Your account
When you create an account, Waleni stores your name, your email address, your password (only as a one-way hash, never in readable form) and your workspace’s name and type. When you invite a teammate, Waleni stores their email address and role. A session cookie keeps you signed in for up to 7 days; exploring a sandbox from the home page creates an anonymous account with its own session cookie. Waleni’s application does not store IP addresses; our hosting provider’s request logs may record them.
Your workspace
Waleni stores what you add to your workspace: products and offers, the images and videos you upload, campaign plans and approvals, and the images and videos you generate. An activity log records who did what in the workspace and when, including invitations with the invitee’s email address. Waleni also stores text you add to the Research lab (copies stay in past analyses after you remove a source) and, in the onboarding conversation, your messages and answers, along with text read from your website if you give its address. In the Waleni chat on your workspace screens, it keeps each person’s messages and Waleni’s answers (the last 60) so the conversation continues across screens and devices; “New conversation” deletes them. A sandbox workspace connects no advertising accounts and does not use paid AI services.
AI replies
When AI replies are on for your workspace, each message you send for a reply is sent to OpenAI to write it, together with the context it needs:
- the recent conversation: up to the last 8 of your messages, answers and AI replies (long ones shortened), including messages saved while AI replies were paused or unavailable, for example before you subscribed;
- your answers and the product details you entered;
- your offer description and what you shared for it: links, and excerpts of the text read from them or from your website. For photos and videos you upload, only their file name, type and size are sent, not the files;
- an outline of your workspace: your workspace type and currency; your campaign brief; the names of up to 20 of your products and media files (with their type and status) and of up to 20 reviewed Research lab sources; for up to 10 of your campaigns, their name, status, review status, budget, platform, readiness checks and ad headlines; how many of each you have; with Waleni’s internal reference numbers for these items.
Waleni doesn’t add your account’s email address, payment details, passwords or connection tokens. What you write or share is sent as it is: if it includes personal information, such as a customer’s name in a review on your website, that is sent too. Requests are sent with OpenAI’s option to store the response turned off.
Waleni keeps, with your workspace data, each message, the request prepared for it (including this context), OpenAI’s full response (including any suggestion Waleni didn’t show you), and the reply’s usage and cost, also for requests that weren’t sent. You can pause AI replies in the conversation at any time.
Connected advertising accounts
When you connect an advertising account (currently Meta or Google Ads), Waleni stores its access token in encrypted form and reads what the permissions you grant allow, such as ad accounts, campaigns, spend and conversions; for Meta also Pages and pixels and, when you ask for them, your Page’s published posts, which Waleni saves. The workspace owner can disconnect an account in Connections, except while a campaign is running, starting, pausing or needs review. Disconnecting deletes the stored token but keeps the data already collected; to also withdraw Waleni’s permission, remove Waleni in your Meta or Google account settings.
Google user data
When you connect Google Ads, Waleni asks for one permission: Google Ads (adwords). With it, Waleni reads the Google Ads accounts you can access and the one you choose: its name, currency and time zone, its purchase conversion actions, and your campaigns’ status, spend, conversions, conversion value, impressions and clicks. When you approve a campaign in Waleni, it uses the same permission to create it in your account (budget, campaign, ad group, ad, keywords and location) and to pause it when you or your safety settings ask. Nothing is created, changed or switched on in your Google Ads account without your approval in Waleni.
Waleni’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Waleni uses Google user data only to provide and improve the features you use in Waleni. It does not sell it, does not use it for advertising to anyone else, and does not use it to develop, improve or train generalized AI or machine-learning models. When you ask Waleni’s AI about your results, the figures it needs are sent to OpenAI only to write that reply, as described under AI replies. Waleni staff do not read your Google data, except with your permission, for security or to investigate abuse, to comply with the law, or as part of aggregated, anonymized operations.
How it is protected. All traffic between your browser, Waleni and Google is encrypted in transit (HTTPS/TLS). Your Google access token is stored only in encrypted form (Fernet: AES-128 with an HMAC-SHA256 integrity check) and is never shown in the app or sent to the AI. Only the workspace owner can connect or disconnect Google Ads, every connection and disconnection is recorded in the workspace activity, and each workspace’s Google data is kept separate from every other workspace’s.
How long it is kept, and how to delete it. The Google access token is kept while Google Ads is connected and is erased as soon as you disconnect it in Connections. Your Google Ads account details and reporting data are kept while your workspace exists, so your reports and history stay available. Write to support@waleni.com to have them deleted: we delete them within 30 days of your request, or within 30 days of your workspace being deleted. You can stop Waleni’s access at any time in your Google Account at myaccount.google.com/permissions.
What you publish
Media and landing pages you publish are public: anyone with the link can see them. Publishing a landing page also publishes its photo. You can unpublish a landing page yourself; to remove published images or videos, write to support. Uploaded videos are stored as they are, with their file information (metadata); uploaded images are saved again without their camera and location data.
Billing
Payments are processed by Stripe. Stripe’s checkout collects your card or other payment details, your billing name and address and, if you enter one, a tax ID; Waleni never sees your full card number. Waleni gives Stripe your account email to set up billing, and keeps Stripe’s reference numbers and records of your plan, payments, invoices, refunds and disputes, and of your AI credits: purchases, balance, and the generations that held or used them.
Services that process your information
Waleni sends each service only what the feature you use needs:
- OpenAI: AI replies in the onboarding conversation (described above), product images you request (in the Media library, or in the onboarding conversation when you choose GPT Image) and Research lab analysis. For an image it receives the reference photo, the name and description of the product (or of the offer you described in the conversation), your art direction and, for a catalog product, its brand terms; for research, the text of the sources you analyse.
- Google Gemini: product images you request, in the Media library or the onboarding conversation. It receives the reference photo, the name and description of the product (or of the offer you described in the conversation), your art direction and, for a catalog product, its brand terms.
- Higgsfield: product videos you request (made with Kling). In the Media library it receives the link to the reference photo, which you publish first, the product’s name and description, your art direction and brand terms. In the onboarding conversation it receives the reference photo through a private link that stops working after one hour (the photo is not published), the name and description of the offer you described and your art direction.
- Typesafe: Research lab analysis, when that option is used. It receives the text of the sources you analyse.
- Stripe: payments for subscriptions and AI credits, as described above.
- Meta and Google: the advertising accounts you connect, as described above.
- Railway hosts the application and its database; Render keeps a standby copy of them for use if Railway is unavailable, and Cloudflare stores uploaded and generated media.
If the sources you analyse in the Research lab contain personal information, such as names in customer reviews, it is sent with them.
Landing pages Waleni hosts for you
Visitors to a landing page you publish get a one-day cookie containing a random identifier; Waleni records against it which version of the page was shown, when the visit started and whether the visitor clicked through. Ad click identifiers in the visitor’s link (from Google, Meta or TikTok) are kept for up to a day in an encrypted cookie in the visitor’s browser and added to the link to your store when they click through; Waleni does not save them in its database.
Browser storage
Besides the session cookie, the application uses your browser’s storage for preferences (theme, animations) and to remember requests in progress, so that one is not sent twice; most of this is cleared when you close the tab. Waleni’s website has no analytics or advertising trackers. The contact form prepares an email in your own email app; the website does not send or store it.
What we don’t do
We don’t sell personal information, and we don’t use it to advertise Waleni or for anyone else’s advertising.
How long we keep information
We keep account and workspace data while your account exists, and delete it when you ask us to, except billing records we must keep for accounting and tax.
Your requests
Write to support@waleni.com to access, correct or delete your account and workspace data, including data received from Meta (Facebook) or Google; we handle each request individually. You can also remove Waleni’s access in your Facebook or Google account settings at any time.
Security
Passwords are stored only as one-way hashes, and connection tokens and other secrets are encrypted. The session cookie cannot be read by page scripts and is sent only over secure connections.
Questions
Contact support@waleni.com.