How we protect your data

When you upload a video or submit a YouTube URL, this is the exact sequence:

• ✓File is uploaded to our analysis server over HTTPS (encrypted in transit)
• ✓Processed on an ephemeral working filesystem during analysis; the working copy is never persisted
• ✓Transcription runs on our own infrastructure by default (a local Whisper model). When a hosted transcription provider (Groq or OpenAI) is enabled for speed, the audio is sent there for transcription under that provider’s API terms — processed transiently and not used to train their models; a low-confidence clip may additionally use the optional AssemblyAI fallback (see Subprocessors)
• ✓Acoustic analysis (pitch, energy, voice-clarity proxy) runs locally: no audio sent to any third party
• ✓The transcript text, acoustic signal summaries (numbers, not audio), and up to four still frames sampled from the video are sent to Anthropic (Claude) — the transcript and summaries for linguistic analysis, the frames for on-screen/frame-semantics analysis; where a hosted summariser (OpenAI) is enabled it also receives the transcript to draft the report summary. The full audio or video file is never sent.
• ✓Your original creative is kept for in-report playback by default - stored encrypted, access-controlled to your account; switch retention off in Account and it is deleted the moment analysis finishes
• ✓Raw video is never written to our database

Who can see your data

• ✓Only you (and team members you invite) can see your analyses
• ✓AdZhi staff have no application-level access to your analysis results; any infrastructure access is restricted, logged, and used only for operational support
• ✓Share links you create expose only that specific report, to anyone with the link. You control this
• ✓Your data is never shared with other AdZhi customers; it only ever feeds shared benchmarks in aggregate across many accounts, never as a single identifiable account (see ML model training below)

Authentication and access control

• ✓Passwords are hashed with bcrypt: we never store plaintext passwords and cannot recover them
• ✓Sessions use signed JWT tokens that expire after 60 minutes
• ✓All API requests require authentication: no unauthenticated data access
• ✓Every database query is scoped to your user ID: no cross-account data access is possible by design
• ✓Password reset uses single-use time-limited tokens sent to your verified email

How your data is encrypted

• ✓In transit: all connections use TLS 1.2+ (HTTPS). HTTP is not served.
• ✓Secrets at the application level: connected ad-account OAuth tokens are encrypted with Fernet (AES-128-CBC with an HMAC authenticity tag) before they are written to the database; passwords are bcrypt-hashed and API keys are stored only as SHA-256 hashes. None of these are reversible or readable in the database.
• ✓At rest: the database runs on Railway's managed Postgres, with any retained media on Railway-hosted storage. Disk-level encryption at rest is handled by the managed platform; see Railway's own security documentation for the current guarantee.

The following third parties process data as part of the AdZhi service:

Last updated: 13 July 2026. We notify account owners by email at least 30 days before a new subprocessor starts handling personal data, so you can object before it takes effect.

AdZhi improves its models and shared benchmarks using acoustic feature data from analyses. This is on by default. You can opt out anytime in Account → Benchmark data.

The lawful basis for this is our legitimate interest in improving the product for every account, balanced by a standing right to opt out at any time (UK GDPR Article 6(1)(f) and the right to object). It is set out in full in our Privacy Policy, Section 5.

While it's on, the following is logged after each analysis:

• ✓Numeric acoustic features: pitch range, energy values, WPM, disfluency count, silence ratio (numbers only, not audio)
• ✓Scores: AdZhi Score, hook score, CTA energy, voice quality, structure score
• ✓Context signals: inferred industry, platform, objective (not your ad account data)
• ✓A pseudonymous internal job and account reference, so a vector can be traced back for opt-out and deletion (an internal ID, never your name, email or company)

What is never included in training data:

• ✕Your video or audio file
• ✕Your transcript or any spoken words
• ✕Your ad account data, spend, or performance metrics
• ✕Any personally identifying information
• ✕Your company name or brand name

Each contributed vector is keyed to a pseudonymous internal account reference. Under UK GDPR that makes it pseudonymised personal data, not anonymous: we could re-associate it with you, which is exactly what lets you withdraw it. It is never labelled with your name, email or company, is only ever used inside multi-account aggregates — never as a single identifiable account, and never exposed to another customer. Every cross-account surface applies a k-anonymity floor before an aggregate is formed (a minimum number of distinct accounts must contribute); the pooled driver model additionally adds differential-privacy noise. Opting out in Account → Benchmark data stops all future contribution immediately. To have previously contributed vectors deleted, email privacy@adzhi.co.uk; deleting your account erases them along with the rest of your data.

Why opt in? Your data helps AdZhi predict performance more accurately for everyone. The Phase 2 XGBoost models that convert heuristic predictions into validated ones require labelled training data from real ads. Users who opt in are directly improving the product for themselves and other performance marketers.

Here's where we actually stand:

• SOC 2 Type II: This requires a year-long audit process and ~£15k in fees. We're working toward it as we grow. Enterprise customers who require it can contact us to discuss timelines.
• ISO 27001: Similarly, an enterprise compliance requirement we're working toward.
• Penetration test: Targeted for Q4 2026 with a third-party firm.

For SMB and agency customers, the security controls above are appropriate for the data involved (ad creative and acoustic analysis). We don't process payment card data, health data, or sensitive personal information.