How Copyweb handles your data.

Copyweb is the trading name for the marketing AIOS practice operated by Liam Petersen and Jensen Grebe. We build creative-testing and content systems for DTC e-commerce and CPG brands. This policy covers the website at copyweb.io, our application form, our internal tooling (CopyAds, Mission Control), and the work we do directly with clients.

Visitors browsing copyweb.io

We collect minimal analytics from our hosting provider (Vercel) — page views, country, referrer, device class. No third-party tracking pixels, no Facebook Pixel on the site itself, no Google Analytics.

Applicants who submit /apply

When you fill in the application form we collect: name, email, company name, website, role, team size, annual revenue band, the tier you're interested in, and any notes you share. This goes into our internal Supabase database and triggers an email to liam@copyweb.io. We use it to respond to your application and nothing else.

Clients who engage us

During the Diagnostic and Build phases of a paid engagement, we may receive access to your Meta Business assets (ad accounts, Pages, datasets/pixels) via a Meta system user token you assign to us. We use this access to read your creative library, performance metrics, audience signals, and to push paused test ads back to your account for your review. We never create active ads on your behalf.

We may also receive copy of your brand assets (logo files, product photography, voice samples, customer research) so we can build your creative system. We treat these as your property at all times.

• To respond to applications and run the sales conversation.
• To analyse your current creative and performance during a Diagnostic.
• To generate new ad concepts using your brand assets as the source of truth.
• To push paused test ads to your Meta ad account for your review.
• To improve our internal tooling, in aggregate. We never train external AI models on your specific brand data.
• To send you operational emails (your applications, our deliverables, billing). We don't run a marketing email list.

We rely on a small set of vendors to run the business. Each touches a specific slice of data and is bound by their own terms.

• Vercel — hosts copyweb.io and our internal dashboards. Sees page-view-level analytics.
• Supabase — stores application form submissions and Mission Control internal records.
• Resend — delivers transactional emails (application confirmations, deliverable handoffs).
• Anthropic — runs the AI vision analysis on creative imagery. We pass individual ad images to Claude for structured analysis; Anthropic does not retain inputs for training under our API contract.
• Kie.ai — runs image generation for new ad variants. We pass seed creatives + prompts; outputs come back to us and never go elsewhere.
• Meta (Marketing API) — when a client grants us system user access we read their ad library, performance metrics, Page data, and pixel/dataset references. We write paused ads back to their account.
• Cal.com — handles strategy-call scheduling. Sees only the data you enter on the booking form.

We don't share client ad-account data with any party not in the above list. We don't sell or rent any data.

Most analysis work runs on Liam's local machine via our internal tool (CopyAds). Client ad-account data is pulled from Meta into a local SQLite database, processed locally, and never uploaded to a multi-tenant cloud. Deliverables (briefs, generated creatives, scope docs) are written to client folders that you receive copies of.

Supabase data is hosted in their default region (US East). Vercel routes through their global edge network. Resend processes email via SendGrid-class infrastructure.

You can, at any time, email liam@copyweb.io to:

• See what information we hold about you or your brand.
• Request deletion of your application or any project files we hold.
• Revoke our Meta system user access — this is also done directly inside Meta Business Settings on your end and takes effect immediately.
• Ask us to correct anything that's wrong.

We respond to requests within 5 business days. If you're in the EEA, UK, or California, your GDPR/CCPA rights apply in full — including portability and the right to lodge a complaint with your local supervisory authority.

Application form submissions are retained for 12 months from submission, then archived. Active client deliverables are retained for the duration of the engagement plus 24 months. Internal performance data used to improve our tooling is retained indefinitely in aggregate (no client-identifying signals).

API keys live in our local .env files and a gitignored secrets folder — never in source repositories or shared documents. Meta system user tokens, Anthropic keys, Kie.ai keys, and Supabase credentials are stored separately and rotated when an engagement ends.

We have a pre-commit hook that blocks accidental key commits. We do not use shared password managers for client credentials. When client engagements end, we destroy our local copies of brand assets unless you ask us to retain them for ongoing work.

Copyweb is a B2B service for brands. We don't knowingly collect data from anyone under 18. If you believe we have, contact us and we'll delete it.

Copyweb serves clients globally. Our team operates remotely and our infrastructure runs primarily on US-based providers (Vercel, Supabase, Anthropic, Kie.ai). By engaging with us you understand that your data may be processed in the United States and in other jurisdictions where our service providers operate. Where required by law, we operate under the appropriate transfer mechanisms (e.g. Standard Contractual Clauses for EEA data).

We update this policy when our practices change materially. The "Last updated" date at the top reflects the most recent change. We'll notify active clients by email when a change materially affects how we handle their data.

Questions, deletion requests, or anything else about your data: liam@copyweb.io

Liam Petersen, Copyweb.