AdCreative

The Privacy Policy states that AdCreative.ai uses 'anonymized user data' for AI training and improvement, with GDPR compliance claimed. However, the ToS (Clause 10.1) grants broad permission to use 'Data Iklan' (Advertising Data) for 'pelatihan, pengembangan, dan peningkatan sistem serta solusi kecerdasan buatan kami' (training, development, and improvement of AI systems). While anonymization is mentioned, the scope is vague and users cannot opt-out by default—they must affirmatively request deletion. Free vs. paid tier distinction is not clearly addressed.

“[Privacy] 'AdCreative.ai uses anonymized user data for the purpose of improving and training its artificial intelligence systems' and [ToS] 'Anda memberikan izin dan mengizinkan AdCreative.ai untuk menggunakan Data Iklan secara eksklusif untuk tujuan Layanan (termasuk...pelatihan, pengembangan, dan peningkatan sistem serta solusi kecerdasan buatan kami)'”

ToS Clause 6.1 grants AdCreative.ai a 'limited, non-exclusive, irrevocable, worldwide, royalty-free, transferable license, with the rights to sublicense' over user Content. The license is explicitly irrevocable and includes sublicensing rights. Clause 12.2 further grants a 'non-exclusive, royalty-free, worldwide' license to use customer trademarks and company names for marketing and promotional purposes without requiring customer approval. These terms are perpetual and broad.

“[ToS 6.1] 'You hereby grant to AdCreative.ai a limited, non-exclusive, irrevocable, worldwide, royalty-free, transferable license, with the rights to sublicense' and [ToS 12.2] 'Pelanggan dengan ini memberikan kepada AdCreative.ai hak lisensi non-eksklusif, bebas royalti, dan berlaku di seluruh dunia untuk menggunakan merek dagang, logo, dan nama perusahaan Pelanggan untuk tujuan promosi, pemasaran'”

The Privacy Policy states data is shared with 'processors and partners' when 'strictly necessary' and mentions subcontractors may be outside the EU with 'adequate levels of data protection' or Privacy Shield/contractual safeguards. However, specific sub-processor lists are not published. Clause 9 (Confidentiality) allows sharing with 'Personel yang Berwenang' (Authorized Personnel) including 'penyedia layanan, kontraktor, dan afiliasi' (service providers, contractors, and affiliates) without detailed restrictions. The Privacy Policy claims 'AdCreative.ai respects user privacy by not sharing data with external third parties for AI processing,' but this conflicts with the broad license grants in ToS.

“[Privacy] 'the collected data are transferred to our processors and partners which intervene in the provision of our services' and [ToS 9] 'Penerima tidak boleh mengungkapkan...kepada pihak ketiga mana pun, kecuali kepada karyawan, agen, perwakilan, konsultan, penyedia layanan, kontraktor, dan afiliasi'”

The Privacy Policy specifies retention periods: 180 days after service access is disabled (general data), 5 years for billing data, 10 years for invoices, and 13 months for cookies. However, the ToS does not clearly address data retention or deletion timelines. The Privacy Policy states users can request deletion and must receive confirmation via email, but the process requires manual confirmation and the 180-day period after account disabling is vague regarding when 'disabling' occurs. Backup retention and data lifecycle are not fully documented.

“[Privacy] 'The personal data collected by users is retained for a period of one hundred and eighty (180) days from the disabling of access to the services offered by AdCreative.ai, except for the data that AdCreative.ai would need to keep as evidence, for legal or administrative purposes'”

ToS Clause 7.1 explicitly states: 'However, the Projects generated by the Services based on the Contents provided by the Client will be owned by the Client.' This clearly grants IP ownership of generated outputs to the user/company. The vendor retains no rights to the Projects themselves, only to the underlying Service platform and AI technology.

“[ToS 7.1] 'However, the Projects generated by the Services based on the Contents provided by the Client will be owned by the Client.'”

The Privacy Policy states compliance with GDPR and French Data Protection Act, and mentions adherence to Google API Services User Data Policy. However, no SOC 2 Type II, ISO 27001, or HIPAA certifications are mentioned. The Privacy Policy references HTTPS/SSL encryption and 2-factor authentication but does not provide a published security page, trust center, or formal DPA reference. Compliance is claimed but not formally certified.

“[Privacy] 'AdCreative.ai is committed to the protection of users' personal data...in accordance with French and European regulations, in particular with the French Data Protection Act of 1978...and the General Data Protection Regulation' and 'Transmission of your Data via the Internet is secured via an HTTPS connection protected by an SSL certificate'”