Privacy Policy

Last Updated: March 17, 2026

Wren Logic LLC (“Company,” “we,” “us”) operates the Wingspan platform (“Service”). This Privacy Policy describes how we collect, use, store, and protect information when you use the Service.

1. Information We Collect

Account Information

• Email address — used for authentication (magic link sign-in) and communications
• Name and profile information — provided during account creation or via Google OAuth
• Google account data — when you sign in with Google, we receive your name, email, and profile picture from Google’s OAuth service. We do not access your Gmail, Drive, or other Google services.

Organization and Role Data

• Organization membership and assigned role (admin, planner, specialist, client_viewer, agency_partner)
• Organization settings and preferences

Marketing and Campaign Data

• Media plans, line items, flight schedules, and budget information entered by your organization
• Advertising performance data (spend, impressions, clicks, conversions) ingested from third-party ad platforms via automated pipelines
• Campaign IDs and account mappings linking ad platform accounts to clients
• Pacing calculations and alert history

Integration Data

• Slack: When your organization connects Slack, we store a bot access token and team name to enable alert posting. We do not access Slack message history or private channels beyond what is necessary to post alerts.

Usage Data

• Activity logs within the Service (e.g., creating or editing plans, resolving alerts)
• We do not use third-party analytics or tracking scripts on the Service at this time.

2. How We Use Your Information

We use collected information to:

• Provide and maintain the Service
• Authenticate your identity and enforce access controls
• Aggregate and display marketing performance data for your organization
• Generate alerts and reports based on campaign data
• Enable integrations with third-party services you connect (e.g., Slack)
• Communicate with you about your account or the Service
• Improve the Service based on aggregated, anonymized usage patterns

We do not:

• Sell your personal information to third parties
• Use your marketing data for purposes unrelated to providing the Service
• Share your organization’s data with other organizations

3. Data Storage and Security

Where Data Is Stored

• Account and application data: Supabase (hosted on AWS infrastructure)
• Marketing analytics data: Google BigQuery (Google Cloud Platform)
• Application hosting: Google Compute Engine (US region)

Security Measures

• All data is encrypted in transit (TLS/HTTPS)
• Database access is enforced through Row Level Security (RLS) — users can only access data belonging to their organization
• Embed dashboards use unique, revocable access keys
• Slack bot tokens are stored server-side and stripped from client-side application state
• Authentication is handled by Supabase Auth with industry-standard practices

Data Retention

• Account and organization data is retained for the duration of the service relationship
• Upon account or organization deletion, we will delete associated data within thirty (30) days
• Advertising performance data in BigQuery is retained according to your organization’s data lifecycle. Contact us for specific retention details.

4. Third-Party Services

The Service uses the following third-party services that may process your data:

Advertising platform data (Google Ads, Meta, LinkedIn, Snapchat, Spotify, Amazon Ads, Simplifi, Bidtellect) is ingested through automated pipelines. We process this data on your behalf under the authorization you grant through your ad platform accounts.

5. Client Embed Dashboards

Embed dashboards provide read-only access to select marketing data without requiring user authentication. Embed URLs contain unique access keys. We do not collect personal information from embed dashboard viewers. Your organization controls the distribution and revocation of embed keys.

6. Data Sharing

We do not share your data with third parties except:

• Service providers: Third-party infrastructure providers listed above, solely for operating the Service
• Legal requirements: When required by law, legal process, or government request
• Business transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)
• With your consent: When you explicitly authorize sharing

7. Your Rights

You may:

• Access your personal information by contacting us
• Correct inaccurate account information through the Service or by contacting us
• Delete your account by contacting your organization administrator or us directly
• Export your organization’s data by contacting us
• Revoke third-party integrations (e.g., Slack) through the Service settings

8. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact us at the address below.

9. International Users

The Service is hosted in the United States. If you access the Service from outside the US, your information will be transferred to and processed in the United States. If you are located in the European Economic Area or United Kingdom, please contact us regarding our Data Processing Agreement.

10. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Your continued use after changes take effect constitutes acceptance.

12. Contact

For privacy questions or requests:

Wren Logic LLC
james@wrenlogic.com