your work, running the analyses and generations you start, scoring your leads, running your audit, showing your inbox and signing you in. We do not sell, rent or share your personal data for marketing.
7. Processors
We use these processors to deliver the service: Supabase (database, file storage and authentication, Frankfurt, EU), Vercel (hosting), Meta (WhatsApp Business, Instagram messaging and Marketing APIs), Stripe (payments), OpenAI (decision model for ad, lead and audit judgements), Google (video analysis and, only with your consent, Google Analytics on this website), Moonshot AI (brief generation), fal.ai (image and video generation), Deepgram (video transcripts), Apify (collection of public social media data) and Resend (transactional email). Each processes data only as needed for the service.
8. Storage and security
Your database and files are stored by Supabase in Frankfurt (eu-central-1). Row level security makes sure each account can only read its own data. Connections use TLS. Passwords are hashed by our authentication provider and never stored in plain text. Extension tokens and API keys are stored only as SHA-256 hashes.
9. Your rights (GDPR)
You have the right to access your personal data, to have it corrected or deleted, to restrict processing, to object, to data portability and to complain to a supervisory authority. To exercise these rights email privacy@intentos.eu.
10. Cookies and analytics
By default this website only uses essential storage: the sign in session cookies of our authentication provider when you sign in, and local storage for your theme, language and your cookie choice. Google Analytics 4 only loads after you choose "Accept analytics" in the cookie banner. It then sets the _ga cookies to measure page views and clicks on our calls to action, with IP anonymisation and with advertising features denied through Consent Mode. You can change your choice at any time on the cookie settings page or with the link in the footer; withdrawing removes the analytics cookies.
11. Data deletion
You can delete your data at any time: delete single leads and their messages in the Leads drawer, disconnect a channel in the Inbox, delete your whole account in Settings, or email privacy@intentos.eu. Details are on the data deletion page.
12. Retention
We keep your account data for as long as your account is active. When you delete your account, its data is deleted. Backups held by our database provider expire on their own schedule.
13. Children
Intentos is not intended for users under 16. We do not knowingly collect data from minors. If you believe we have, contact us and we will delete it.
14. Changes and contact
We will tell you about material changes to this policy by email. Privacy questions: privacy@intentos.eu. Everything else: hello@intentos.eu.