Privacy Policy

We collect the following categories of information:

• Account information — name, email, company, job title, and password (handled via our authentication provider, Clerk).
• Plan & campaign content — media plans, budgets, scenarios, brand information, and measurement data you create or upload into the platform.
• Usage data — pages visited, features used, clicks, session duration, referrer, browser, device, and IP address. Collected via PostHog and standard web logs.
• Marketing attribution — UTM parameters, Google click IDs (gclid), and ad-platform identifiers when you arrive from a paid campaign.
• Data from connected ad platforms — campaign settings, creative, and performance data from ad accounts you connect. See Section 4.
• Communications — emails, messages, and meeting notes you exchange with us, including any feedback or support requests.
• Cookies & similar technologies — used for authentication, analytics, and marketing attribution. See Section 7.

We use the information we collect to:

• Provide, operate, and improve the Services.
• Authenticate users and secure accounts.
• Process media plans, scenarios, and measurement data on your behalf.
• Send transactional emails (account, billing, security) and, where permitted, product and marketing communications.
• Analyze usage, diagnose issues, and improve the product.
• Measure and optimize marketing campaigns (including paid search and paid social attribution).
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We share information with:

• Service providers — including Clerk (authentication), Vercel (hosting), PostHog (product analytics), Resend (transactional email), Stripe (billing), Google Workspace (email/calendar), and Anthropic / OpenAI (AI features). These providers process data only under contract and on our instructions.
• Advertising partners — aggregated or hashed identifiers may be shared with Meta, Google, and other ad platforms to measure and optimize campaigns.
• Legal and safety — when required by law, legal process, or to protect the rights, property, or safety of Halliard, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

If you connect an advertising account to Halliard, such as a Meta (Facebook and Instagram) ad account, a Google Ads account, or a programmatic platform, you sign in with that platform and choose which accounts, Pages, and pixels to share with Halliard, using the platform's own authorization screen (for Meta, Facebook Login for Business). We never see or store your password. The platform gives Halliard an access token limited to what you chose. We keep that token encrypted in a dedicated secrets manager, separate from the rest of our data. It is never stored in our application database, written to logs, or shown to anyone, and it is used only by Halliard's servers to make the requests described below. Alternatively, you can share an ad account, Page, or pixel with Halliard's business portfolio as a partner in your platform's business settings, the same way you would with an agency. Halliard then accesses it with its own credentials, and no token from you is involved.

What we read. Account, campaign, ad set, and ad settings; ad creative (images, video, and copy); delivery and performance metrics such as spend, impressions, reach, clicks, and conversions; and the name and picture of the Page and the ID of the pixel your ads use. We read aggregated advertising data. We do not read private messages or the personal profiles of people who see or engage with your ads.

What we do with it. We use it only to provide the Services to you: building media plans from your own historical costs and results, ranking which creative performed, drafting campaigns, reporting on live campaigns, and proposing optimizations. When you approve a draft or a change, we create or update campaigns, ad sets, and ads in your account on your behalf. Nothing is created or changed in your account without your approval, unless you have told us in advance that a type of change, such as pausing an underperforming ad, does not need approval.

What we don't do. We do not sell ad-platform data. We do not use it to plan or buy for any other customer. We do not use it to build profiles of individuals, and we do not share it with third parties except the service providers listed in Section 3 who process it on our behalf, including the AI providers that power Halliard's planning and buying agents.

Record of activity. Every request we make to an ad platform on your behalf, and the platform's response, is recorded in an activity log you can review in Halliard. Access tokens are never included in that log.

Disconnecting and deletion. You can disconnect at any time in Halliard's settings, or by removing Halliard from your platform's business settings (for Meta, Business integrations or Partners). When you disconnect, we delete the access token from our secrets manager and stop reading from the account. To have data read from a connected account deleted, email privacy@halliardmedia.com with the account name. We will delete it within 30 days and confirm by email. The exception is the activity log of changes we made in your account on your behalf, which we keep as an audit record for as long as your Halliard account exists, or longer where the law requires.

We retain account and plan data for as long as your account is active, and for a reasonable period afterward to meet legal, tax, and audit obligations. You can request deletion of your account at any time by emailing privacy@halliardmedia.com. Backup copies may persist for up to 90 days after deletion.

We use industry-standard security practices including TLS in transit, encryption at rest for sensitive fields, access controls, and least-privilege internal access. No system is 100% secure; if you believe your account has been compromised, contact us immediately.

We use first-party and third-party cookies for authentication, analytics, and advertising. Specifically:

• Essential — session and CSRF cookies set by Clerk and our app.
• Analytics — PostHog for product usage analytics.
• Marketing — Meta Pixel, Google Ads conversion tracking, and LinkedIn Insight Tag where enabled.

You can control cookies through your browser settings. Disabling essential cookies will prevent the Services from working.

Depending on your location, you may have rights to access, correct, delete, port, or restrict processing of your personal information. California residents have rights under the CCPA/CPRA, and EU/UK residents have rights under the GDPR/UK GDPR. To exercise these rights, email privacy@halliardmedia.com. We will respond within the legally required timeframe.

Halliard is based in the United States, and your information will be processed in the U.S. If you access the Services from outside the U.S., you consent to this transfer. Where required, we use standard contractual clauses or other lawful transfer mechanisms.

The Services are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated effective date, and for significant changes we will notify account holders by email.

Questions or requests? Contact us at privacy@halliardmedia.com.

Halliard LLC
Hoboken, NJ, USA