Privacy Policy

Effective date: August 1, 2026

This Privacy Policy explains how Bonito AI Enterprise Inc., operating as PoppyAds ("PoppyAds", "we", "us"), collects, uses, and protects information in connection with our website (poppyads.com) and the AdVan platform (the "Service"). Bonito AI Enterprise Inc. is an Ontario, Canada corporation.

The short version: AdVan is deployed single-tenant. Each customer runs in a dedicated environment with its own isolated database. Your data is never pooled with other customers', never sold, and never used to train AI models or to benefit anyone but you.

1. Our single-tenant architecture

Unlike typical SaaS products that store every customer's records in one shared database, each AdVan customer receives a dedicated deployment: their own application instance and their own isolated database. This means:

Your campaign data, ad-account data, chat history, reports, and files are stored only in your own environment.
No other customer's systems, queries, or users can reach your data, and yours cannot reach theirs.
Aggregation across customers does not occur. We do not build cross-customer datasets, benchmarks, or models from your data.
When your agreement ends, your environment and its database are deleted (see Retention below).

2. Information we collect

Website (poppyads.com)

Our marketing website is static and does not use advertising trackers or analytics cookies. If you email us (for example to book a demo), we receive the information you choose to send.

The AdVan platform

Account information: names, work email addresses, roles, and login credentials (passwords are stored hashed) for the users your organization creates.
Advertising platform data: with your authorization, AdVan connects to advertising platforms (such as Meta) on your behalf and processes campaign structures, budgets, performance metrics, audiences at an aggregate level, and creative assets from your connected ad accounts.
Content you provide: chat messages, campaign briefs, website URLs you ask AdVan to analyze, uploaded creative files, and generated reports.
Operational logs: technical logs (timestamps, request metadata, error traces) needed to run and secure your instance.

3. How we use information

To provide the Service: answering questions about your campaigns, staging and placing campaigns you approve, generating creatives, previews, and reports.
To operate, secure, and support your dedicated instance.
To communicate with you about the Service.

We do not sell personal information, and we do not use your data for our own advertising or for other customers.

4. Advertising platform data

When you connect an advertising platform such as Meta, we act as your service provider. Advertising data obtained through those connections is used solely on your behalf to provide the Service to you, consistent with the platform's terms (including Meta's Business Tools and platform terms), kept confidential and secure, and never shared with or used for any other customer. Campaigns created through AdVan are staged in paused or preview state and only go live with your approval, under your own ad accounts.

5. AI processing

AdVan uses large language models and image models to power chat, copywriting, and creative features. Content needed for a given request (for example a chat message, campaign metadata, or a website's public creative assets) is processed by our model providers to generate the response. We do not use your data to train models, and our provider agreements do not permit training on your data.

6. Subprocessors

We use a small set of infrastructure providers to run the Service: cloud hosting for your dedicated instance and database, advertising platform APIs you authorize (such as Meta), and AI model providers for the features described above. Each processes only what is required to deliver the Service, under contractual confidentiality and data-protection obligations. A current list is available on request at [email protected].

7. Retention and deletion

Data in your instance is retained while your agreement is active and is under your control within the Service.
On termination, we will make your data available for export on request, and delete your dedicated environment and database within 30 days.
Operational backups are deleted on their normal expiry cycle after instance deletion.

8. Security

Your instance runs isolated from other customers, with encrypted transport (TLS), hashed credentials, role-based access inside the application (ad-ops, sales, analyst), and least-privilege operational access on our side. Campaign placement is preview-first by design, so no spend occurs without human approval.

9. Your rights

Depending on where you are located, you may have rights to access, correct, export, or delete personal information (including under GDPR, PIPEDA, and CCPA/CPRA). Because AdVan customers control their own instance, most requests can be handled directly in the product; for anything else, contact us and we will respond within the timelines required by applicable law.

10. Children

The Service is for business use and is not directed to children under 16. We do not knowingly collect information from children.

11. Changes

If we make material changes to this policy, we will update the effective date above and notify customers through the Service or by email.

12. Contact

Questions or requests: [email protected]