Privacy policy

This policy applies to campyon.ai and the Campyon application (together, the “Service”). It also covers campaign.ge, our former address, which now redirects here. When you create an account, build workspaces, connect ad platforms, or browse the marketing site, we process personal data as described below.

We collect only what the product needs to work, store it in the EU, and do not sell it. If anything here is unclear, email privacy@campyon.ai.

Account & profile

When you sign up we store:

• Email address and authentication identifiers
• Username, display name, and profile preferences
• Workspaces you create or are invited to, and your role in them
• Whether you've agreed to our terms and have product access

Workspace content

Anything you build inside a workspace: businesses, dashboards, audiences, campaign drafts, notes, uploaded logos and banners. This content is private to the workspace and visible only to the members you invite.

Ad-platform integrations

When you connect Meta, Google, or TikTok via OAuth, we store the access and refresh tokens issued by that provider, the ad accounts you authorize, and the data we fetch on your behalf (campaign metadata, performance metrics, audience insights). We never request more scopes than the feature requires, and you can disconnect at any time from the workspace integrations page.

Usage analytics

With your consent, we capture pageviews, feature interactions, and a randomly-generated visitor id via PostHog. On our public marketing pages we also record a replay of your visit, with every form field masked, so we can see where the site trips people up. We ask every visitor for that consent up front, and PostHog records nothing until you accept. Signed-in workspace pages are never recorded.

Separately, we count page views with Vercel Web Analytics, which sets no cookies and stores nothing on your device. It gives us totals: which pages were visited, where visitors came from, and their country, browser, and device type. Before a page view is sent, we remove anything in the address that could identify you, such as your username and workspace name. See Cookies & analytics for the full picture.

Technical data

Server logs containing IP address, user-agent, and request metadata, retained briefly for security and abuse prevention. The IP address itself is not retained beyond that window.

Error reports

When the Service hits an unexpected error, we send a report to Sentry so we can fix it. Before you accept cookies, that report contains the technical context only: error message, stack trace, page URL, and browser version. We strip your user id, cookies, and request headers from the report before it leaves your browser. Note that the page URL itself may contain identifying path segments while you are signed in (your username and workspace name appear in paths under /workspace/). We treat capturing this as a legitimate interest under GDPR because the page URL is the smallest context we need to locate and fix the bug.

After you accept cookies, the report also includes your user id and email (so we can reach out if your specific account is hitting a problem), plus a short video-like recording of the seconds leading up to the error. This error recording sits in a rolling buffer and is thrown away unless something breaks and flushes it, so it never captures a normal browsing session. Form input values are masked. It is separate from the product-analytics replay under Cookies & analytics, which records ordinary visits on our public pages.

• Provide the Service. Authenticate you, render your workspaces, and fetch the ad-platform data you authorized.
• Communicate. Send transactional emails (sign-up confirmation, password reset, security notifications, workspace invites) from noreply@campyon.ai. That mailbox is unmonitored; for replies, contact support@campyon.ai.
• Improve the product. Review aggregated usage patterns to understand which features get used and where people get stuck.
• Diagnose errors.When something breaks, the error context (stack trace, page, optional user id once you've consented) goes to Sentry so we can reproduce and fix it.
• Security and compliance. Detect abuse, prevent unauthorized access, and meet our legal obligations.

We do not sell your personal data, and we do not use your workspace content to train machine-learning models.

We use a small number of cookies and similar technologies, plus one analytics tool that uses neither.

Strictly necessary

Required for the Service to function: your authentication session and the cookie that records your consent decision. These are set without a prompt because the Service cannot work without them.

Analytics (consent-gated)

PostHog (EU project, hosted at eu.i.posthog.com) captures pageviews and feature events to help us improve the product. We wait for your explicit consent before PostHog fires. Until you accept, it sets no cookies, writes nothing to local storage, and captures no events. This applies to every visitor regardless of region.

On our public marketing pages, the ones you can browse without signing in, PostHog also records a replay of your visit once you accept: a video-like reconstruction of what you clicked and scrolled. Every form field is masked, the job-application form is blocked out entirely, and signed-in workspace pages are never recorded. Turn consent off and recording stops right away.

Cookieless page counts

Vercel, which hosts the Service, also counts page views for us through Vercel Web Analytics. It sets no cookies and stores nothing on your device, so it runs whether or not you accept the banner. (Its script does check your browser's local storage for an optional account-linking feature we don't use, so that check never finds anything and nothing is saved.) To tell one visit from another without a cookie, Vercel makes a hash from details of the incoming request, such as your IP address and browser, and deletes that hash after 24 hours. We only ever see totals: pages viewed, referring sites, campaign (UTM) tags, and visitors' country, browser, operating system, and device type. We never see your IP address, and nothing in those reports points back to you.

Before a page view leaves your browser, we remove anything in the address that could identify you: the username and workspace name in workspace pages, invite tokens, record ids, every query parameter except the campaign source, medium, and name, and anything after a #. An address that isn't one of our pages is counted as “unmatched” and nothing more. The one detail we can't trim is the site that sent you here, which your browser normally shares as just its domain. Our legal basis is legitimate interest, since we need to know which pages get used and this doesn't build a profile of anyone. To object, email privacy@campyon.ai.

Error monitoring (two tiers)

Sentry (EU project, hosted at ingest.de.sentry.io) captures errors so we can diagnose and fix them. Error capture runs pre-consent on a narrow scope: the technical error context only, with cookies, request headers, and any user identifier stripped before the report leaves your browser. We treat this as legitimate interest under GDPR because no personal data is captured and the alternative is shipping a Service we can't debug.

After you accept cookies, two additional things switch on: the error report includes your user id and email (so we can contact you if your account hits a recurring issue), and Sentry's Session Replay records a short rolling buffer that flushes only when an error occurs. This Sentry buffer only keeps the moments around a crash, not a normal session (the product-analytics replay above is the one that records ordinary visits on public pages). Form inputs are masked at the SDK layer. Withdraw consent at any time and replay stops immediately; future reports go back to the pre-consent scope.

Your choice, on every device

The decision is stored locally and re-prompted at least every 13 months, in line with CNIL and EDPB guidance. You can change it any time from the footer, from your workspace user menu, or here:

Privacy choices

We share personal data only with the providers we need to run the Service, each bound by a data-processing agreement and the appropriate transfer mechanism.

We may also disclose data when required by law, to protect the safety of our users, or in connection with a merger or acquisition (in which case we'll notify you in advance). Send law-enforcement requests and other formal legal notices to legal@campyon.ai.

Companies on Campyon can post open roles on our public job board. If you apply to one of those roles through a form on campyon.ai, we first send a one-time code to your email to confirm it's yours, then collect what you put in the form: your name, email address, an optional cover note, an optional portfolio link, and your CV if you attach one. The verification code and the IP address that requested it are kept only briefly, then deleted automatically.

Your application goes to the company you applied to. They decide what happens with it. For that data, the hiring company is the data controller and Campyon is a processor acting on their behalf. We store applications and CVs in the EU (Supabase), restrict access to the hiring company's workspace, and never use applicant data for anything other than delivering it to that company. We process it on the basis of the consent you give when submitting the form.

Applications are deleted automatically 90 days after the posting closes, CV files included. To have your application removed earlier, contact the company you applied to, or email privacy@campyon.aiand we'll handle it within 30 days.

• Account data. Kept while your account is active. Deletion requests are honoured within 30 days, excluding records we are legally required to keep.
• Workspace content. Kept until you delete it or the workspace, then removed from production within 30 days and from backups within 90 days.
• Integration tokens. Revoked immediately when you disconnect a provider; cached data from that provider is purged on the next sync.
• Job applications. Deleted, including CV files, 90 days after the job posting closes.
• Analytics events. Retained for up to 12 months in PostHog, then aggregated or deleted.
• Page-view counts.Vercel deletes the visitor hash after 24 hours. After that, only anonymous totals remain, and they can't be tied back to you.
• Error reports. Retained for up to 90 days in Sentry.
• Session replays. Both the product-analytics replays (PostHog, public pages only) and the error replays (Sentry, the seconds around a crash) are kept for up to 30 days, then deleted. Neither is created before you consent.
• Server logs. Retained for up to 30 days for security and debugging.

Account and workspace data are stored in the European Union (Supabase EU region). Analytics events and product-analytics replays are stored in the EU (PostHog EU). Error reports and error replays are stored in the EU (Sentry, Frankfurt). Some sub-processors (notably Vercel, for its edge network and page-view analytics, and certain email providers) may process data in other regions; in those cases we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

You can contact us to exercise rights over your data. Residents of the EU/EEA, UK, and Switzerland have the following rights under the GDPR:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Correct anything inaccurate or incomplete.
• Erasure. Delete your account and personal data.
• Restriction. Pause certain processing while we resolve a dispute.
• Portability. Receive your data in a machine-readable format.
• Objection. Object to processing based on legitimate interest.
• Withdraw consent. Withdraw analytics consent at any time, with no effect on the Service.

Email privacy@campyon.ai from the address on your account and we will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

We protect your data with TLS in transit, encryption at rest on all managed databases, scoped database access via row-level security, encrypted OAuth tokens, and least-privilege access for the team. No system is fully secure. If you discover a vulnerability, please email security@campyon.ai with the details. We acknowledge security reports within two business days. The same address is published at /.well-known/security.txt for researchers who look there first.

The Service is not directed to children under 16. We don't knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we'll delete it.

We may update this policy from time to time. The date at the top of this page reflects the most recent change. For material changes we will notify you by email or via an in-app notice before they take effect.