Privacy Policy

1. Who is responsible for your data

Brooklyn Social House LLC, Brooklyn, New York, United States, is the controller of the personal data described here. For privacy questions, requests, or complaints, write to daryl@makedovey.com and we will respond within thirty days, or sooner where the law requires it.

2. What we collect

Account information. Your email address, which is your account and how you sign in, and your basic Google profile if you sign in with Google, never your Google password. During signup we may also ask for your name, your role, your industry, and how you heard about us. If you sign up or connect through an AI assistant, we also keep the name that assistant gives itself when it connects (such as Claude), the address it returns to, and which person and workspace approved it.

Free plan checks. When a new workspace is made, we check whether it can have the Free plan. We compare your email domain with a list of throwaway mail services and look it up in public DNS to see that it can receive mail. We keep your email address in a normalised form (lower case, with any +tag removed, and for Gmail without the dots) so that one person gets one Free allowance, together with a salted hash of the network address you signed up from, so we can count sign-ups from one network without keeping the address itself in that record.

The waitlist. If you joined it while it was open, the email address, website and note you gave us, and the search, remix or plan you were looking at when you joined, so we know what you came for.

Content you provide. The searches and questions you ask, the conversations you have with Klayson's agent on the web and on the canvas, your bookmarks and collections, the creators you save and your lists, your canvases and workflows, what is on them, the comments you leave on them and whether you have shared them, the messages you send Klayson in Slack and the files attached to them, your instructions, product photos, logos, brand imagery, style references you upload, your brand details, the brand style and the numbers and claims you confirm, and your website address.

Content we create for you. The ads Klayson designs for you, the creative documents behind them, and their exported files.

What you do through an AI assistant. When you use Klayson from ChatGPT, Claude or another assistant you connect, the assistant sends Klayson what it needs for your request: the words of the request as the assistant passes them on (for example "make a Black Friday ad" or the new headline), the ids of the ads and canvases it works on, and files you choose to give it, such as a product photo. We keep these with your workspace like anything you do on the web, together with which assistant made each call. We do not receive your other conversations with the assistant, your assistant account details or your assistant's memory.

Information from your website. If you give us your website address, we read your site with our own fetcher and a headless browser: the page you give us, up to six other pages on the same site such as product pages, and the product feed it publishes. From them we take your business description, marketing language, colours, logo, products, and their pictures. We also look up the ads your brand already runs in the Meta Ad Library, by your domain.

Your Meta ad account. If you connect it, an access token, which we encrypt before we store it, and what Klayson found and you chose when you connected: your business portfolio's id, the Meta user id of the person who connected and the permissions they granted, and the ids and names of your ad accounts (with their currency and time zone), Pages, Instagram accounts and pixels. We also keep what we read with the token: your ads and their performance figures, such as spend, impressions, clicks, and results for each ad.

Ads Klayson publishes for you. For each ad Klayson publishes to your ad account, we keep with that ad in your workspace the ids Meta gives its campaign, ad set, ad and creative, the settings it was published with, its status, Meta's review decision and any feedback that came with it, its results, and who in your workspace saved it as a draft, published or paused it, with their Slack name when they pressed in Slack.

Slack. If you add Klayson to Slack, an access token for your Slack workspace, the channel Klayson posts to, and the messages and files described above. Klayson acts on messages that mention it, direct messages to it, and replies in its own threads.

Usage and generation records. To keep the product improving we record each generation and what shaped it: the brief, the model used, the prompt, a snapshot of the brand details at that moment, cost, and how long it took. We also record product events such as when a creative is approved, skipped, changed, or exported, and each workflow run with its steps. These corrections are the most useful signal we have for making output better. To measure your plan's usage, we also record each paid call made for your workspace (the provider and model, how much it processed, and what it cost us) and count the calls your connected AI assistants make.

Payment information. Stripe processes your payments and holds your card details. We receive and store your Stripe customer and subscription identifiers, your plan, its status, renewal dates, and the reason you give if you cancel. We never receive your full card number.

Advertising attribution. When you first arrive on our site, your browser keeps the campaign details of the link you came from (such as its utm tags and Meta's click identifier), the site that referred you, and the page you landed on, for up to 30 days. When you create a workspace we store them on it once, so we can tell which advertising actually works. When you reach our docs from an AI assistant, we record the page, that you came from an assistant, and which one you chose. The app you pick in Continue in is remembered only in your own browser.

What we do not collect. We do not ask for or want your card number, government identifiers, health information, or precise location, and nothing in the product requests them. If you send us something like that anyway, we will delete it on request.

Technical information. IP address, browser and device information, and log data created when you use the service.

The poster product. Klayson's poster product, which you used by texting a number, ended on October 14, 2026, and we no longer receive or send text messages. If you used it, we still hold your phone number, which workspace it belonged to, the messages you sent and the replies we sent, and the designs made from them, until you ask us to delete them.

3. Information about advertisers and creators

Klayson also holds information about people and businesses who are not our customers, because that is what the product searches. Ads and advertisers come from the Meta Ad Library, which Meta publishes: the advertiser's page name and identifiers, the ad copy, the creative, the platforms it ran on and its start date. Creators come from public TikTok and Instagram profiles and posts: the handle, the display name, the bio, the follower count, the public posts with their view, like and comment counts, and a business email or link where the creator has put one on their profile. We collect both through ScrapeCreators, a data provider, and keep our own copy so that searches are fast and dated.

We add what our models read from that material (the angle and offer of an ad, the topics a creator posts about, a transcript of a video) and numbers we compute (how long an ad has run, a creator's median views and engagement rate). We do not add anything private, we do not guess contact details, and we show a creator's public contact details only to workspaces on a paid plan or a paid plan's trial.

Our basis for this is our legitimate interest in providing a research tool over material the people concerned have made public for the purpose of being seen, and our customers' legitimate interest in studying their market and finding people to work with. If you are an advertiser or a creator and you would rather not appear in Klayson, or you want to see or correct what we hold, write to us and we will act within thirty days. Where the law gives you the right to object, that right applies here.

4. Why we use it, and our legal basis

To provide the service you asked for: creating your account, generating and storing creatives, and letting you export them. Basis: performance of our contract with you.

To publish the ads you approve to your own Meta ad account, as drafts or live, and to pause them, when you confirm it, and show you how they are doing, using the Meta data described above. Basis: performance of our contract with you. We do not sell this data, and we do not use it to target ads at anyone, for ourselves or for anyone else. It is used only to run Klayson for your workspace.

To take payment and manage subscriptions. Basis: performance of our contract, and compliance with tax and accounting law.

To keep the service secure, prevent abuse, and debug failures. Basis: our legitimate interest in a service that works and is not abused.

To keep the Free plan to one allowance per person and stop it being farmed, using the normalised email address, the salted network hash, and the email domain checks described above. Basis: our legitimate interest in preventing fraud, which is what lets us offer a free plan at all.

To improve generation quality using the generation and correction records described above. Basis: our legitimate interest in improving the product. This uses your workspace's own material and the patterns we learn from it, and we do not sell it.

To improve search and the research agent using the searches you run, the questions you ask, and what you do with the results (which ads you open, bookmark, remix or skip). Basis: our legitimate interest in a search that ranks well. These signals are tied to your workspace while it is open and severed from it when it closes.

To send you service messages such as sign in links and billing notices. Basis: performance of our contract.

To measure and improve our own advertising. Basis: consent where required, and otherwise our legitimate interest in knowing which ads work.

5. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising beyond the advertising measurement described below. We use the following processors, each for the purpose named:

• Supabase: database, file storage, and authentication (United States)
• Railway: hosting for our API and background workers (United States)
• Vercel: hosting and analytics for the website (United States)
• ScrapeCreators: the data provider through which we collect public ads from the Meta Ad Library and public creator profiles and posts from TikTok and Instagram
• Anthropic: the research agent that answers your questions over the ads, Klayson's agent on the canvas, understanding your requests, planning briefs, designing ads and writing their words, reading your website (its page text, product and logo pictures, and the text of documents on it) to build your brand profile
• Google (Gemini): reading each ad's creative and video, reading what a creator posts about, and reading your logo and product photos when we read your brand
• OpenAI: the search index (embeddings of ads and creators, and of your searches)
• The AI assistant you connect, such as ChatGPT (OpenAI) or Claude (Anthropic): what Klayson answers your requests with, such as your brand details, your products, your ads and their pictures, and links to your canvases, so the assistant can show them to you. The assistant's provider handles that under its own terms and privacy policy, and your settings with it
• fal: cutting your product photos out of their background
• PostHog: product analytics and error reports, from every page of our site and app and from our servers, described below (United States)
• Stripe: payment processing and subscription management
• Resend: the email relay that delivers sign in links sent by our authentication provider
• Slack: if you add Klayson to your Slack workspace, the messages, files, and replies described above. We also use Slack ourselves for alerts to our team, which can include your email address, your name, your workspace name, feedback you send us, and the reason you give if you cancel
• Meta: measurement of our own advertising, described below, and, if you connect your ad account, reading it and publishing the ads you confirm to it through Meta's API, which sends Meta each ad's picture, words, link and settings. Meta's own terms and policies govern your ad account, the ads in it, and what Meta collects when people see them
• Google: sign in, if you choose to sign in with Google, and the fonts some of our pages load from Google Fonts

If you share a workflow, the people you give the link to, and anyone they pass it to, see what that page shows, as described in our Terms of Use.

We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer in connection with a merger or sale of assets, in which case we will tell you before your data becomes subject to a different policy.

6. How AI providers handle your content

A search sends your query to OpenAI to be turned into the vector we search with. A question to the research agent sends the question, the conversation so far, and the ads or creators it reads to Anthropic, which writes the answer. Reading an ad's creative or a creator's posts sends that public material, never your account details, to Google. Reading your brand sends your website's text and pictures to Anthropic, and your logo and product photos to Google. Designing an ad whose words and layout you can edit sends your brand details, your products and your instructions to Anthropic. Cutting a product photo out of its background sends that photo to fal. Analysis passes send generated images and your product photos for comparison, which is how we check that your product was not altered.

We use these providers under business terms that do not permit them to train their models on our customers' content. Their own policies govern retention on their side, and those policies can change. If you have strict confidentiality obligations about a product that is not yet public, take that into account before uploading it.

7. Cookies, analytics, and advertising measurement

We use cookies and similar technologies that are necessary to sign you in and keep your session working. These cannot be turned off without breaking the service.

We use Vercel Analytics to understand page traffic. It is designed to measure without tracking individuals across sites.

We use PostHog on every page of our site and app to understand which features are used and where things break. It records product events on our pages, not your browsing on other sites. When you are signed in it knows you by your workspace and your email address. Our servers also send PostHog product events and error reports, some of which include your email address, your name, your workspace name, or the reason you gave for cancelling.

We use the Meta pixel on every page of our site, including the signed in application, and we send Meta server-side events when someone signs up, starts a trial, or pays for a subscription, so we can measure our own advertising. These events carry your email address only in hashed form, never in readable form, together with your workspace's identifier, Meta's own browser and click identifiers, and your browser's user agent. Meta processes this under its own terms and may combine it with data it already holds. If you would rather not be measured this way, browser tracking protection and Meta's own ad settings both limit it.

Some pages load fonts from Google Fonts, so your browser connects to Google, which receives your IP address.

The signed in application is excluded from search engines and we do not show advertising inside it.

8. International transfers

We are based in the United States and our processors are largely in the United States, so using Klayson means your information is transferred there. If you are in the United Kingdom or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where relevant, as the transfer mechanism with our processors.

9. How long we keep it

What you do through an AI assistant: kept with your workspace like the rest of your content. To stop an assistant using Klayson, disconnect Klayson in the assistant's settings or revoke its access in Klayson's settings under API keys; what it already made stays in your workspace until you delete it.

Account information and your content: for as long as your account is open. To have your account or workspace deleted, email daryl@makedovey.com from the email address on the account. We check that the request comes from the account, then delete your workspace, email address, phone number, brand details, uploads, searches, conversations, bookmarks, collections, lists, workflows, generated designs, and your Meta connection with the Meta data kept with your ads within thirty days, except where we must keep something longer by law or as set out below. Deleting a workspace in your settings closes it instead: it cancels the plan, takes everyone off it, revokes its API keys and deletes its Slack and Meta tokens, but keeps what it made until you ask us by email to erase it.

Free plan claims: the normalised email address and the salted network hash described above are kept for 24 months after the claim was made, including after your account is deleted, so that deleting an account and signing up again does not give the same person a second Free allowance. After 24 months they are deleted automatically.

Connections: the Slack access token until you disconnect Slack, or until your account is deleted.

Your Meta connection: the access token and the business, ad account, Page, Instagram and pixel details that came with it, until you disconnect Meta in your settings, until you remove Klayson from your business integrations in Meta, or until your account is deleted. Removing Klayson in Meta makes Meta call Klayson's deauthorize callback, and we delete the token and those details at once.

Ads Klayson published: the Meta ids, status and results kept with each ad stay with that ad in your workspace after you disconnect, so you can still see what ran, until you ask us by email, or Meta, to delete them. A data deletion request you make through Meta reaches us through Meta's data deletion callback, and we then delete the token, the connection details and the Meta ids and results on your ads at once, and give you a confirmation code. The ads themselves are in your ad account, and Meta keeps them until you delete them there. klayson.com/data-deletion explains each way.

Shared workflow links: until you turn sharing off or delete the workflow. Copies other people made with Use this workflow are theirs and are not deleted with your account.

Waitlist entries: until you have an account, or until you ask us to remove you.

Ads and creator data: this is public material we keep as a research index, independent of any customer account, refreshed as the sources change and removed on request as described above.

Opt-out records: if you opted out of text messages while the poster product ran, we keep that record with the number's link to your workspace, so that the opt-out is honoured for as long as that record exists.

Payment and transaction records: kept as long as tax and accounting law requires, typically seven years, even after an account closes.

Usage records: the cost of each paid call and the count of assistant calls, kept with your workspace while it is open and severed from your identity when it is deleted.

Generation and product event records: retained while they remain useful for improving quality. On account deletion these are severed from your identity, so what remains describes what worked and what did not, not who you are.

Backups: deleted data can persist in encrypted backups for a short period before those backups roll over.

10. Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or stop a particular use, and we will not treat you worse for asking. Email daryl@makedovey.com from the email address on your account. We check that the request comes from you and answer it within 30 days. If you no longer have that address, say so and we will find another way to confirm it is you.

If you are in the United Kingdom or the European Economic Area, you also have the rights to access, rectification, erasure, restriction, portability, and objection under the UK GDPR and the GDPR, including the right to object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time. You may complain to your data protection authority, and in the UK to the Information Commissioner's Office.

If you are in California, you have the rights under the CCPA as amended to know, delete, correct, and opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising beyond the advertising measurement described above, which you can limit as explained there.

If you are in Canada, you have rights of access and correction under PIPEDA and may complain to the Office of the Privacy Commissioner. If you are in Australia, you have rights of access and correction under the Privacy Act and may complain to the Office of the Australian Information Commissioner.

11. Security

Data is encrypted in transit and at rest with our infrastructure providers. Workspaces are separated at the database level so one customer cannot read another's data. Access to production systems is limited to people who need it. API keys are stored only as hashes, which is why a key is shown once and never again. The access tokens other services give us, your Slack token and your Meta ad account token, are encrypted by us before they are stored, on top of our providers' encryption.

Files you upload and the pictures we make for you are stored at long, unguessable web addresses rather than behind a sign in, so that they can appear in Slack, in AI assistants, and on shared workflow pages. Anyone who has a file's link can open it, so share those links with the same care as the files themselves.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator as the law requires.

12. Children

Klayson is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We will update this page when our practices change, and we will change the date at the top. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect.

14. Contact

Brooklyn Social House LLC, 141 Engert Ave, Brooklyn, New York 11222, United States. Privacy questions and requests go to daryl@makedovey.com.