Privacy Policy

This Privacy Policy describes how Morelli Group LLC (hereinafter the “Company”) collects, processes, and protects the personal data of users of the Static Ads service, in compliance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.

1. Data Controller

The data controller is Morelli Group LLC, with registered office at 1209 Mountain Rd Pl NE, Suite N, Albuquerque, NM 87110, USA. Contact: nicoby7@gmail.com.

2. Data We Collect

We collect the following categories of data:

• Account data: email address, hashed password (managed by our authentication provider).
• Briefs and outputs: text you submit (offer, target audience, brand cues), creatives we generate for you, generation parameters.
• Uploaded files: product photos, logos, reference ads you provide.
• Billing data: customer and subscription identifiers transmitted by our payment processor. We never see or store any payment card number.
• Operational logs: request timestamps, IP address, error reports, anonymised usage metrics.

3. Purposes and Legal Bases

• Operating the Service (ad generation, downloads, support), legal basis: performance of contract (Art. 6.1.b GDPR).
• Billing and payment management, legal basis: performance of contract (Art. 6.1.b) and statutory accounting obligations (Art. 6.1.c).
• Security, fraud prevention, error diagnostics, legal basis: legitimate interest of the Company in keeping the Service secure (Art. 6.1.f).
• Transactional emails (signup confirmation, batch completion), legal basis: performance of contract.
• Service improvement through anonymised measurements, legal basis: legitimate interest.

No marketing communication is sent without prior consent. No personal data is resold to third parties.

4. Sub-processors and Recipients

To operate the Service, we rely on the following technical sub-processors:

• Supabase Inc. (USA), authentication and PostgreSQL database hosted in the EU (Frankfurt).
• Railway Corp. (USA), application hosting (web servers and workers).
• Cloudflare, Inc. (USA), file storage (Cloudflare R2), CDN, and security.
• Anthropic PBC (USA), Claude service used to analyse your brief and compose ads.
• fal.ai (Features and Labels Inc.) (USA), AI image generation service (Ideogram and GPT Image models).
• Brandfetch SA (Switzerland), automatic retrieval of visual brand identities from a URL.
• Serper.dev (USA), targeted web search used for customer research.
• Resend, Inc. (USA), transactional email delivery.
• Whop Inc. (USA), payment processing and subscription management.
• Functional Software, Inc. dba Sentry (USA), technical error reporting.

Each sub-processor is bound by a data processing agreement (DPA) imposing confidentiality, security, and purpose-limitation obligations. None of our sub-processors is allowed to use your data to train their models.

5. International Data Transfers

Since some sub-processors are established outside the European Union, your data may be transferred to the United States or Switzerland. These transfers are governed by Standard Contractual Clauses adopted by the European Commission and, where applicable, by the EU-US Data Privacy Framework. You may request a copy of these safeguards by writing to nicoby7@gmail.com.

6. Retention Periods

• Account data: retained as long as the account is active, then deleted within thirty (30) days of closure.
• Briefs, generated content, and uploaded files: retained as long as the account is active, deleted within thirty (30) days of closure unless earlier deletion is requested.
• Billing data: retained for the statutory accounting period (10 years in France).
• Operational logs and error reports: retained for a maximum of one (1) year.

7. Your Rights

Under the GDPR, you have the following rights over your personal data:

• Access: obtain a copy of all data we hold about you.
• Rectification: correct any inaccurate data directly from your account or upon request.
• Erasure: request deletion of your account and all associated content.
• Portability: retrieve all your briefs and generated creatives as a ZIP file.
• Objection to processing based on legitimate interest.
• Restriction of processing.

To exercise these rights, write to us at nicoby7@gmail.com specifying your identity. We will respond within one (1) month at the latest.

8. Cookies

Our use of cookies is detailed in the Cookie Policy.

9. Minors

The Service is not intended for persons under 16 years of age. If we discover that an account has been created by a minor without parental authorisation, we will delete it immediately.

10. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access (TLS encryption in transit, hashed passwords, access segmentation, logging of sensitive operations). However, no method of electronic transmission or storage being fully secure, we cannot guarantee absolute security.

11. Supervisory Authority

If you believe your rights have not been respected, you may file a complaint with the French Data Protection Authority (CNIL), 3 Place de Fontenoy, 75007 Paris, France, www.cnil.fr.

12. Modifications

Any substantial modification to this Policy will be notified by email at least thirty (30) days before its entry into force. The update date is indicated at the top of the page.