Privacy Policy

1. Who we are and what this covers

Just Art Media (“Just Art Media”, “we”, “us”) is a performance marketing company based in New York, United States. We also build and publish software. This policy applies to:

• our website at justartmedia.com (the “Website”);
• mobile and desktop apps we publish through Apple’s App Store, including apps for iPhone, iPad, Mac, Apple Watch, Apple TV and Apple Vision Pro;
• apps and integrations that connect to Meta products, such as Facebook Login, Facebook Pages, Instagram, WhatsApp Business, Messenger and the Meta Marketing API;
• apps we publish for Shopify merchants, including through the Shopify App Store;
• the support, email and other communications connected to any of the above.

We call these together the “Services”, and each app an “App”. An App may show a short, app-specific privacy notice in its store listing or inside the App. That notice adds detail about that App; it never reduces the protections described here.

For most of the Services, Just Art Media decides how and why personal information is used and is the “controller” (or “business”) for it. In some cases we handle information only on behalf of a customer, such as a Shopify merchant or a business that connects its Meta assets to an App. In those cases the customer is the controller and we act as its “processor” (or “service provider”). Sections 6 and 7 explain where that applies.

2. The short version

• We collect only the information an App or the Website needs to do its job.
• We do not sell personal information for money.
• We do not sell, license or hand to data brokers any information we receive from Apple, Meta or Shopify.
• We do not track you across other companies’ apps and websites from our Apple apps unless you give permission through Apple’s tracking prompt.
• You can ask us to access, correct, export or delete your information at any time. See Deleting your data.
• Questions go to privacy@justartmedia.com.

3. Information we collect

What we collect depends on which Service you use and how you use it. No single App collects everything listed here.

3.1 Information you give us

• Contact form. When you send an inquiry through the Website we collect your name, email address, company (optional), the services you are interested in (optional), your monthly ad spend range (optional) and your message.
• Account details. If an App has accounts, we collect what you provide to create one, such as your name, email address, phone number, password (stored only as a salted hash) and profile settings.
• Content you create or upload. Text, images, video, audio, files and other content you add to an App, plus anything you send us in a support request, survey or feedback form.
• Purchase information. What you bought, when, the price, and your subscription status. Payments are processed by Apple, Shopify or another payment provider. We do not receive or store your full card number.
• Communications. Emails and messages you exchange with us, and your preferences for receiving them.

3.2 Information collected automatically

• Device and app information. Device model, operating system version, app version, language, time zone, screen size and similar technical details.
• Identifiers. An account or installation ID we generate, a push notification token if you allow notifications, and, only where you have given permission, your device’s advertising identifier.
• Usage information. Which screens and features you use, the actions you take, session times and how you arrived at a Service.
• Diagnostics. Crash reports, error logs and performance measurements.
• Network information. IP address, approximate location inferred from it (country, region or city), browser type and referring page.
• Cookies and similar technologies on the Website, described in section 8.

3.3 Information from device permissions

Some Apps ask for access to device features such as the camera, microphone, photo library, contacts, calendar, precise location, Bluetooth or notifications. An App asks only when a feature needs it, your operating system shows the request, and you can refuse or later withdraw access in your device settings. Refusing may switch off the related feature but not the rest of the App.

3.4 Information from other companies

• Sign-in providers. If you sign in with Apple, Facebook, Google or another provider, we receive the profile details that provider shares with your consent, typically a user ID, name and email address.
• Platforms you connect. When you connect a Meta or Shopify account to an App, we receive the information described in sections 6 and 7, limited to the permissions you approve.
• App stores. Apple and Shopify send us transaction and subscription status information so we can unlock what you paid for.
• Advertising and measurement partners. Aggregated or event-level information about whether an ad led to a visit, an install or a purchase.

3.5 Sensitive information

We do not ask for sensitive information such as government ID numbers, health data, biometric data, precise location, or details about your race, religion, sexual orientation or political opinions unless a specific App feature needs it. If one does, the App will tell you clearly beforehand and ask for your consent where the law requires it. Please do not include sensitive information in contact forms or support messages.

4. How we use information

We use personal information to:

• provide, maintain and secure the Services and the features you ask for;
• create and manage accounts, and verify who you are;
• process purchases and subscriptions and restore them on a new device;
• answer inquiries and provide support;
• send service messages such as receipts, security alerts and notices about changes to an App or to this policy;
• send marketing messages where you have agreed to them or the law otherwise allows, with an unsubscribe option in each one;
• understand how the Services are used so we can fix problems and improve them;
• measure and improve our own advertising;
• detect, investigate and prevent fraud, abuse and security incidents;
• comply with the law, respond to lawful requests and enforce our terms.

We do not make decisions about you that have legal or similarly significant effects using automated processing alone.

4.1 Legal bases (EEA, UK and Switzerland)

Where the GDPR or a similar law applies, we rely on these legal bases:

5. Apps on Apple platforms

This section applies to Apps distributed through Apple’s App Store or TestFlight.

• App privacy details. Each App’s App Store page lists the data types that App collects and whether they are linked to you or used to track you. Those details and this policy are meant to be read together.
• Tracking. We do not track you across apps and websites owned by other companies, and we do not access your device’s advertising identifier (IDFA), unless you choose “Allow” in Apple’s App Tracking Transparency prompt. You can change this at any time in Settings > Privacy & Security > Tracking. Declining does not limit the App’s features.
• Sign in with Apple. If an App offers it, we receive a stable user identifier from Apple and, if you choose to share them, your name and email address. If you use Hide My Email we receive only Apple’s relay address.
• Purchases. In-app purchases and subscriptions are billed by Apple. We receive transaction identifiers, product identifiers and subscription status, not your payment card details. You manage or cancel subscriptions in your Apple Account settings.
• Permissions. Access to the camera, photos, microphone, location, contacts, notifications and similar features is requested only when needed, with an explanation of why, and can be revoked in Settings.
• Push notifications. If you allow them, we store a device token issued by Apple so we can deliver notifications. Turn them off in Settings > Notifications.
• Health, home and similar data. If an App ever uses HealthKit, HomeKit or comparable Apple frameworks, the data from them is used only to provide that feature. It is never used for advertising or marketing, never sold, and never shared with third parties without your explicit permission.
• Account deletion. Any App that lets you create an account also lets you start deleting that account, and the data tied to it, from inside the App, normally under Settings > Account > Delete Account. See section 11.
• Third-party code. Software development kits and service providers used in our Apps may only process your information as described in this policy and must give it the same or equal protection as this policy and Apple’s App Review Guidelines require.

To withdraw consent you gave inside an App, change the relevant setting in the App or in your device Settings, or write to us at privacy@justartmedia.com.

6. Apps on Meta platforms

This section applies when an App uses Meta products or APIs, for example Facebook Login, the Graph API, the Marketing API, Instagram, Messenger or the WhatsApp Business Platform. We call the information we receive from Meta “Platform Data”.

6.1 What we receive

Only what the App needs and only after you approve the permissions Meta shows you. This can include:

• your Meta user ID, name, email address and profile picture;
• the Pages, Instagram professional accounts, ad accounts, business portfolios, catalogs, pixels and WhatsApp Business accounts you choose to connect;
• content and performance data for those assets, such as posts, comments, campaigns, ad sets, ads, audiences, spend and insights;
• leads submitted through your lead ad forms;
• messages sent to your business through Messenger, Instagram or WhatsApp, where the App handles them;
• access tokens that let the App act with the permissions you granted.

6.2 How we use Platform Data

• We use Platform Data only to provide and improve the App features you use.
• We do not sell, license or purchase Platform Data.
• We do not share Platform Data with data brokers, ad networks or monetization services.
• We do not use Platform Data to build or enrich profiles unrelated to the App, to make eligibility decisions (about housing, employment, insurance, education, credit, government benefits or immigration status), to discriminate, or for surveillance.
• We share Platform Data only with service providers that process it for us under written terms, when you direct us to, or when the law requires it.
• We handle Platform Data in line with the Meta Platform Terms and Developer Policies.

6.3 Data about other people

When a business connects its Meta assets to an App, the App may process information about that business’s own customers, such as leads, commenters and people who message the business. The business is the controller of that information and we process it on the business’s instructions. If you are one of those people, contact the business first; we will help it respond to your request.

6.4 Removing access and deleting Platform Data

You can disconnect an App at any time from Facebook under Settings & privacy > Settings > Apps and websites, or from the App’s own settings. Disconnecting stops new data from reaching us. To have the Platform Data we already hold deleted, follow the steps in Deleting your data. We also delete Platform Data when Meta asks us to, when it is no longer needed for the App, or when we stop operating the App.

7. Apps for Shopify

This section applies to Apps that merchants install on their Shopify stores. “Merchant” means the store owner and their staff; “Customer” means a person who visits or buys from a Merchant’s store.

7.1 Our role

The Merchant is the controller of its store data and of its Customers’ personal information. Just Art Media processes that information as a processor (service provider) on the Merchant’s behalf, to provide the App. We are the controller only of the limited information we need to run our relationship with the Merchant, such as account, billing and support records.

7.2 What an App may access

Each App requests only the Shopify access scopes it needs. The exact scopes are shown on the install screen before a Merchant approves them.

7.3 How we handle Shopify data

• We use it only to provide, support and improve the App for that Merchant.
• We do not sell Merchant or Customer information, and we do not use it for our own advertising.
• We request the minimum level of access to Customer information that a feature needs.
• We encrypt Shopify data in transit and encrypt Customer personal information at rest, limit staff access to people who need it, and keep access logs.
• We respect Customers’ marketing and data-sharing choices that Shopify passes to the App, including consent and opt-out signals.

7.4 Privacy requests and uninstalling

Our Apps subscribe to Shopify’s mandatory privacy webhooks and act on them:

• Customer data request (customers/data_request). When a Customer asks a Merchant for their data, we give the Merchant the information the App holds about that Customer.
• Customer redaction (customers/redact). When a Merchant asks for a Customer’s data to be erased, we delete or irreversibly anonymize it within 30 days.
• Shop redaction (shop/redact). Shopify sends this 48 hours after a Merchant uninstalls an App. We then delete that store’s data, including Customer information, within 30 days.

We keep information past those periods only where the law requires it, for example billing records for tax purposes.

If you are a Customer of a store that uses one of our Apps, please send privacy requests to that store. It decides how your information is used, and we will support it in answering you. If you write to us directly, we will pass your request to the store.

8. Cookies, analytics and advertising

8.1 On the Website

The Website loads the Google Ads tag (gtag.js) from Google. It uses cookies and similar identifiers to measure whether our ads lead to visits and inquiries, and it may be used to show our ads to people who have visited the Website. Through it Google receives information such as your IP address, browser and device details, the pages you view and Google’s advertising cookie identifiers. Google’s use of this information is described in its Privacy Policy.

The Website’s fonts and other assets are served from our own domain, not from third-party font services.

8.2 In our Apps

Apps may include analytics and crash-reporting tools so we can see which features are used and fix faults. Apps that show ads or measure advertising follow the rules in section 5 on Apple’s tracking permission. Each App’s store listing identifies the data it collects for these purposes.

8.3 Your choices

• Block or delete cookies in your browser settings. The Website works without them.
• Control Google’s ad personalization at My Ad Center.
• On iPhone and iPad, manage tracking under Settings > Privacy & Security > Tracking. On Android, reset or delete your advertising ID under Settings > Privacy > Ads.
• Email privacy@justartmedia.com to opt out of our use of your information for advertising.

9. Who we share information with

We do not sell personal information for money. We share it only in these cases:

• Service providers that process information for us under contracts requiring confidentiality and appropriate security. They fall into these categories: cloud hosting and content delivery, databases and file storage, email delivery, analytics and crash reporting, customer support tools, payment and subscription management, and advertising measurement. The Website is hosted by Vercel, its contact form emails are delivered by Resend, and its advertising measurement is provided by Google.
• Platforms. Apple, Meta and Shopify receive information as part of running their platforms, for example when you sign in, make a purchase, or when an App writes data back to your connected account at your request. Their own privacy policies govern what they do with it.
• At your direction. When you ask an App to send information to another service or person.
• Professional advisers such as lawyers, accountants and auditors, under duties of confidentiality.
• Legal and safety reasons. When we believe in good faith that disclosure is required by law or a valid legal process, or is needed to protect the rights, property or safety of our users, the public or Just Art Media.
• Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of it. The recipient must honor this policy or give you notice and a choice before changing how your information is used.

We may share information that has been aggregated or de-identified so that it cannot reasonably identify you.

10. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete or anonymize it.

11. Deleting your data

You can ask us to delete your personal information at any time, whichever Service you used. This section also serves as our data deletion instructions for Apps on Meta platforms.

11.1 How to request deletion

1. From inside an App. If the App has accounts, open Settings > Account > Delete Account and confirm. This starts deletion of your account and the data linked to it.
2. By email. Write to privacy@justartmedia.com with the subject “Data deletion request”. Tell us which App or Service you used and the email address, account ID or Meta user ID connected to it, so we can find your records.
3. For Facebook or Instagram connections. In Facebook, go to Settings & privacy > Settings > Apps and websites, select the App and choose Remove. Then send us the email in step 2 if you also want the data we already hold erased.
4. For Shopify Apps. Merchants can uninstall the App from their Shopify admin under Settings > Apps and sales channels; store data is then deleted as described in section 7.4. Customers should contact the store they bought from.

11.2 What happens next

• We may ask for information to confirm the request comes from you or someone authorized by you.
• We confirm receipt and complete deletion within 30 days, and tell you when it is done.
• Deletion covers our live systems and our service providers’ systems. Copies in backups are overwritten on the cycle described in section 10.
• We may keep limited information where the law requires or permits it, for example transaction records for tax purposes or records needed to resolve a dispute or prevent fraud. We will tell you if that applies.
• Deleting an account does not cancel a subscription billed by Apple or Shopify. Cancel it in your Apple Account settings or Shopify admin.

12. Your privacy rights

Depending on where you live, you have some or all of the rights below. We do not charge for requests and we will not treat you differently for making one. To use any of them, email privacy@justartmedia.com. We respond within 30 days, or sooner where the law requires.

12.1 Everyone

• Ask what personal information we hold about you and receive a copy.
• Ask us to correct information that is wrong or incomplete.
• Ask us to delete your information.
• Unsubscribe from marketing emails using the link in any of them.
• Withdraw device permissions and consent you have given.

12.2 European Economic Area, United Kingdom and Switzerland

Under the GDPR and UK GDPR you also have the right to restrict or object to our processing, including objecting to processing based on legitimate interests and to direct marketing; the right to data portability; and the right to withdraw consent at any time without affecting earlier processing. You may lodge a complaint with your local data protection authority, though we would appreciate the chance to resolve your concern first.

12.3 United States

Residents of California and of other states with comprehensive privacy laws have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to receive it in a portable format; to opt out of the sale of personal information, of its sharing for cross-context behavioral advertising and of targeted advertising; and to appeal if we decline a request.

• In the past 12 months we have collected the categories described in section 3: identifiers, commercial information, internet and device activity, approximate geolocation, user content, and inferences drawn from usage.
• We have not sold personal information for money.
• Our use of the Google Ads tag on the Website may count as “sharing” identifiers and internet activity for cross-context behavioral advertising, or as “targeted advertising”. To opt out, use the choices in section 8.3 or email us.
• We do not use or disclose sensitive personal information for purposes that require a right to limit.
• We do not knowingly sell or share the personal information of anyone under 16.
• You may use an authorized agent to make a request. We will ask for proof of the agent’s authority.
• To appeal a decision, reply to our response and write “Appeal” in the subject line.

12.4 Brazil

Under the Lei Geral de Proteção de Dados (LGPD) you have the right to confirm that we process your data; to access, correct, anonymize, block or delete it; to data portability; to information about who we share it with; to withdraw consent; and to complain to the Autoridade Nacional de Proteção de Dados (ANPD).

12.5 Other regions

If the privacy law where you live gives you rights not listed here, we will honor them. Contact us and tell us where you are located.

13. International transfers

Just Art Media is based in the United States and works with team members and service providers in other countries. Your information may be processed in the United States and in countries whose data protection laws differ from those where you live. When we transfer personal information out of the EEA, the United Kingdom, Switzerland or Brazil, we rely on a recognized safeguard, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision. You can ask us for details of the safeguard that applies to your information.

14. Security

We protect personal information with measures appropriate to its sensitivity, including:

• encryption in transit using TLS, and encryption at rest for databases holding personal information;
• access limited to people who need it for their work, protected by multi-factor authentication;
• separate production and development environments, with no real personal data used for testing;
• logging and monitoring of access to systems that hold personal information;
• review of the service providers we rely on.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities, and Apple, Meta or Shopify where their terms require it, without undue delay and within the time the law sets.

15. Children

The Services are intended for adults and are not directed to children under 13, or under 16 in the EEA and United Kingdom. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it. If we ever publish an App intended for children, it will have its own privacy notice and will follow the laws and platform rules for children’s apps, including obtaining parental consent where required.

16. Changes to this policy

We may update this policy as our Services or the law change. We will post the new version here and change the “Last updated” date at the top. If a change materially affects how we use personal information, we will give notice in the affected App or by email before it takes effect, and ask for your consent where the law requires it.

17. Contact us

For questions, requests or complaints about privacy:

Please tell us which App or Service your message is about so we can reply quickly.