Privacy Policy

Komendly runs komendly.com and its two products: Komendly Ads (turns your website into ad creatives and can publish them to your Meta ad account) and Komendly Testimonials (turns customer reviews into AI-avatar videos). In this policy "we" means Komendly, the controller of the personal data described here. To contact us about privacy, reply to any email we have sent you or write to us from the email address on your account.

• Account data: name, email address and a salted hash of your password (we never store the password itself).
• What you give us to work with: website URLs, the brand details, text and images we pull from those sites, review text, scripts, uploaded images, and the ads and videos we generate for you.
• Payment data: Stripe handles your card. We receive your plan, payment status, amounts and Stripe customer and payment ids, never your full card number.
• Meta connection (Ads, optional): if you connect Meta, we store an access token (encrypted at rest) and the ad account and Page ids you choose, so we can publish ads you ask us to publish and read their results.
• Usage and device data: IP address, browser user agent, pages viewed, product events (for example sign-up, run started, checkout, purchase), A/B test variants and the cookies listed below.
• Visit source: UTM tags, Facebook click id (fbclid), the referring website and your first landing page.

• To provide the service: create your account, generate ads and videos, publish to Meta when you ask, send account emails such as email verification (contract).
• To take payments, manage credits and handle refunds (contract and legal obligation).
• To prevent abuse, such as repeated free trials from the same device, email or business (legitimate interest).
• To measure and improve the product and our marketing: analytics, A/B tests and working out which ads and channels bring sign-ups (legitimate interest, or consent where the law requires it).

Meta Pixel and Conversions API. Our pages load the Meta Pixel, which records page views and steps like sign-up, trial start, checkout and purchase. Our server also sends some of those events directly to Meta (the Conversions API) with: your email address and account id, both hashed with SHA-256 before sending, your IP address, user agent, the _fbp and _fbc cookie values, the page URL, and the purchase value. Meta uses this to measure and optimise our ads and may combine it with what it already knows about you, under Meta's own privacy policy.

Google Analytics 4. We use GA4 to count visits and funnel steps (for example which A/B variant you saw). Google processes this under its own terms.

How to opt out:

• Meta: Meta ad preferences and your Off-Facebook / activity settings in Accounts Centre.
• Google: the Google Analytics opt-out browser add-on and Google ad settings.
• Industry tools: optout.aboutads.info (US) and youronlinechoices.eu (EU/UK).
• You can also block or delete cookies in your browser. The site still works, but you will be signed out if you clear session_token.

We do not sell your personal information for money. Sharing data with Meta and Google for ad measurement may count as "sharing" for cross-context behavioural advertising under California law; you can opt out using the tools above or by contacting us.

We share data only with the providers we need to run Komendly:

• Vercel: website hosting.
• Railway: database (Postgres), file storage for generated ads and the ad-generation worker.
• Stripe: payments and billing.
• OpenAI: reads your website content and writes and generates ad copy and images.
• FAL, KIE, Mirage and voice (text-to-speech) providers: generate testimonial videos, avatars and voices from your scripts.
• Our email provider: sends account and verification emails.
• Meta: ad measurement (above) and, if you connect your account, publishing your ads.
• Google: analytics.

We may also disclose data if the law requires it, or to a buyer if Komendly is sold or merged.

• Account, brand and billing records: while your account is open. Billing records may be kept longer where tax or accounting law requires.
• Generated ad files from a run: automatically deleted from storage 7 days after they are made, so download what you want to keep. Brand assets (like your logo) stay until you delete your account.
• Testimonial videos are stored with our video providers and linked from your account.
• Sign-in sessions expire after 30 days. Cookie lifetimes are in the table above.
• When you ask us to delete your account, we delete or anonymise your personal data unless we must keep it by law.

Depending on where you live (for example the EU, UK or California), you can ask us to: see the data we hold about you, correct it, delete it, export it, stop or limit some uses (including ad measurement), and withdraw consent. Email us from your account address and we will answer within 30 days. We will not treat you differently for using these rights.

If you are in the EU or UK you can also complain to your data protection authority (in the UK, the ICO).

Komendly is a business tool and is not for anyone under 16. We do not knowingly collect data from children; if you think a child has given us data, contact us and we will delete it.

Our providers, including Vercel, Railway, Stripe, OpenAI, Meta and Google, process data in the United States and other countries. Where data leaves the EU or UK, we rely on the providers' Standard Contractual Clauses, the UK addendum or the EU-US Data Privacy Framework.

We use HTTPS, hash passwords, encrypt Meta access tokens at rest and give out file download links that expire within minutes. No system is perfectly secure, but we work to protect your data.

If we change this policy we will update the date at the top, and for important changes we will tell you by email or in the app. See also our Terms of Service.