Privacy policy

Your analytics and advertising choices

Switches control additional analytics details, GA4 and advertising cookies. Basic internal reports continue before a choice and after Essential cookies only, without IP, User-Agent, device data or advertising identifiers. Pages, UTM and server conversions continue to be sent to Meta. Withdrawal clears optional history; basic records remain for up to 180 days and Meta-only transport for up to 7 days. Projects and payments are not deleted. Contact support@in-director.com about personal-data requests.

Optional tracking is currently disabled. You can still withdraw a previous choice.

Additional analytics details and Google Analytics: Off

Meta Pixel and advertising cookies: Off

1. Service records and legal grounds

We process account details (name, email, sign-in identity), your projects and content, generation requests and results, subscriptions and transaction records to provide the service you request (GDPR Article 6(1)(b)). We process records required by applicable accounting and other laws under Article 6(1)(c). Payment providers handle card credentials; we retain payment status, amount, currency and transaction identifiers.

We process proportionate technical and security records to protect accounts, prevent abuse and diagnose failures based on legitimate interests (Article 6(1)(f)), subject to your rights and a balancing assessment. Such service records are separate from optional marketing analytics. We do not treat a marketing funnel or an advertising identifier as necessary to deliver the service.

2. Basic internal and optional analytics

Basic internal reports work independently of your banner choice. They contain event names/times, normalized routes, sanitized UTM campaign tags, account or random session IDs, and payment amounts/currencies. They contain no IP, User-Agent, device profile, advertising identifiers, message bodies, screenplay text, prompts, passwords or card credentials. A signed token in this tab's sessionStorage supports the session without an analytics cookie; the session renews after 30 minutes of inactivity. IDs can link visits to an account, so these records are not fully anonymous. Your analytics choice enables additional details, active-time measurement and Google Analytics 4.

With that consent we associate visits and conversions with UTM source, medium, campaign, adset (utm_term), creative (utm_content), and ad identifiers. We may connect an anonymous visit with your account after sign-in. We also record approximate country from a local IP database, device type, OS/browser families, language, timezone and display-size categories. We do not infer your exact location or link visitors by IP/email for our first-party journeys. Country lookup does not send your IP to a geolocation service.

3. Advertising cookies and Meta server matching

Meta Pixel and advertising cookies are enabled only by your advertising choice. Separately, our server sends page history, UTM campaign/adset/creative tags and verified registration, checkout, completed payment and subscription-start events to Meta Conversions API independently of that choice. This also happens before a banner choice, after Essential cookies only, and after switching browser advertising off.

For matching, Meta receives SHA-256 hashes of normalized email, internal account ID and a random visitor ID when available. These hashes and linked history remain personal data. We send the event name/time, deduplication event ID, allowlisted current/previous page routes without private names or tokens, UTM source/medium/campaign/term/content, campaign/adset/ad IDs and payment amount/currency. With advertising consent to this notice, CAPI additionally receives _fbp/_fbc identifiers (including the advertising click ID), visitor IP and User-Agent. These protocol fields are sent without hashing and are stored encrypted for up to 7 days. Without that consent, they are omitted. We do not send other query parameters, screenplay/chat/prompt content or card credentials.

Refusal disables additional analytics details, GA4 and browser Pixel. Basic internal reports and the server transfer of pages, UTM and conversions to Meta continue. Meta processes received data under its privacy policy and applicable Business Tools Terms. This mode is not represented as a GDPR compliance mode.

4. Cookies, browser storage and consent

Essential storage supports sign-in, security and remembering your privacy choice. The privacy-choice record contains purpose flags, decision time and a random consent receipt, and is renewed after 180 days. Releases and edits to this notice do not reset an existing choice.

With analytics enabled, _ga/_ga_* cookies last up to 180 days, first-touch attribution up to 90 days, session attribution 30 minutes and last non-direct attribution up to 30 days. Optional first-party analytics cookies last up to 90 days and session tokens up to one hour. With advertising enabled Meta manages _fbp/_fbc, and CAPI can use those identifiers with consent to this notice. Separately, sessionStorage always keeps a random CAPI ID and UTM in the tab, renewed after 30 minutes of inactivity. Switches stop browser Pixel and GA4; CAPI continues with its reduced data when advertising is off.

5. Recipients and international transfers

Hosting, authentication, AI-generation, payment and support providers process data needed for your requested functions. AI providers receive the content needed for the selected generation or assistant. Google receives permitted GA4 analytics. Meta receives the server conversions described here independently of your choice and browser Pixel events when enabled. Processing can take place outside Ukraine and the EEA, including in the United States.

Where GDPR Chapter V applies, transfers require an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses, with further measures where needed. Account registration alone is not our evidence that all required terms and safeguards are in place. Optional tracking is disabled until the operator has checked the relevant provider terms, roles, retention and transfer arrangements. Contact support@in-director.com for information about the safeguards applicable to your request.

6. Retention and deletion

First-party analytics events and linked acquisition data are retained for up to 180 days, then removed by scheduled cleanup. Encrypted advertising/matching context is removed after 7 days; advertising-only transport events are also removed after 7 days. Generated analytics CSV exports expire after 24 hours. Minimal consent evidence is retained for up to 365 days to demonstrate and manage choices; it is excluded from marketing reports.

Account content is retained to provide your account and requested service. After a deletion request we remove data that are no longer needed, subject to applicable accounting, legal-claim and security obligations. Provider retention and backups are separate from our analytics database; a first-party deletion does not automatically delete data already received by Google or Meta. We handle relevant provider deletion requests through their available processes.

7. Your rights and contact

You may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw optional consent at any time here. Withdrawal does not change the lawfulness of processing before withdrawal. Contact support@in-director.com; we may request proportionate identity verification. Under GDPR we normally respond within one month, with permitted extensions explained to you.

You may complain to a competent supervisory authority, including in the EEA country where you live, work or where an alleged infringement occurred. We do not use the marketing funnel to make solely automated decisions with legal or similarly significant effects on you. If applicable local law grants additional advertising opt-out rights, you can also exercise them through the same contact. Material purpose changes require a new notice and, where needed, a new choice.