Privacy policy

Last updated: October 28, 2026. Contact: team@duggie.io.

This policy covers the Duggie product and account services, operated by Unicron Studios LLC, 1651 Chamberlain Ave SE, Grand Rapids, MI 49506. Our marketing website and waitlist are covered by the marketing privacy notice at duggie.io/marketing-privacy.

What we collect

Account data: your name, work email and hashed password, plus your workspace and team members.

Brand data you provide or we read from your public website: offer details, product facts, approved claims, brand colors, logos and images.

Billing data: your subscription status, payment dates and amounts. Card payments are handled by Helcim; we never see or store your full card number.

Signup requests: the details you submit through our signup form.

Generated creative: the ad copy, images and files we make for you, and our reviewers' notes.

Meta ad account data, only if you choose to connect an ad account (see below).

Website usage, only if you allow cookies (see Optional analytics and advertising measurement).

Connecting a Meta ad account (optional)

Connecting an ad account is optional. You can use Duggie fully without it. If you connect one, you choose which of these to turn on, and you can turn each off separately at any time:

Upload. Meta permission: ads_management. What we access: your ad account ID, the ID of the Page you choose, and an access token. Why: to upload the approved images and ad copy we made for you into your ad account, so you don't have to. You decide whether and when to run them.

Performance reading. Meta permission: ads_read. What we access: performance metrics (such as impressions, clicks, spend, and conversions you track) for ads in that account that use our creatives. Why: to learn which creative works for your brand and improve your future ads. We use it only for your brand and never share it with other customers.

Account and Page selection. Meta permissions: business_management, pages_show_list and pages_read_engagement. What we access: the ad accounts and Pages you can choose, plus the selected Page details needed for your approved creative uploads.

We access Meta data only with the permissions you grant and only for the features you have turned on. We use it solely to provide the service to you, and never sell it or use it to build advertising profiles.

How we use it

To make, review and deliver your ad creatives and ad copy.

If you turn it on, to upload approved creatives and ad copy into your connected ad account.

If you turn it on, to read performance metrics so your future ads for that brand improve.

To bill your subscription and process refunds.

To send service emails, such as delivery notices, billing notices and replies to your requests.

To improve creative for that same brand only. Learning is per brand and never shared with other customers. Aggregate, anonymized statistics may inform product defaults.

To operate, secure and support the service.

Sharing

We use subprocessors to run the service:

Cloud hosting and database

AI model providers for copy and image generation, which only receive the content needed to make your ads

Helcim, for card payments and recurring billing

Resend, for email delivery

Meta, through its APIs, only if you connect an ad account

Google, for Google Tag Manager on our public pages and, only if you allow cookies, Google Analytics

Meta, for the Pixel and Conversions API, only if you allow cookies

PostHog, for website analytics, only if you allow cookies

We don't sell personal data.

Optional analytics and advertising measurement

If you allow cookies, we measure how people use our public website (duggie.io and the public pages of app.duggie.io) with these tools:

Google Analytics, loaded through Google Tag Manager, to see which pages and steps work. Google receives the pages you visit (the addresses keep only campaign tags), the buttons you click, the parts of a page you view, the FAQ questions you open, completed waitlist and signup requests (never your email address), checkout steps with the amount and currency, your browser and device type, an approximate location worked out from your IP address, and cookie identifiers. Google Analytics does not store your IP address. We keep Google Analytics data for 14 months. Google's privacy policy describes its processing.

Meta Pixel and Conversions API, to measure visits, successful waitlist and signup requests, and confirmed paid subscriptions. Meta may receive browser and click identifiers, your browser's user agent, event times, and payment amount and currency. For a request, we share a SHA-256 hashed version of your email address for matching. Hashing does not make this anonymous. Meta's privacy policy describes its processing.

PostHog, on the pages that use it, to understand how visitors use our website and to test versions of our pages. PostHog receives the pages you visit, clicks and other interactions on those pages, your browser and device type, your IP address (used to estimate your location) and a cookie identifier. PostHog stores this data in the United States. PostHog's privacy policy describes its processing.

We do not send card details, passwords, workspace content, or clients' ad data to any of them.

Tracking is off until you allow it, and we honor Global Privacy Control. On duggie.io one choice covers all of these tools, and you can allow, reject or change it at any time with Cookie choices at the bottom of the page. On app.duggie.io, use Advertising cookie preferences. Browser tracking does not run on client or admin pages. The Google Tag Manager script loads on our public pages for every visitor, before you choose, so that it can read your choice; when it loads, Google receives your IP address and normal browser information.

Payment events use the consent recorded with your request; rejecting cookies in that same browser also withdraws that request's consent for future server events. Events already sent cannot be recalled by changing this choice. Contact team@duggie.io to withdraw consent for a request from another browser.

Security

Passwords are hashed.

Each workspace's data is isolated from every other workspace.

Ad account access tokens are encrypted at rest, and every upload to a connected ad account is recorded in an audit log.

Retention

We keep your data while your account is active.

Access tokens are deleted as soon as you disconnect your ad account in the app or remove Duggie in your Meta settings.

If you turn off Performance reading or disconnect, we stop reading metrics immediately and delete the performance metrics we stored within 30 days.

Creatives already uploaded to your ad account stay there and are yours; disconnecting does not remove them.

When you ask us to delete your data, we delete it within 30 days, as described on our data deletion page.

How to disconnect or revoke access

In the app: open your brand, then Ad account. Turn Upload or Performance reading off separately, or choose Disconnect & delete token to remove all access.

In Meta: go to Facebook Settings & privacy, then Settings, then Business integrations, and remove Duggie. You can also remove individual permissions there.

Your rights

You can ask us to access, correct, export or delete your data at team@duggie.io.