Your Creative Stays Yours
Your ads are never used to train AI models. We only use AI providers under paid business terms that exclude customer content from model training. Uploaded videos are deleted from the AI models as soon as analysis is complete. Providers may keep Request Logs for a limited time for abuse monitoring.
How We Protect Your Creative
Designed with the questions brands and agencies ask in vendor security reviews in mind.
Never Used for AI Training
Your videos, transcripts, scripts and results are used only to produce your diagnostics. We only use AI providers under paid business terms that exclude customer content from model training, and uploaded videos are deleted from the AI models as soon as analysis is complete.
Workspace Isolation
Customer data is separated by workspace. Database access from the app is restricted by Row-Level Security, and our server routes verify that you own a record before reading or changing it.
Encryption at Rest & in Transit
Videos and records are encrypted at rest with AES-256 by our infrastructure providers, and all traffic is encrypted in transit with TLS 1.2 or higher. Ad videos live in private storage and are only ever served through short-lived signed links.
Prompt Deletion
Deleting a campaign removes its video and results from active storage immediately. Residual copies in encrypted system backups expire automatically within 7 days.
Secure Key Management
Service credentials (database, payment and AI provider keys) are kept in encrypted environment settings on the server, never shipped to the browser or committed to code. Workspace webhook URLs are validated and only called over public HTTPS.
Built on Certified Infrastructure
AdFlame runs on established cloud platforms (Vercel, Supabase on AWS and Stripe) that hold SOC 2 Type II reports, with card payments handled entirely by Stripe, a PCI-DSS Level 1 provider. AdFlame itself is not independently audited.
Workspace Isolation
Customer data is separated by workspace. Campaigns, results and scripts are stored in a PostgreSQL database with Row-Level Security (RLS) policies that limit what each signed-in user can read to their own workspace. Our server routes additionally verify that you own a campaign or video before reading, changing or analyzing it.
FOR SELECT
TO authenticated
USING (public.can_view_campaigns_of(user_id));
Data Retention & Deletion
You control the videos and results stored in your account:
- Deleting a campaign: removes its video and results from active storage immediately.
- Deleting your account: removes your workspace, team seats, campaigns, Script Vault and files straight away.
- Backups and records: residual copies in encrypted system backups expire automatically within 7 days. Billing records are kept by our payment processor as required by law.
Data Processing Agreements
Your data is processed only by vetted sub-processors listed in our Data Processing Agreement (DPA). For agencies and brands that need one, we can provide a DPA with standard contractual clauses (SCCs) for EU GDPR and UK data protection law.
Need a signed Data Processing Agreement (DPA)?
We can provide our DPA, SCCs and sub-processor list on request.
Responsible Disclosure & Security Inquiries
We welcome responsible security research. If you believe you have found a vulnerability or security issue in AdFlame, please report it to securityadflame.ai. We acknowledge reports within 2 business days and will not pursue good-faith researchers who report responsibly.