Privacy policy

Your account: your name, email address and a salted hash of your password. We never store the password itself.

Your ad-account links: when you connect Meta with the Facebook login button, Meta gives Xovium an access token limited to the ad accounts and Pages you chose. When you connect through our partner Windsor.ai instead, Windsor issues an access link. In both cases we store the token or link, the account and Page names and IDs it exposes, the billing currency, and the platform. We never receive your Meta or Google password.

Your campaigns: what you type, the conversation with your campaign agent, the copy and images generated for you, the settings you choose, and the IDs of the paused campaigns created in your ad account.

Technical logs: our servers keep standard request logs (IP address, time, page requested) for up to 30 days to keep the service secure.

We use this data only to run Xovium for you: to show your dashboard, to draft copy and images, and to create paused campaigns in the ad accounts you connected. We do not sell your data and we do not use it for advertising of our own.

Meta, when you connect with the Facebook login button, receives the campaign, ad set, creative and ad Xovium creates for you, and answers our reads of your account (currency, status, audiences, results). Access is through Meta's Marketing API under Meta's Platform Terms.

Windsor.ai, when you connect through it, holds the authorised connection to your ad accounts and performs the campaign-creation actions on our behalf.

Anthropic (Claude) runs your campaign agent: it receives what you type, the facts read from your website, and the state of your campaign draft, so it can ask, draft and plan. It does not receive your access tokens, email or password.

OpenAI, Google (Gemini), fal.ai or Cloudflare render pictures from an agreed description, plus any reference photos you chose. They never receive your ad-account credentials, your email or your password.

Meta and Google receive the campaign, ad set and ad we create in your own account, exactly as if you had created them yourself.

None of these parties may use your data for their own purposes beyond providing the service.

Data we receive through Meta's or Google's platforms is used only to show you your own accounts and to create the campaigns you ask for, in line with the Meta Platform Terms and the Google API Services User Data Policy, including the Limited Use requirements.

Disconnect an account: from your dashboard, at any time. This removes the link from Xovium. To revoke access at the source as well, remove Xovium or Windsor.ai in your Meta Business or Google account settings.

Delete your account and data: press Delete my account under Settings → Data & privacy, or email hello@outboundclicks.com from the address you signed up with. Everything goes at once in the first case and within 14 days in the second. Full details on the data deletion page. Campaigns already created in your ad account stay there, because they are yours.

See your data: email the same address and we will send you a copy.

All traffic uses HTTPS. Passwords are hashed with PBKDF2. Access tokens and links to your ad accounts are stored server-side and are never sent to your browser. Everything Xovium does in your account is written to an activity log you can read on your dashboard.

If this policy changes in a way that matters, we will say so on this page and by email. Questions: hello@outboundclicks.com.

Xovium is an independent product and is not affiliated with or endorsed by Meta or Google. Meta, Facebook, Instagram, Google and Google Ads are trademarks of their owners.