Privacy

Your account. Your name and email address, from whichever sign-in you used. We never receive your Google or Facebook password.

Your business details — legal name, EIN, address — but only if you ask us for a phone number. The mobile carriers require these before a number can send anything, and that is the only reason we ask. Skip the number and you can skip the details.

Payment information. Your card goes from your browser to our payment processor and never touches our servers. What we store is a token, the card brand and the last four digits.

What you make here — campaigns, ad copy, images you upload or generate, landing pages, and the prompts you typed to get them.

Once you connect Meta or Google we read your campaigns, spend and results through their APIs, and we write the campaigns you build here into your account. We only read the ad accounts you connected, and only while they stay connected.

Meta. Facebook gives us an access token for the ad accounts and pages you pick on their screen. We keep it on our servers, never in your browser, and use it only to run your ads.

Google. When you connect, you sign in with Google and we see the names and ID numbers of the Google Ads accounts that login can reach, so you can choose one. The ones you don’t choose are forgotten as soon as you pick. The one you choose gets just.diy added as a manager, which is how we build and check campaigns in it from then on. We use your Google sign-in once, at that moment, and don’t keep it.

Google Calendar. If you take bookings with the just.diy calendar, you can connect your Google Calendar. This is optional and separate from connecting Google Ads. We ask for two things. The first is when you’re busy: the start and end of the times you’re not free, and nothing else. We never see what an appointment is called, who it’s with, where it is or anything written in it. We use those busy times only to stop offering them to people booking with you, and we don’t store them: they’re read fresh each time someone looks at your open times. The second is a calendar we add to your Google Calendar, named “just.diy bookings”, where we put the appointments people book with you (their name, phone, email and the time). We can’t read or change any other calendar or event. Because bookings arrive when you’re not here, we keep this sign-in on our servers until you disconnect. Disconnect on the Calendar page and we delete it; appointments already in your Google Calendar stay there, because they’re yours. You can also remove our access at any time at myaccount.google.com/connections.

Disconnect on the Connections page and we end that access on our side, for either platform. You can also remove it from your side at any time: in Google Ads under Admin → Access and security → Managers, or in Meta Business Settings.

We do not have and cannot see the card you have on file with Meta or Google. They charge you directly for your ad spend.

just.diy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: what we read from your Google Ads account is used only to show you your campaigns and results and to carry out what you ask for here, and the busy times we read from your Google Calendar are used only to work out which appointment times to offer. We don’t sell it, don’t use it for advertising to you or anyone else, don’t use it to train AI models, and no person here reads it unless you ask us to help, it’s needed for security, or the law requires it.

In transit. Everything between your browser, our servers, Google, Meta and our other providers travels over HTTPS (TLS). Nothing is sent in plain text.

At rest. Our database and hosting (Supabase and Vercel) encrypt stored data at rest. Access keys and the credentials we use to reach Google and Meta are kept as encrypted server-side secrets, never in code and never in your browser.

Your Google sign-in. The token Google gives us when you connect is held for at most 15 minutes, in a secure, HTTP-only cookie your browser’s scripts can’t read, while you pick an account. It is used to list your accounts and accept our manager invitation, then discarded. It is never written to our database.

Your Google Calendar sign-in. This one is kept, because bookings come in when you’re away. It is stored in our database, encrypted at rest, in a table only our servers can read. It never reaches your browser, and it is deleted when you disconnect.

Who can get in. Access to production systems and data is limited to the few people who run just.diy and need it to keep the product working. Each customer’s data is tied to their own account and isn’t visible to other customers.

If something goes wrong. If we learn that your data has been accessed without permission, we’ll tell you promptly, say what was affected, and do what the law requires.

When someone fills in a form on one of your ads, their name, phone number, email and answers land in your inbox here. That information belongs to you. We hold it on your behalf so the product can show it to you and, if you have a number, text them for you.

We do not sell it, rent it, market to it, or use it to train anything. If a person asks you to delete their record, you can delete it here and it is gone from our systems too.

Only the companies that make the product work, and only the part each one needs:

Meta and Google — to create and run your ads, because that is where the ads run. Twilio — to send and receive text messages from your number. Authorize.net — to charge you. Anthropic — when you generate copy or images, your prompt goes to the model that makes them. Supabase and Vercel — hosting and the database.

We will also hand over data if the law requires it, and we will tell you when we are allowed to.

If you ask us to text you when a new lead comes in, we keep the mobile number you gave us and when you agreed. We use it for those alerts and nothing else. We do not sell or share mobile numbers or texting consent with anyone for their marketing. Reply STOP to any alert and they stop; reply HELP for help, or turn them off in Settings. Message and data rates may apply.

If you use a number to text your leads, we keep the messages, the time they were sent, and whether anyone replied STOP. Anyone who replies STOP is never texted from your number again, by you or by us — that is not a setting you can turn off.

Getting permission to text the people on your list is your responsibility. Ours is to stop obvious harm before a carrier does, which sometimes means pausing your sending and telling you why.

The app sets one cookie to keep you signed in, plus a couple of short-lived ones while you connect Meta or Google, which expire within 15 minutes. There is no advertising tracking inside the product and no third-party trackers following you around it.

While your account is open, and for as long afterwards as tax and payment records require. Delete your account and we delete your data within 30 days, except the billing records we are legally obliged to keep.

Your campaigns are not ours to delete. They live in your ad account, and they stay there whatever happens to your account here.

You can see everything we hold about you inside the product, correct it, export your leads, or delete the account outright. If you would rather ask a person, email hello@just.diy and we’ll do it.

This is a product for businesses. It is not for anyone under 18, and we don’t knowingly collect anything from them.

If we change something that matters, we’ll email you before it takes effect rather than quietly editing this page and updating the date.