Privacy Policy

• Account details: your email, name (if you give it) and how you sign in (password, email link or Google).
• Your website: the URL you enter and the public content of that page (title, description, headings and text), plus what we derive from it — product summary, audience, offers, tone and niche.
• Setup choices: your plan, daily ad budget, niche confirmation and notification preferences.
• Billing: Stripe processes your card. We store your Stripe customer ID, plan, subscription status and payment outcomes — never your full card number.
• Campaign data: campaign status, budgets and performance (impressions, clicks, spend) from the ad account you give us access to.
• Activity log: key actions like approvals, plan changes and launches, kept as an audit trail.
• Technical data: standard server logs (IP address, browser, timestamps) for security and debugging.

To find the messages that already sell we analyze publicly available ads from sources such as Meta's Ad Library: ad text, advertiser page names and run dates. We use them to identify patterns. We don't copy them into your ads.

• To analyze your site, write your ads and run your campaigns.
• To bill your subscription and send service emails (receipts, payment issues, reports, digests).
• To review ads for policy compliance and keep the service secure.
• To improve our niche mapping and message research, using aggregated data.

We don't sell your personal data and we don't use it for third-party advertising.

• Lovable Cloud (Supabase) — hosting, database and sign-in.
• Cloudflare — website hosting and delivery.
• Stripe — payments and billing portal.
• OpenAI (API) — analyzing your site and drafting ad copy.
• Resend — transactional email.
• Google — only if you choose to sign in with Google.
• Meta — public Ad Library data (we send search terms, not your personal data).

Each processes data only to provide its service to us. Your OpenAI ad account itself is covered by OpenAI's privacy policy.

• Free analyses you don't sign up for: deleted after 30 days.
• Your account, reports and creatives: kept while your account exists, including after you cancel, so you can still read them. Delete them any time by asking us.
• Billing records: kept as long as tax and accounting law requires (usually up to 7 years).
• Server logs: up to 90 days.

When you ask us to delete your account, we delete or anonymize your data within 30 days, except records we must keep by law.

We use your browser's storage to keep you signed in and to remember a free analysis you started before creating an account. We don't use advertising trackers.

You can ask to access, correct, export or delete your data, or object to how we use it. Email ricky@trysecondwin.com and we'll respond within 30 days. You can remove our access to your OpenAI ad account at any time from that account.

Data is encrypted in transit, access is limited to the people who run your account, and each customer can only read their own data. No system is perfectly secure; if a breach affects you, we'll tell you promptly.

SecondWin is for businesses and is not meant for anyone under 18.

If we change this policy in a meaningful way, we'll email you before it takes effect. SecondWin is not affiliated with OpenAI. ChatGPT is a trademark of OpenAI.