Privacy Policy

A Pro Marketing, Inc. ("A Pro Marketing," "apro," "we," "us," or "our") respects your privacy. This policy explains what information we collect when you visit apromarketing.com, use app.apromarketing.com, install our Shopify plugin, or otherwise use our products and services (collectively, the "Services"). It describes why we collect that information, how we use it, who we share it with, and the choices you have.

If anything here is unclear, email us at contact@apromarketing.com.

1. Who we are

A Pro Marketing, Inc. is a Delaware C-corporation headquartered in the United States. We provide AI-assisted digital marketing tools — including our AI digital marketing agent, "Jade" — for solopreneurs and small and medium-sized businesses.

For personal information described in this policy, A Pro Marketing, Inc. is the data controller (or, where applicable, the "business" under U.S. state privacy laws).

You can reach us at:

A Pro Marketing, Inc.
Email: contact@apromarketing.com

2. Information we collect

Information you provide to us

• Contact form. Name, email address, optional company and team size, the topic you selected, your message, and whether you opted in to follow-up communications.
• Newsletter and beta signups. Name, email, optional company and website.
• Demo and account creation. Information you provide when you try our demo or create an account on app.apromarketing.com, including name, email, password (stored hashed), and billing information processed by our payment provider.
• Business profile data. When you onboard your business, we collect and process information about your business, including your website URL, company name, business overview, brand colors and assets (including logos you upload), tone and values, target audience description and demographics, competitor URLs, and keyword preferences.
• Connected account credentials. If you choose to connect social media, advertising, e-commerce, or analytics accounts (for example, to allow us to publish content on your behalf or to retrieve performance metrics), we receive and store OAuth tokens or API keys for those accounts. Refresh tokens and access tokens are encrypted at rest using AES-256-GCM. We request only the scopes necessary to perform the functions you have authorized, and you can revoke access at any time from your account settings or directly with the connected platform.
• Google services (Analytics and Search Console). When you connect Google Analytics or Google Search Console, you grant us read-only access using the scopes analytics.readonly, webmasters.readonly, and userinfo.email. We store an encrypted refresh token for ongoing access and use it solely to fetch the metrics and reports we display in the Service. We do not use this data for advertising and do not transfer it to third parties except as needed to deliver the Service to you, as required by law, or as part of a business transfer. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You may revoke access at any time from your account settings or at myaccount.google.com/permissions.
• Shopify plugin data. If you install our Shopify plugin, we receive store and product information that Shopify makes available under the scopes you approve at install time, in accordance with Shopify's app permission framework.
• Communications. If you email us, reply to automated emails (for example, to approve, edit, or reject proposed content or strategies), or otherwise correspond with us, we keep a record of the correspondence and process its contents to provide the Service.

Information collected automatically

• Cookies and similar technologies. We use cookies to remember your preferences (such as language) and to measure how the site is used. See Section 6 for details.
• Log and device data. Like most websites, our servers record IP address, browser type, device identifiers, referring page, and timestamps. We use this for security, debugging, and aggregate analytics.
• Analytics. We use Google Analytics to understand traffic patterns. Analytics data is aggregated and not used to identify individuals.

Information collected from third parties and public sources

To deliver the Service, we collect information about your business from sources you direct us to or that are publicly available, including:

• Content scraped from the website URL you provide (for brand, content, and SEO analysis).
• Publicly available information about your competitors and industry.
• Performance and SEO metrics retrieved from Google Lighthouse / PageSpeed Insights.
• Keyword and search data retrieved from Google Ads (Keyword Planner) APIs.
• Publicly visible information from social media platforms (such as follower counts and post metrics) for accounts you identify or that we auto-detect from your website.

3. How we use your information

We use the information we collect to:

• Provide, operate, maintain, and improve the Services, including generating marketing strategies, campaigns, and content tailored to your business.
• Train per-customer retrieval-augmented (RAG) systems that personalize Jade's outputs to your brand. We do not use your business or personal data to train foundation models that serve other customers.
• Respond to inquiries and provide customer support.
• Send you transactional messages, such as proposed quarterly strategies and weekly content drafts for your review and approval.
• Send newsletters and product updates if you have opted in.
• Detect, prevent, and address technical issues, fraud, or abuse.
• Comply with legal obligations.

How AI is used in the Service

The Services use artificial intelligence to analyze your business and generate marketing assets. To do this, we send relevant inputs (such as your business profile, brand information, and prompts) to our own internal models and to third-party AI providers, including OpenAI, Anthropic, Google (Gemini), and Perplexity. We rely on the enterprise/API offerings of these providers, which are contractually configured so that your inputs and the resulting outputs are not used to train their general-purpose models. Each provider's own retention and abuse-monitoring practices apply to data they process on our behalf.

AI-generated outputs (strategies, copy, images, and similar) may contain inaccuracies or omissions. We provide review-and-approval workflows so you can edit or reject anything before it is published. We do not use AI to make decisions that produce legal or similarly significant effects about individuals.

4. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases:

• Consent — for newsletter signups, optional marketing communications, and non-essential cookies. You can withdraw consent at any time.
• Legitimate interests — for operating and improving the Service, securing the site, understanding aggregate usage, and preventing fraud and abuse.
• Contract — when processing is necessary to deliver a product or service you have requested, including running AI workflows on data you submit.
• Legal obligation — when we are required by applicable law.

5. Sharing your information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

We share information only in these limited situations:

• Service providers and sub-processors. Vendors who help us operate the Service. These providers are bound by contracts that limit them to processing your data on our behalf.
• At your direction. When you connect a third-party account (for example, a social media platform) and authorize us to publish content or retrieve data on your behalf, we exchange information with that platform as needed.
• Legal and safety. When we believe disclosure is required by law, court order, or to protect the rights, property, or safety of A Pro Marketing, our users, or others.
• Business transfers. If A Pro Marketing is involved in a merger, acquisition, financing, or asset sale, your information may be transferred. We will notify you before personal information becomes subject to a different privacy policy.

Current key sub-processors

We will update this list as our sub-processors change. As we roll out posting on social media platforms (for example, Meta, X, LinkedIn, TikTok, YouTube), those platforms will also act as recipients of content and account data when you connect them.

6. Cookies

You can control cookies through your browser settings or, where offered, our cookie preferences tool. Blocking cookies may affect how the site works — for example, the site may not remember your language preference.

We use the following categories:

• Strictly necessary — required for the site to function (such as authentication and the language preference cookie).
• Analytics — help us understand how visitors use the site (e.g., Google Analytics).
• Marketing — help us measure ad effectiveness on third-party platforms (e.g., Meta Pixel).

A detailed list of the specific cookies we use, their providers, and their durations is available in our cookie preferences tool on the website.

7. Data retention

We keep personal information only as long as needed for the purposes described in this policy, or as required by law:

• Contact form submissions: up to 24 months.
• Newsletter records: until you unsubscribe.
• Account and business profile data: for the life of your account, and up to 90 days after account deletion to allow recovery and to satisfy legal and audit obligations. After that, we delete or de-identify the data.
• Generated strategies, campaigns, and content: for the life of your account, unless you delete them earlier.
• Connected-account credentials (OAuth tokens, API keys): until you disconnect the integration or delete your account, after which we revoke and delete them.
• Backups: retained on a rolling basis for up to 90 days.
• Aggregate, de-identified analytics: may be retained longer.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information.
• Object to or restrict certain processing.
• Receive a copy of your information in a portable format.
• Withdraw consent where we rely on it.
• Opt out of any "sale" or "sharing" of personal information (we do not sell or share, but you can confirm this preference).
• Be free from retaliation for exercising your privacy rights.

To exercise any of these rights, email contact@apromarketing.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling certain requests. You may use an authorized agent where permitted by law.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

U.S. state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws have the rights described above to the extent those laws apply. California residents may also request information under the "Shine the Light" law (Cal. Civ. Code § 1798.83) about disclosures of personal information to third parties for their direct marketing purposes; we do not currently make such disclosures.

9. Automated decision-making

We use AI to generate marketing strategies, campaigns, and content. These outputs are presented to you for review, editing, and approval before any external action (such as publishing to a social media account) is taken. We do not use automated processing to make decisions about individuals that produce legal effects or similarly significant effects.

10. Security

We use administrative, technical, and physical safeguards to protect personal information, including:

• TLS encryption for data in transit.
• Encryption at rest for sensitive credentials such as OAuth tokens and API keys.
• Role-based access controls and the principle of least privilege for personnel.
• Audit logging on production systems.
• Regular review of our infrastructure and dependencies.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Children's privacy

Our Services are not directed to children. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction, which is 16 in much of the EEA and UK). If you believe a child has provided us with personal information, please contact us so we can delete it.

12. International transfers

A Pro Marketing, Inc. is headquartered in the United States, and your personal information may be processed in the United States or in other countries where our service providers operate. These countries may not provide the same level of data protection as your home country.

Where required, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You may contact us to request more information about these safeguards.

13. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you by email or through the Service. Your continued use of the Services after the update takes effect constitutes acceptance of the revised policy.

14. Contact us

Questions, requests, or concerns about this policy or your information can be sent to:

A Pro Marketing, Inc.
Email: contact@apromarketing.com