Privacy Policy

1. Introduction

This Privacy Policy describes how Advocacy Holdings, Inc. (“Company,” “we,” “us”), operating One Click Campaign Studio (“OCCS,” “the Service”), collects, uses, stores, and shares personal information when you use our platform. By using the Service, you consent to the practices described in this policy.

Advocacy Holdings, Inc.
1 North Wacker Drive
Chicago, IL 60606

2. Information we collect

Account information: Name, email address, password (hashed, never stored in plaintext), job title, organization name, and profile photo.

Billing information: Payment card details are collected and processed directly by Stripe. We do not store card numbers, CVVs, or full card details on our servers. We store Stripe customer IDs and subscription status.

Content you create: Campaigns, campaign branches, assets (images, video, audio, text), contact lists, email/SMS broadcasts, scheduled posts, sales videos, sequences, and any AI-generated content.

Contact data you upload: Names, email addresses, phone numbers, and other fields you import via CSV, Google Sheets, or manual entry. You are the data controller for this information.

Connected accounts: When you connect social media or productivity accounts (Facebook, Instagram, LinkedIn, Google/YouTube, Google Sheets, Google Ads, X/Twitter, TikTok), we store OAuth access + refresh tokens (encrypted at rest) along with the metadata each provider returns (e.g. profile name, channel id, page list). We do not store your passwords for these services. Disconnecting an account from Settings → Connected accounts revokes the tokens at the provider in addition to deleting our local copy.

Usage data: Pages visited, features used, AI generation events (provider, function, cost, timestamp), and performance metrics. This data is used to operate and improve the Service.

Device and log data: IP address, browser type, operating system, and request timestamps collected automatically via server logs.

3. How we use your information

• Provide the Service: Authenticate your account, manage workspaces, generate content, publish campaigns, send broadcasts, and process billing.
• AI content generation: Your brand profile, campaign briefs, and product details are sent to AI providers (OpenAI, Replicate, ElevenLabs) to generate text, images, video, and audio. These providers process the data under their own terms and data processing agreements.
• Social media publishing: Your content and connected-account credentials are used to publish posts to the platforms you authorize.
• Email and SMS delivery: Your contact lists and message content are transmitted to Postmark (email) and Twilio (SMS) for delivery.
• Contact enrichment (opt-in): When you enable contact enrichment for a workspace, the email addresses and any LinkedIn URLs of contacts you choose to enrich are sent to our enrichment processor (currently a stub adapter; People Data Labs once configured) so we can return profile + company context for sales and marketing decisions. Enrichment is off by default for every new workspace and can be turned off for an individual contact at any time.
• Billing: Subscription and usage data is shared with Stripe to process payments and generate invoices.
• Communication: We send transactional emails (account confirmation, password reset, team invitations, action-item notifications) via Postmark.
• Improvement: Aggregated, anonymized usage data helps us improve the Service. We do not train AI models on your content.
• Legal compliance: We may process data as required by law, regulation, or legal process.

4. Subprocessors

We share personal data with the following categories of third-party processors, each of which processes data only as necessary to provide their service:

For the authoritative public list with legal entities, HQ regions, and DPA links, see /legal/subprocessors. Signed-in customers can also view per-vendor opt-out controls at the in-app Settings → Data processors page.

5. Data security

We protect your data with:

• Encryption in transit (TLS/HTTPS enforced on all connections)
• Encryption at rest for sensitive fields (OAuth tokens, S3 credentials) via Active Record Encryption
• Passwords hashed with bcrypt (12 cost factor)
• Content Security Policy headers to prevent cross-site scripting
• SSRF protection on all outbound HTTP requests
• Rate limiting on authentication and public endpoints
• Role-based access controls with Pundit authorization policies
• Audit logging for administrative actions (impersonation, key rotation)

No system is 100% secure. We will notify affected users promptly in the event of a data breach as required by applicable law.

6. Data retention

Active accounts: We retain your data for the duration of your account plus 30 days after cancellation to allow for reactivation.

After deletion request: We delete or anonymize your personal data within 30 days of a verified deletion request, except where retention is required by law (e.g., billing records for tax purposes, which are retained for 7 years).

AI usage logs: AI generation event metadata (provider, function, cost, timestamp) is retained for 12 months for billing reconciliation and then anonymized.

Server logs: IP addresses and request logs are retained for 90 days for security and debugging purposes.

7. Cookies and tracking

Our public marketing pages use three categories of cookies. The Service shows a consent banner on your first visit where you can accept, reject, or customize which categories load. You can change your preferences at any time via the “Cookie preferences” link in the footer.

Strictly necessary cookies (always on): Session cookies and CSRF tokens required for the Service to function. These cannot be disabled and are not used to track you across other sites.

Analytics cookies (opt-in): When enabled, Google Analytics (GA4) sets cookies that help us understand how visitors use our marketing pages in aggregate. We do not use this data to build individual profiles of unauthenticated visitors.

Marketing cookies (opt-in): When enabled, the following ad-platform pixels load to measure the effectiveness of our advertising and show you relevant ads on other sites: Google Ads, Meta Pixel, LinkedIn Insight, TikTok Pixel, Microsoft (Bing) UET. Each pixel sets its own cookies governed by the respective vendor’s privacy policy.

Authenticated users: Once you are signed in to the Service, we do not load any third-party analytics or marketing cookies on application pages. In-app product telemetry is first-party and described above in §3 (Data we collect).

Pre-consent behavior: Until you choose Accept or Customize, no analytics or marketing scripts are loaded into your browser — the underlying network requests to Google, Meta, LinkedIn, TikTok, and Microsoft do not fire.

Do Not Track: We honor Do Not Track browser signals.

8. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (“right to be forgotten”)
• Export: Request a machine-readable export of your data
• Restriction: Request that we limit processing of your data
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact privacy@1clickcampaign.com. We will respond within 30 days.

9. California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how it is used
• Right to delete personal information
• Right to opt out of the “sale” of personal information — we do not sell your personal information
• Right to non-discrimination for exercising your privacy rights

10. European residents (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, we process your data under the following legal bases:

• Contract: Processing necessary to provide the Service you signed up for
• Legitimate interest: Service improvement, security, and fraud prevention
• Consent: Where required (e.g., optional analytics, marketing communications)
• Legal obligation: Tax records, law enforcement requests

Data transfers outside the EEA are protected by Standard Contractual Clauses or equivalent safeguards. You may lodge a complaint with your local supervisory authority.

11. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 30 days before they take effect. The “Last updated” date at the top reflects the most recent revision.

13. Contact

For privacy questions or data requests:
Advocacy Holdings, Inc.
1 North Wacker Drive
Chicago, IL 60606
privacy@1clickcampaign.com