Privacy Policy

Dashless Ltd runs Dashless and is the data controller for the personal data described here. Our registered office is 3-3, 35 Springbank Gardens, Glasgow G31 4QP, Scotland, United Kingdom. For anything about your data, email support@dashless.app.

• Your account. Your email address and, if you sign in with Google, the name Google shares with us. The email addresses of team members and clients you invite.
• Your ad accounts, from Meta. When you connect Meta, we read your campaigns, ad sets and ads, including the creative (images, videos and ad copy), and their results: spend, impressions, clicks, purchases and revenue as Meta reports them. Breakdowns such as age, gender and placement come from Meta as totals and do not identify individual people. We store the access token Meta gives us, encrypted.
• What you add. Your targets and settings, the questions you ask the analyst, notes and facts you give it to remember, the reports you write, and any online stores you ask us to track.
• Billing. Stripe collects your card details; we never see them. We keep your Stripe customer ID, your plan and your subscription status.
• Integrations you connect. If you connect Slack, the workspace and channel we post alerts to, and the access token Slack gives us. If you create API keys for our MCP server, we store only a hash of each key.
• How the site is used. Page views through Vercel Web Analytics, which uses no cookies, and our own record of steps such as clicking a button or starting a free read. That record holds a random ID for your browser tab and, if you are signed in, your user ID.
• Which of our ads brought you here. If you allow it, Meta's pixel records visits to our public pages and three steps: starting a free read, going to checkout and starting a trial. See Cookies below.
• Technical logs. Errors and our calls to Meta's API, so we can keep the service working.

We use your approximate country, which our hosting provider supplies from your connection, to show prices in your currency.

We ask Meta for two permissions: ads_read, to read your ad accounts, and business_management, to list the ad accounts in your Business Manager. We never ask for permission to change your ads. We do not read messages, posts or personal data about the people who see your ads.

• To provide the service you signed up for (performance of our contract with you): reading your ad accounts, checking ads against your targets, writing analysis and reports, answering questions, sending the alerts and emails you set up, and billing you.
• To keep Dashless secure and working (our legitimate interests): logs, limits that stop abuse, and fixing errors.
• To improve Dashless (our legitimate interests): looking at how the site and app are used, in aggregate.
• To measure our own advertising (your consent in the UK, the EEA and Switzerland; elsewhere our legitimate interests, and you can turn it off): the Meta pixel.
• To meet legal obligations: tax and accounting records, and lawful requests from authorities.

We do not sell your data, or combine different customers' data in any form that identifies them. The only thing we send an advertising platform is the Meta pixel data described under Cookies. Your ad accounts, your clients and anything inside the app are never part of it.

To write analysis, reports and answers, we send the relevant account data and your questions to Anthropic's API. Anthropic does not use this data to train its models, and neither do we.

• Supabase: our database and sign-in. Ireland.
• Vercel: hosting and web analytics. Our servers run in Dublin, Ireland.
• Anthropic: AI analysis and answers. United States.
• Stripe: payments and billing.
• Resend: sending our emails. United States.
• fal: only if you use AI image generation, where it is available.

Some services you choose to use run under their own privacy policies rather than on our behalf: Meta, the source of your ad data and, if you allow its pixel, a joint controller with us for the data the pixel collects; Google, if you sign in with Google; and Slack, if you connect it for alerts.

People you share with. A report you share by link can be opened by anyone who has the link, until it expires or you revoke it. A client you give a seat to sees only the ad account you give them.

Our database and servers are in Ireland, which the UK recognises as providing adequate protection. Some of the providers above process data in the United States. Each of them has a data processing agreement that forms part of its terms with us, and covers transfers out of the UK with the UK International Data Transfer Addendum to the Standard Contractual Clauses, and in some cases the UK Extension to the EU-US Data Privacy Framework.

• While your account is open, we keep your data so the service works.
• If you cancel your plan, your data stays until you delete your account, so you can come back. You can delete it at any time.
• When you delete your account, we delete your profile, your connected ad accounts and everything built from them. Usage records we keep are unlinked from you.
• If you take a free read and don't start a plan, we remove our access to that ad account within 48 hours of the read.
• Stripe keeps payment records for as long as tax law requires.
• Deleted data can remain in our database provider's backups for a short period before those backups are replaced.

Dashless needs some cookies to work: keeping you signed in, remembering which workspace you are in, protecting the Meta and Slack connection steps against forgery, and carrying your answers from the signup questions to the pricing page. Your browser also stores a random ID for the current tab, for our usage record, and preferences such as light or dark mode.

The Meta pixel is the one advertising cookie. It runs on our public pages (the homepage, pricing, sign in and the pages around them) and sets _fbp, and _fbc if you came from a Meta ad, for up to 90 days. It tells Meta which of our ads led to a visit, and whether you then started a free read, went to checkout or started a trial. It never runs on the pages inside the app, and it does not read what is on a page. In the UK, the EEA and Switzerland it loads only after you press Allow; elsewhere it loads unless you turn it off. You can change your choice here at any time:

Meta access tokens are encrypted with AES-256-GCM. Each workspace can see only its own data, and a client seat sees only the account it is given. Everything travels over HTTPS. API keys are stored only as hashes, and card details stay with Stripe.

You can ask to see the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or receive a copy to take elsewhere. Email support@dashless.app and we will reply within one month.

You can delete your account yourself from Settings or on the data deletion page, and disconnect any Meta ad account at any time. If you email us instead, we delete your data within 7 days.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk. We would like the chance to fix it first.

Dashless is a tool for businesses and is not meant for anyone under 18.

If a public authority asks for personal data we hold, we check that the request is lawful and valid before responding, and we challenge requests we consider unlawful or too broad. Where we are legally required to disclose, we disclose only the minimum needed.

We record each request, our response and our reasons, and unless the law prevents it, we tell the customers affected. We do not give any government direct or bulk access to customer data.

When we change this policy we update the date at the top. If a change affects how we use your data in a meaningful way, we email account holders before it applies.