Privacy policy

The entity that provides the You Announce service, as identified on the invoice. For any privacy question: the form on the help page.

• Account: name, email, password (stored as a secure hash, never in plain text), preferred language and consents.
• Sign in with Google or Apple: if you choose this option, we receive your name, email and an account identifier from Google or Apple. We never receive your password or access to anything else in your account.
• App notifications: if you allow them on your phone, we store the identifier Apple or Google gives the device, only to send notices about your account. It is deleted when you sign out in the app.
• Website visibility: we read the public pages of the website you give us to produce the visibility check and plan, which are stored in your account. In the free checker on our public site, the address is not stored.
• Business and campaigns: what you tell us in the conversation, the website you give us, the campaigns, the approvals and the change history.
• Campaign results: aggregated metrics from Google Ads and Meta (impressions, clicks, cost, conversions). We do not receive personal data about the people who see the ads.
• Meta ad accounts: the ad account and Page IDs you give us and the account status (active, currency, whether it has a payment method), read through the Meta API. We do not get access to your personal Facebook account.
• Ad photos: the ones you upload are stored in our database and are public at the ad’s address, like the ad itself.
• TikTok ad accounts: the account’s ID, name, currency and status, and the access TikTok gives us after your authorisation, stored encrypted.
• Ad videos: the ones you upload are stored in Vercel’s storage and are public at the ad’s address, like the ad itself.
• Stripe sales (if you connect it): the amount, currency, date and reference of each completed payment. We do not receive the buyer’s or the card’s details.
• Measurement on customers’ sites (the tag): on the customer’s behalf, a random visitor identifier, the ad click (Google, Meta and TikTok identifiers and the visit’s source), the page without parameters and the type of action (visit, contact, call, purchase). No names, emails or phone numbers, and only after the visitor accepts.
• Payments: handled by Stripe. We only store the subscription status, never card details.
• Contact requests: name, company, email, phone, message and the language of the page.
• Link approvals (agency clients): the name you enter, the decision, the comment, the date and the IP address in the security log. Results shared by link only show aggregated campaign figures.
• Google business profile (if you connect it): the profile (name, address, phone, opening hours, categories, description), the reviews (with the public name of the reviewer), the profile figures and the email of the Google account that authorised it; the access is stored encrypted.
• Referrals: which business referred which and the credits given.
• Technical data: IP address and browser for signed-in sessions, security logs and product usage events, stored in our own database.

• Providing the service (creating, publishing and monitoring campaigns): performance of the contract.
• Billing and tax obligations: legal obligation.
• Security, abuse prevention and product improvement: legitimate interest.
• Replying to contact requests: pre-contractual steps, at your request.
• Reminders about the next step in your account (a campaign to approve, the Google account to connect, the first results): legitimate interest, at most one a week; each one has a link to stop them.
• Sending news by email: only with your consent, which you can withdraw at any time.

You Announce uses artificial intelligence in the step-by-step flow and says so in its first message. Conversation messages and the public content of the website you give us are sent for processing to Google’s Gemini API, under a paid service in which Google states that it does not use this data to improve its products. Conversations are stored in our database, linked to your account, and are not used to train models.

• You are answered by that business’s virtual assistant, an automated system. The business is the controller of your data; You Announce processes it on its behalf.
• We keep the chat messages, the buttons you tapped, the details you left in the form (for example, name, phone, email and whatever the business asks for) and, only if you accept measurement, the identifiers of the ad you clicked. Your IP address is not stored: only an encrypted summary that changes every day, to stop abuse.
• The messages you write may be sent to Google’s Gemini API, on the paid tier and not used for training, to write the reply and a summary of your request. The form details are never sent to artificial intelligence.
• Sensitive data (such as health data) is only stored with your explicit consent, and encrypted.
• To exercise your rights, contact the business; if you can’t, write to us and we’ll pass the request on. Chats without contact details are deleted after 90 days and messages after 12 months; contacts are kept until the business deletes them.

We do not sell data. We use processors, contractually bound by the GDPR:

• Vercel: application hosting;
• the PostgreSQL database provider;
• Google: Gemini API (artificial intelligence), Google Ads API (publishing campaigns) and Sign in with Google;
• Meta Platforms Ireland: Marketing API (publishing and results of the campaigns on Facebook and Instagram), only if you connect a Meta account. For the ads, Meta and Google also process data as controllers, under their own policies;
• TikTok Technology Limited (Ireland): API for Business (publishing, results and sending the measured contacts and purchases), only if you connect a TikTok account. For the ads, TikTok also processes data as a controller, under its own policy;
• Apple: Sign in with Apple, in the mobile app;
• Stripe: payments;
• Resend: sending account emails and notices, and the delivery status of each one (delivered, bounced or marked as spam); no tracking of opens or clicks;
• Google: the business profile APIs (Business Profile), only if the business connects its profile;
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering app notifications, only if you allow them.

Some of these providers may process data outside the European Economic Area, notably in the United States, under the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

• Account, business and campaign data: for as long as the account exists; deleted within 30 days of deleting the account.
• Billing documents: 10 years, as required by law.
• Security and audit logs: up to 12 months, unless needed for a dispute.
• Contact requests with no follow-up: 12 months.
• The Google profile, the stored reviews and the profile figures: until you disconnect the profile.
• Log of the emails we send (recipient, type, language and delivery status): 12 months. Emails are sent in the language you chose; without that certainty, in English.
• Product usage events and AI usage logs: 24 months, linked only to internal identifiers.
• Website visibility plans: 24 months (while the account exists).
• Ad photos: while a campaign uses them; the others are deleted after 30 days.
• Ad videos: while an ad uses them; the others are deleted after 30 days.
• Measurement tag events: 13 months, enough to compare a year with the previous one.
• Chats with a business’s assistant: without contact details, 90 days; messages, 12 months; contacts, until the business deletes them or the account.

You can request access, rectification, erasure, restriction and portability, and object to processing. In your account settings you can export your data and delete your account without contacting us. For other requests, write to the form on the help page; we reply within one month.

You also have the right to lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD).

• Everything: in the account Settings, “Delete account”. We delete the account, the businesses, the conversations, the campaigns, the ad photos and the data received from Google and Meta within 30 days; only the billing documents remain, for as long as the law requires.
• Only the Meta connection: in “Meta account”, disconnect the account and remove the You Announce partner access in Meta Business Suite (Business settings → Partners). We stop reading the account and its results.
• Only the TikTok connection: disconnect the TikTok account in You Announce (we delete the stored access straight away) and, if you wish, withdraw the authorisation on TikTok.
• Only Stripe or the tag: under “Measurement”, disconnect Stripe or remove the line from your site; events already measured are deleted with the account or after 13 months.

For other requests, write to the form on the help page; we reply within one month.

Passwords hashed with bcrypt, sessions with secure cookies that scripts cannot access, encrypted connections (HTTPS), restricted internal access and an audit log of sensitive actions.

We only use essential cookies: the session cookie, the active client cookie (agency accounts) and, while signing in with Google, a security cookie that lasts 10 minutes. Details on the cookies page. On the sites of customers who use it, the measurement tag stores a random identifier and the ad click in the visitor’s browser, only after they accept; each customer informs them in their own site’s cookie policy.

If this policy changes materially, we will let you know by email before the change takes effect.