Privacy Policy

Who we are and scope

Indoo.ai (“Indoo,” “we,” “us,” or “our”) provides an AI marketing platform that helps customers research, plan, create, publish, and measure marketing work. This policy explains how we handle personal information when you visit indoo.ai, create an account, use the platform, connect a third-party service, or contact us.

When an organization provides you access to Indoo, that organization may control the workspace and the information submitted to it. Its own privacy notices may also apply.

Information we collect

We collect information you provide, information generated through your use of the service, and limited technical information needed to operate and secure Indoo.

• Account information: name, email address, password verifier, authentication details, workspace membership, and account preferences.
• Brand and workspace content: brand profiles, goals, prompts, instructions, drafts, uploaded files, campaign plans, approvals, and other content you choose to submit.
• Website and research information: website addresses you ask us to analyze and publicly available content gathered from those sites or other public sources.
• Connected-service information: connection status, account or profile identifiers, content, and activity needed to perform actions you request through social, messaging, publishing, or other integrations. Authentication tokens are protected and used only for the connected feature.
• Usage and device information: feature activity, request timestamps, approximate location inferred from an IP address, browser and device details, diagnostics, logs, and security events.
• Communications: messages, support requests, feedback, and information you include when contacting us.

How we use information

• Provide, personalize, maintain, and improve the service.
• Create requested AI-generated research, plans, content, and recommendations.
• Authenticate users, protect accounts, prevent abuse, and investigate security incidents.
• Operate integrations and publish or send content only when directed by an authorized user or configured automation.
• Communicate about the service, respond to requests, and provide important operational notices.
• Understand product performance, enforce our terms, comply with law, and protect our users and the public.

Legal bases for processing

Where data protection law requires a legal basis, we rely on the basis that fits the particular purpose and context.

• Contract: to create and administer your account, provide requested features, operate integrations, and deliver customer support.
• Legitimate interests: to secure, maintain, understand, and improve the Service; prevent abuse; and communicate about relevant product operations, balanced against your rights and expectations.
• Consent: for optional processing where we ask for it. You may withdraw consent at any time without affecting earlier lawful processing.
• Legal obligations: to keep required records, respond to lawful requests, and protect legal rights and safety.

AI features and customer content

Indoo sends the instructions and content needed to fulfill a request to AI and infrastructure providers acting on our behalf. Depending on the feature, this can include prompts, brand context, selected files, public website content, and prior workspace context.

Do not submit sensitive personal information that is not necessary for your marketing work. AI output can be incomplete or inaccurate; you are responsible for reviewing output before relying on, publishing, or sending it.

How we share information

We do not sell personal information or share it for cross-context behavioral advertising. We may disclose it only as needed for the purposes below.

• Service providers: hosting, data storage, AI processing, website research, authentication, email delivery, security, and support vendors that process information for us under appropriate obligations.
• Connected services: third-party platforms you choose to connect. Their terms and privacy policies govern their handling of data.
• Your organization: workspace owners and administrators may access and manage workspace content, members, and activity.
• Legal and safety: authorities or other parties when reasonably necessary to comply with law, enforce agreements, or protect rights, safety, and the integrity of the service.
• Business transfers: a buyer, successor, or adviser in connection with a merger, financing, reorganization, or sale, subject to appropriate confidentiality protections.

Cookies and similar technologies

We use essential cookies and browser storage to keep you signed in, protect forms and sessions, remember preferences, and complete requested connection flows. We do not currently use advertising cookies on the public website. See our Cookie Policy for details and available controls.

Retention

We retain personal information for as long as needed to provide the service, maintain legitimate business and security records, resolve disputes, and meet legal obligations. Retention depends on the type of information, why it was collected, workspace settings, and applicable law. When information is no longer required, we delete or de-identify it using reasonable measures. Limited copies can remain temporarily in backups and security records.

International data transfers

Indoo and its providers may process information in countries other than the one where you live. Where required, we use contractual safeguards or another lawful transfer mechanism designed to protect personal information across borders.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing of, or receive a portable copy of your personal information, and to withdraw consent where consent is the basis for processing. You may also have the right to appeal a decision or complain to a data protection authority.

• Update basic account and workspace information in the product where those controls are available.
• Email [email protected] with the subject “Privacy request” to exercise a right or request account deletion.
• Use the email address associated with your account so we can verify the request. We may ask for additional information only when reasonably necessary to protect your account.
• Where applicable, opt out of sale or sharing for targeted advertising, limit certain uses of sensitive information, and exercise your rights without unlawful discrimination.
• Use a grievance or appeal process, or nominate another person to exercise rights on your behalf, where applicable law provides those options.

Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, secure session handling, encryption in transit, tenant separation, and monitoring. However, no method of storage or transmission is completely secure. You are responsible for protecting your credentials and promptly telling us about suspected unauthorized access.

Children

Indoo is a business service and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can review and delete it where appropriate.

Changes to this policy

We may update this policy as the service or legal requirements change. We will post the revised version here and update the date above. If a change materially affects your rights, we will provide additional notice when reasonably practicable.

Contact us

For privacy questions, requests, or complaints, email us at [email protected] with “Privacy request” in the subject line. We will acknowledge your message and explain any information needed to process it.