Privacy Policy

1. Introduction

Mad (“Company,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data in accordance with the New Zealand Privacy Act 2020, as well as applicable international frameworks such as the EU General Data Protection Regulation (GDPR). This Privacy Policy explains how we collect, use, process, and safeguard your information when you access or use our AI-assisted creative direction and ideation platform (the “Service”).

2. Information We Collect

We collect information directly from you, automatically via your use of the platform, and through third-party service integrations:

• Identity & Authentication Data (Auth0): Name, email address, social login tokens, and authentication credentials processed securely via Auth0.
• Payment & Billing Data (Stripe): Transaction history, billing address, and credit purchase records. All payment card details are collected and stored directly by Stripe; we never receive or store raw payment card numbers.
• Campaign Inputs & Creative Briefs: Text prompts, product descriptions, target audience notes, company names, and instructions you enter to generate ad concepts.
• Usage & Technical Data: IP address, browser type, operating system, device identifiers, referring URLs, pages visited, time spent on pages, and logs of your interactions with our features.
• Cookies & Analytics Data (Google Analytics): Essential session cookies to maintain your login state, as well as analytics cookies that help us understand aggregate visitor behavior, traffic channels, and platform usage trends.

3. Third-Party Infrastructure & Service Providers

We partner with industry-standard third-party providers to secure, authenticate, analyze, and process transactions on our platform. By using our Service, you acknowledge that your data may be transferred and processed offshore by these global providers, subject to comparable privacy safeguards:

• Auth0, Inc. (Authentication): Manages user registration, login security, account credentials, and single sign-on processing. (Auth0 Privacy Policy)
• Stripe, Inc. (Payment Processing): Handles encrypted payment transactions, credit purchases, and fraud prevention. (Stripe Privacy Policy)
• Google LLC (Google Analytics): Provides aggregated web analytics, user engagement tracking, and diagnostic performance metrics. (Google Privacy Policy)

4. Third-Party Artificial Intelligence Sub-Processors

To power our ideation features, scriptwriting, and concept sketching, we transmit user-submitted campaign briefs and prompts to third-party AI technology sub-processors:

• OpenAI, LLC: Used for text generation, copywriting, scriptwriting, and visual concept sketch generation via API. (OpenAI Privacy Policy)
• Google LLC (Gemini API): Used for prompt analysis, category routing, and creative direction processing via API. (Google Privacy Policy)

These providers process data under strict contractual data protection agreements and are authorized to use your inputs solely to return the requested outputs back to your account.

5. How We Use Your Information

We use collected information for the following purposes:

• To authenticate your identity and maintain account security via Auth0.
• To process payment transactions and maintain your credit balance via Stripe.
• To operate, maintain, and provide the core concept-generation features of the platform.
• To analyze site traffic, user interactions, and performance using Google Analytics to optimize features and improve user experience.
• To save and display your campaign history, draft copy, scripts, and sketches in your private dashboard.
• To detect, prevent, and address technical issues, security threats, or platform abuse.
• To communicate with you regarding service updates, credit transactions, or support requests.

6. Sharing & Disclosure of Information

We do not sell, rent, or trade your personal information or campaign inputs to third parties or advertisers. Information is disclosed only under these circumstances:

• Authorized Service Providers: Operational sub-processors detailed in this policy (Auth0, Stripe, Google Analytics, OpenAI, Google Gemini) strictly as necessary to deliver and improve the Service.
• Public Pitch Pages (User-Initiated): If you choose to use our "Create Pitch" feature, a public URL containing your selected campaign concepts will be generated for you to share with clients.
• Legal Compliance: If required by law, court order, or governmental authority to protect the safety, rights, or security of our users or the public.

7. Data Retention & Account Deletion

We retain your account details and campaign history for as long as your account remains active. You can delete individual generated items or concepts directly from your campaign dashboard at any time.

If you wish to permanently delete your account, authentication profile, and all associated campaign data, please contact us at support@mad.co.nz.

8. Your Rights & Choices (New Zealand Privacy Act & GDPR)

Depending on your location, including rights established under the New Zealand Privacy Act 2020 and the European GDPR, you have statutory rights regarding your personal data:

• Access & Portability: Request copies of the personal data we hold about you.
• Rectification: Correct or update inaccurate account information.
• Erasure: Request the deletion of your account and personal history.
• Opt-Out of Analytics: You may prevent Google Analytics from recognizing you on return visits by disabling cookies in your browser or installing the official Google Analytics Opt-out Browser Add-on.
• Marketing Opt-Out: Unsubscribe from non-essential promotional emails at any time.

If you have any concerns regarding how we handle your privacy, you have the right to make a complaint to the New Zealand Office of the Privacy Commissioner (or your local data protection authority).

9. Data Security

We utilize industry-standard security protocols, including HTTPS encryption, CSRF protection, secure session management, Auth0 identity isolation, and Stripe PCI-compliant payment infrastructure. While we take every reasonable precaution, no method of electronic transmission is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect service updates or legal requirements. When updates occur, we will revise the "Last Updated" date at the top of this page.

11. Contact Us

If you have any questions or requests regarding this Privacy Policy, your personal data, or your privacy rights, please contact us at:
support@mad.co.nz