Privacy Policy

We collect only what we need to run your ad campaigns:

• Account details. Your email address (for passwordless magic-link sign-in) and your organization profile.
• Website content. When you enter your website URL, we scrape its public pages to understand your business, offers, and brand so our agent can write relevant ad copy.
• LinkedIn data. When you connect LinkedIn, we receive an OAuth access token and the account, organization, and campaign data you authorize us to manage. The exact fields, and how we handle them, are itemized in Section 4.
• Campaign & performance data. Campaigns, creatives, budgets, targeting, and performance metrics returned by the LinkedIn Marketing API.
• Usage data. Basic logs and diagnostics needed to operate and secure the service.

We use your information only for the purposes disclosed to you and authorized when you connect your account:

• To research your business and generate ad creatives and campaign strategy.
• To create, manage, and optimize LinkedIn campaigns within the limits you set.
• To display performance, leads, and recommendations in your dashboard.
• To authenticate you and secure your account.
• To operate, debug, and improve the service.

We do not use your data — including any LinkedIn data — for any purpose you have not been told about and agreed to, and we do not sell your personal data.

Veran relies on third-party services to function. Relevant data is shared with these providers only as needed to deliver the service:

• OpenAI — generates ad copy, strategy, and brand analysis from your website content.
• LinkedIn — creates and runs your campaigns; charges ad spend directly to your linked payment method.
• Firecrawl — scrapes your website content.
• Supabase — database, authentication, and storage.

Your website content and business details may be sent to these AI and infrastructure providers to produce campaign assets. We do not use your data to train third-party models beyond what is required to fulfill a request. LinkedIn Content is never sent to these providers except the campaign, creative, and budget details you direct us to send to LinkedIn itself — see Section 4.

This section describes how we handle data obtained through the LinkedIn Marketing API and LinkedIn OAuth (“LinkedIn Content”), in accordance with LinkedIn’s API Terms of Use.

What we access

• Sign-in identity (OpenID Connect). Your name and email address, used to identify you and enable sign-in.
• OAuth tokens. The access and refresh tokens that let us act in your ad account on your behalf.
• Ad accounts & organizations. The ad accounts and company pages you authorize us to manage, including their identifiers, names, and (where available) logo, follower count, and public company-page details used to inform your campaigns.
• Campaign data. Campaigns, creatives, budgets, targeting, lead-gen forms, and performance metrics for the accounts you connect.

How we use it

We use LinkedIn Content solely to provide the service to you — to build, launch, manage, and report on the ad campaigns in the account you connected. We do not use it for any other purpose.

What we store and cache

We store only what is necessary to operate your campaigns: your OAuth tokens (stored encrypted), the account and organization identifiers you authorize, and the campaign and performance data tied to your organization. We do not scrape LinkedIn, build a copy or cache of member profiles, or retain profile or connection data beyond the duration necessary to deliver the service. All LinkedIn Content is segregated by organization (database-level Row Level Security) so that it can be identified and selectively deleted on request.

Consent & re-authorization

We access your LinkedIn account only after you grant consent through LinkedIn’s OAuth screen, and only within the scopes you approve. When your access token expires, we must obtain your consent again before we can continue. You can withdraw consent at any time by disconnecting LinkedIn from the Settings page or by revoking Veran’s access from within your LinkedIn account settings.

Deletion

When you disconnect LinkedIn, delete your account, or otherwise request it, we immediately delete all LinkedIn Content collected on your behalf, including your OAuth and refresh tokens. We will likewise delete all LinkedIn Content if LinkedIn directs us to, or if we stop operating the service, except where retention is strictly required by law.

No third-party sharing

We do not sell, rent, lease, or otherwise disclose LinkedIn Content to any third party. In particular, we never share it with data brokers, advertising networks, or any party for their own use. The only transfers we make are (a) back to LinkedIn to run your campaigns, and (b) to the infrastructure providers in Section 3 that process data solely on our behalf under confidentiality obligations at least as protective as this policy.

We enforce tenant isolation so your data is never visible to other organizations (database-level Row Level Security scoped to your organization). OAuth tokens are stored encrypted, access keys are kept server-side only, and all LinkedIn requests are proxied through our backend rather than exposed to your browser. No system is perfectly secure, but we apply industry-standard safeguards.

We retain your data only for as long as your account is active and we need it to provide the service. You can disconnect LinkedIn or revoke authorization at any time from the Settings page; doing so triggers immediate deletion of the associated LinkedIn Content as described in Section 4. When you ask us to delete your account, we remove your personal data promptly, except where retention is required by law.

Depending on your jurisdiction (including under the GDPR and similar frameworks), you may have the right to access, correct, export, or delete your personal data, and to withdraw consent at any time. You can withdraw consent yourself by disconnecting LinkedIn from the Settings page (which immediately deletes your stored tokens). To delete your account and remaining personal data, or to exercise any other right, email us at the address below — we honor verified requests to delete LinkedIn Content immediately.

We may update this policy as the product evolves. Material changes will be reflected by the “Last updated” date above. Continued use after a change means you accept the revised policy.

Questions about this policy, or want to exercise your data rights? Email us at privacy@veran.ai.