Skip to main content
Geenlo

Privacy Policy

Last updated 13 October 2026

Plain-language summary: we collect what we need to run your account and your ads workspace, we don't sell your data, and you can ask us to delete it at any time.

Draft. This page has not yet been reviewed by a lawyer and may change before Geenlo launches publicly.

1. Who we are

the Geenlo team ("Geenlo", "we") operates the Geenlo website and app. We decide how and why your personal data is used, which makes us the "controller" under laws such as the GDPR. Contact us at the contact address we will publish here before launch.

2. What we collect

Information you give us

  • Account: your name, email address and password. Passwords are stored only as a salted hash by our authentication provider; we never see or store them in readable form.
  • Sign in with Google: if you choose it, Google tells us your name, email address and account identifier. We do not receive your Google password and we do not access your Gmail, contacts, Drive or any other Google data.
  • Workspace and brand details: your store address, brand name, colours, tone of voice, audience, products, goals, advertising platforms and monthly budget, and anything you edit in Settings.
  • Messages to us, such as support or data requests.

Information created when you use Geenlo

  • Credit activity (what you spent credits on, and refunds), notification preferences and a log of changes made in your workspace.
  • Technical data your browser sends, such as IP address, device and browser type, and timestamps. Our hosting and authentication provider keeps these in server logs for security and abuse prevention.

Information from advertising platforms (when you connect them)

Connecting Meta, TikTok or Google Ads is not available yet. When it is, and only if you choose to connect, we will receive an access token for your ad account and read the data needed to provide the feature you asked for, for example campaign names, spend, results and the ads we create for you. Tokens are encrypted before they are stored. We use this data only to provide Geenlo to you.

3. How we use your information

  • To create and secure your account, and to provide, maintain and improve the service.
  • To generate, score and policy-check ads and to show you results.
  • To send essential messages: email verification, password resets and security notices. We send product updates or reports only if you turned them on.
  • To prevent fraud and abuse, and to meet legal obligations.

Where the GDPR applies, our legal bases are performing our contract with you, our legitimate interests in running and securing the service, your consent where we ask for it, and legal obligations.

4. Who we share it with

We do not sell your personal data and we do not use it to show you third-party advertising. We share it only with service providers ("processors") that help us run Geenlo, under agreements that limit how they can use it:

  • Appwrite for hosting, the database, authentication and account emails. Our project is hosted in Frankfurt, Germany.
  • Google if you use Sign in with Google.
  • AI model providers, when AI generation launches: the brief, brand and product details you provide are sent to the provider to produce your ad. We will list the providers here before we turn this on.
  • Stripe for payments, when billing opens. Card details go to Stripe and never touch our servers.
  • Advertising platforms (Meta, TikTok, Google) that you connect, to launch and measure your ads.

We may also disclose information when required by law, or to protect the rights, safety and security of our users and Geenlo. If Geenlo is involved in a merger or sale, your information may transfer to the new owner, who must honour this policy.

5. Cookies and similar technologies

We use only what is strictly necessary: a sign-in session so you stay logged in, and local storage in your browser for your theme choice and temporary app state. We do not use advertising or analytics cookies. If that changes we will ask for your consent first where the law requires it.

6. How long we keep it

We keep your account and workspace data while your account is active. When you ask us to delete your data (see Data deletion) we delete or anonymise it within 30 days, except where we must keep certain records, such as payment records, for legal or accounting reasons. Backups are overwritten on a rolling schedule.

7. Security

Data is encrypted in transit (HTTPS). Advertising-platform tokens are encrypted before storage. Access to production data is limited to those who need it. No system is perfectly secure, so please use a strong, unique password and tell us promptly if you suspect misuse of your account.

8. International transfers

Some of our providers may process data outside your country, including outside the European Economic Area. Where that happens we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

9. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or the CCPA/CPRA), you may have the right to access your data, correct it, delete it, receive a copy, object to or restrict certain processing, withdraw consent, and complain to your data-protection authority. We will not discriminate against you for exercising these rights. To use them, email the contact address we will publish here before launch. We may need to verify your identity first.

10. Children

Geenlo is for businesses and is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

11. Changes

We will update this policy as Geenlo changes, and change the date at the top. For material changes we will notify you by email or in the app.

12. Contact

the Geenlo team. Email: the contact address we will publish here before launch.