1. Data controller
Falmana is a service operated by Aloin Trade S.A.R.L., a company established in Morocco. For privacy questions or to exercise your rights, contact privacy@falmana.com.
2. Data we process
Depending on the features you use, Falmana may process:
- your account information, including your name, email address, technical identifiers, and workspace;
- information from the advertising accounts you choose to connect, including account identifiers, campaigns, budgets, ads, performance statistics, and action history;
- the OAuth permissions and tokens required to connect Google Ads and Meta Ads;
- your messages, instructions, strategies, objectives, approvals, and activity logs in the Ads Agent;
- images, logos, briefs, and other content you upload to the Creative Agent, as well as generated content;
- billing and subscription information. Full payment card details are processed by our payment provider and are not stored by Falmana;
- technical security and operational data, including IP address, browser, timestamps, errors, and request logs.
3. Data from Google APIs
When you connect Google Ads, Falmana requests the https://www.googleapis.com/auth/adwords scope. Based on your choices and Google Ads permissions, this allows Falmana to discover accessible accounts, read campaigns and performance, prepare recommendations, and execute actions you authorize.
Falmana uses Google data only to provide or improve the user-facing advertising features you request. We do not sell this data, use it for independent targeted advertising, or use it to train a general-purpose artificial intelligence model.
Falmana’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
4. Purposes and legal bases
We process this data to create and secure your account, provide requested services, synchronize and analyze campaigns, execute approved actions, produce creative content, manage billing, prevent abuse, provide support, and comply with legal obligations.
Depending on the circumstances, processing is based on performing our contract with you, your consent during an OAuth connection, our legitimate interests in security and service improvement, or a legal obligation.
5. Sharing and service providers
Falmana does not sell your data. When necessary to provide the service, data may be processed by providers supporting hosting, databases, authentication, content generation, video rendering, payments, and technical monitoring, including Supabase, Vercel, Google, Meta, OpenAI, fal.ai, Shotstack, and Lemon Squeezy.
These providers act under their own terms or as processors. Some data may be processed outside your country; where required, we apply appropriate contractual and technical safeguards under applicable law.
6. Security and retention
Advertising platform tokens are encrypted before storage. Access is restricted by workspace, user files are stored in private locations, and sensitive actions are logged. Despite these measures, no Internet-connected system can guarantee absolute security.
We retain data for as long as necessary to provide Falmana, protect the service, resolve disputes, and meet our obligations. After account closure or a deletion request, data is deleted or anonymized within a reasonable period, subject to legal requirements and backup cycles.
7. Your choices and rights
You may request access, correction, portability, restriction, or deletion of your data, and withdraw consent where processing relies on it. Email privacy@falmana.com from the address associated with your account.
You can revoke Google access from your Google Account connections. You can also revoke Meta access from your Meta account’s business integration settings. Revocation prevents new access without affecting processing already performed lawfully.
Data subjects may also use the remedies available under Moroccan Law No. 09-08 through the CNDP and, where the GDPR applies, through their competent supervisory authority.
8. Cookies, children, and changes
Falmana uses storage mechanisms that are strictly necessary for authentication, security, and service operation. Any non-essential analytics tools will be subject to the choices required by applicable law.
The service is intended for adult professionals and is not directed to children. We may update this policy to reflect product or regulatory changes. The update date will appear at the top of this page, and we will provide appropriate notice of material changes.