1. Who operates Ad8
Ad8.ai is operated by [LEGAL_ENTITY], located at [REGISTERED_ADDRESS]. Contact for privacy requests: [VERIFIED_PRIVACY_CONTACT]. Effective date: [EFFECTIVE_DATE]. Identify any legally required representative or data-protection contact after reviewing the actual operating markets.
2. Scope
This notice should cover the marketing site, account and billing workflows, research workspace, support requests, and Ad8’s MCP service. Third-party AI applications and linked source platforms maintain their own policies. The standalone preview has no network submission or analytics code; that fact must not be copied into the live policy unless still true.
3. Information categories
Describe the data actually collected: account identifiers, authentication records, brand context and tracked selections, report requests, MCP authorization and tool-use logs, support messages, consent records, and payment-provider references. Disclose any public-source advertising information that includes personal data. Do not claim Ad8 receives full card details unless it actually does.
4. Purposes and lawful basis
For each relevant category, identify why it is processed and the applicable legal basis in each operating jurisdiction. Potential activities include account administration, delivery of subscribed research, payment management, abuse prevention, support, and optional marketing. [PURPOSE_AND_LEGAL_BASIS_TABLE] must match real processing rather than a generic claim that all processing is based on consent.
5. Service providers and disclosures
Identify actual hosting, authentication, payment, email, support, storage, monitoring, and AI-analysis providers and the roles they perform. [ACTUAL_PROVIDER_LIST]. State any advertising or analytics sharing accurately. No assertion that data is “never shared,” “never sold,” or excluded from model training is approved without verification.
6. External AI connections
Explain which questions, record content, report content, and workspace details a connected client can receive. The user’s selected AI provider may process that content under separate terms. Revoking access stops future authorized retrieval but does not automatically erase content already transferred.
7. Retention and deletion
Publish actual retention periods or clear criteria for account records, reports, ad-source observations, support messages, logs, billing records, and backups. [RETENTION_SCHEDULE]. Distinguish canceled subscriptions from deletion requests and disclose any legally required retention.
8. International transfers
Describe actual processing locations and applicable transfer safeguards. [PROCESSING_LOCATIONS_AND_TRANSFER_MECHANISMS]. Do not insert a guarantee of local-only storage without confirming infrastructure and all providers.
9. Individual rights
Explain rights that apply in the relevant jurisdiction, how to request them, any identity verification needed, applicable response periods, and the relevant regulator or complaint route. [JURISDICTION_SPECIFIC_RIGHTS_AND_CONTACTS]. Requests may concern public-source personal data as well as account data.
10. Cookies and choices
Link to the finalized cookie inventory and consent controls. Essential service processing and optional marketing choices should not be bundled. Identify the actual analytics and advertising technology before describing its operation.
11. Security and incidents
Describe implemented measures accurately and the actual process for handling incidents. Do not claim certification, absolute security, or a fixed notification deadline without a supporting basis.
12. Updates
Explain how material changes will be communicated and maintain an effective date and version. This draft cannot be published as the final notice while placeholders or unverified practices remain.