Privacy Policy

Digital Evolution Marketing Group (“DEMG,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what information we collect through demg.ai (the marketing website) and dashboard.demg.ai (the ACE client portal and related tools, together with demg.ai, the “Services”), how we use and share it, and the choices you have. By using the Services, you agree to this Policy. It works together with our Terms & Conditions.

1. Information we collect

Information you give us. We collect information you provide directly, including when you:

• Complete a contact or inquiry form (such as your name, email, company, and message details);
• Schedule a call through our booking tool (such as your name, email, phone number, and scheduling details);
• Create an account or sign in to the ACE portal (such as your name and email);
• Begin or complete onboarding (such as business and contact details, services of interest, project information, brand or site URLs, and files or notes you provide);
• Connect third-party tools in ACE Integrations (for example, publishing destinations, Google Search Console, Analytics or Google Ads, Facebook Pages, Instagram accounts, Meta ad accounts, or other social and advertising platforms — see section 3);
• Subscribe to newsletters or marketing emails;
• Communicate with us by email or otherwise.

2. Google account connections (Search Console and Analytics)

If you (or an authorized teammate) choose Connect with Google in ACE for Google Search Console or Google Analytics, we ask Google for read-only access using these scopes:

• https://www.googleapis.com/auth/webmasters.readonly (Search Console)
• https://www.googleapis.com/auth/analytics.readonly (Google Analytics)

With your authorization, we may receive: your Google account email; OAuth tokens needed to call Google’s APIs on your behalf; and property metadata and performance data you select (for example, Search Console queries, pages, clicks, impressions, and position, and Analytics traffic and engagement metrics for the linked property).

We do not request write access to change your Search Console or Analytics settings, content, or properties. You can disconnect Google at any time in ACE Integrations (and revoke access in your Google Account permissions). OAuth refresh tokens are encrypted before storage and used only to provide the Services described below. The same Google OAuth client may also power “Sign in with Google” for the ACE portal via our authentication provider; that sign-in flow is separate from Search Console and Analytics Connect.

Publishing and CMS credentials you paste. If you connect a publishing destination (for example Supabase, Netlify, WordPress, or similar), you may paste credentials such as API URLs, service keys, or personal access tokens. Those secrets are stored in our portal vault for your client workspace, used to draft or publish content you Approve, and are not placed in public git Brain files or shared across unrelated clients.

Information we collect automatically. When you visit the Services, we and our providers may automatically collect technical information such as IP address, browser type, device information, pages viewed, referring URLs, and dates and times of visits, through cookies and similar technologies (see “Cookies and tracking” below). We do not intentionally collect sensitive personal information through the marketing site, and we ask that you not submit it there.

3. Advertising and social media connections (Meta, Google Ads and others)

If you (or an authorized teammate) choose Connect for an advertising or social media account in ACE Integrations, you authorize DEMG to access that platform’s official API on your behalf. We then pull live data from the accounts you select into your ACE workspace, where it is analyzed, reported on, and made available for your review. We use each platform’s own sign-in and consent screen, so you see the permissions we request before you grant them. We only access the Pages, profiles, and ad accounts you choose on that screen, and you can disconnect at any time.

Connected data is refreshed automatically on a regular schedule (typically daily). It is also refreshed when you or DEMG request an update in ACE. Your data stays current until you disconnect.

Meta (Facebook and Instagram)

With your permission, we may receive:

• Facebook Pages you manage: Page name, ID, and profile details; posts, photos, videos, and reels; Page and post insights such as reach, impressions, engagement, video views, and follower counts; and comments and replies on your posts.
• Instagram professional accounts linked to those Pages: profile details, media, insights, and comments on your media.
• Meta ad accounts (Ads Manager) you select: account name, ID, status, and currency; campaigns, ad sets, ads, and creatives; campaign settings such as objectives, budgets, schedules, and targeting settings; and performance results such as spend, impressions, reach, clicks, click-through rate, cost per result, conversions, and return on ad spend. Meta reports ad results in aggregate. We do not receive the identities of the individual people who saw or clicked your ads.
• Business portfolio (Business Manager) details: the names and IDs of the businesses, Pages, and ad accounts you can access, so you can choose which ones to connect.

Depending on the features you turn on, we may request these Meta permissions: pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_engagement, read_insights, instagram_basic, instagram_manage_insights, instagram_manage_comments, ads_read, and business_management. We request only the permissions a feature needs. We use pages_manage_engagement and instagram_manage_comments only to post comments as your Page or account on your own posts, never to change or remove anyone else’s comment.

Comments. ACE reads the comments on your connected Facebook Pages and Instagram accounts, so it can report on questions, feedback, and themes. With your permission, ACE can also post comments, as your Page or account, on your own posts, for example to answer a common question or add a follow-up.

Through the Meta connection, ACE does not:

• hide, delete, like, or edit any comment written by someone else;
• publish new posts;
• send direct messages;
• create or edit ads, campaigns, audiences, or budgets; or
• change your Page or account settings.

If we add any of these features later, we will request that permission separately and update this Policy first.

People who comment on your posts. Comments come from members of the public, not only from our clients. When you connect a Page or Instagram account, we process each commenter’s public name or username, platform ID, and comment content. We use this only to:

• show the comment to you; and
• identify common questions and themes for your marketing.

We never hide, delete, or edit their comments. We do not contact commenters outside the platform, build profiles of them, or use their information for any other client.

Meta Platform Terms. DEMG complies with Meta’s Platform Terms and Developer Policies for all data received from Meta. We do not sell, license, or purchase Meta platform data. We do not share it with data brokers or ad networks. We do not use it to decide anyone’s eligibility for housing, employment, credit, insurance, or similar opportunities, or for surveillance.

Google Ads

If you connect Google Ads, we request the Google Ads API scope https://www.googleapis.com/auth/adwords. Google offers only this one scope for the Google Ads API.

With your authorization, we may receive:

• Accounts: customer IDs, account names, and manager-account structure.
• Campaign structure: campaigns, ad groups, ads, and assets; keywords and search-term reports.
• Settings: budgets, bidding, and targeting settings.
• Results: spend, impressions, clicks, conversions, and other performance metrics for the accounts you select.

We use this access only to read and analyze your Google Ads data for review and reporting. We do not create, edit, pause, or remove campaigns, ads, keywords, bids, or budgets in your Google Ads account.

Google Ads data is Google user data. DEMG complies with the Google Ads API Terms and Conditions and with the Google API Services User Data Policy (section 7). You can revoke access at any time at myaccount.google.com/permissions.

Other platforms: TikTok, X, LinkedIn, YouTube, Pinterest, Microsoft Advertising, and others

We plan to offer connections for other platforms. They include:

• TikTok (accounts and TikTok Ads Manager);
• X (formerly Twitter), including X Ads;
• LinkedIn (Company Pages and Campaign Manager);
• YouTube;
• Pinterest; and
• Microsoft Advertising.

When you connect one of these, the same approach applies:

• We use the platform’s official API and consent screen, and access only the accounts you select.
• We pull live data into ACE for analysis, reporting, and review. Depending on the platform, this can include profile or Page details; posts and videos; follower, reach, and engagement analytics; ad account structure, spend, and performance metrics; and comments on your content.
• Where a platform supports it and you grant the permission, ACE may post comments as your account on your own content. It never hides, deletes, or edits comments written by anyone else.
• We do not receive the identities of the individual people who saw or engaged with your ads beyond what the platform makes public, such as a commenter’s public name.

Before each new connection becomes available, we will list its specific permissions in this section. Each platform’s own privacy policy governs how that platform handles your data.

How we use live advertising and social data

We use data from connected advertising and social accounts only to provide ACE to your workspace:

• dashboards and reports, including monthly and strategy reports;
• comparing paid and organic performance across channels;
• finding content ideas in your posts and in the questions people ask in comments;
• recommendations on creative, targeting, and budget, for you to review and decide on;
• comments posted as your account on your own posts; and
• improving your workspace’s Marketing Brain (see below).

Your Marketing Brain learns from your data. ACE keeps a knowledge base for each client workspace, called the Marketing Brain. It holds your brand, audience, offers, voice, and what has worked. ACE updates your Brain from what your connected accounts show, and from the content you approve and edit. For example, it records which topics, formats, and messages perform best with your audience, and the questions people ask most often. Your content and recommendations improve over time because of this. That learning is specific to your workspace:

• it is not shared with other clients;
• it is not used to improve any other client’s workspace; and
• it is not used to build or train general-purpose AI models.

ACE uses AI models to analyze this data, draft reports and content, and update your Brain. Service providers run these models on our behalf, under agreements that prohibit them from using your data to train their own models. We do not use data from Google or Meta to develop, improve, or train generalized or non-personalized AI or machine-learning models. Data from your connected accounts is used only for your own workspace.

Your controls

• Choose what to connect. You select which Pages, profiles, and ad accounts ACE can access. You can change that selection at any time.
• Turn features off. You can turn off posting comments in ACE and keep read-only reporting.
• Disconnect in ACE. Use ACE Integrations. We stop pulling data immediately and delete the access tokens.
• Revoke on the platform. For Meta, go to Facebook Settings → Security and login → Business integrations, and remove DEMG. For Google, visit myaccount.google.com/permissions. Each other platform provides a similar setting.

Data deletion requests

To delete the data we received from Meta, Google, or any other connected platform:

1. Disconnect the account in ACE Integrations, or remove DEMG in the platform’s settings; and
2. Email support@demg.io with the subject “Data deletion request”. Include the business name and the Page or ad account involved.

We will confirm your request and delete the data we hold from that connection within 30 days. This includes stored posts, comments, insights, ad data, access tokens, and the insights your Brain learned from that data. We keep information only where the law requires us to keep it.

4. How we use your information

We use the information we collect to:

• Respond to inquiries and communicate with you;
• Schedule and prepare for calls and deliver marketing services you request;
• Operate, maintain, secure, and improve the Services, including ACE (strategy reports, Brain/onboarding, content planning, drafting, human Approve workflows, and publishing);
• Use connected Google Search Console and Analytics data to analyze performance, inform content and SEO strategy, and generate reports inside ACE for your workspace;
• Use connected advertising and social media data (such as Meta, Google Ads, and other platforms you connect) to build dashboards and reports, analyze paid and organic performance, and make recommendations for your review;
• Read comments on the Pages and accounts you connect for reporting and insight, and, where you grant permission, post comments as your Page or account on your own posts (we never hide, delete, or edit comments written by others);
• Update your workspace’s Marketing Brain from connected data and the content you approve and edit, so the content and recommendations ACE produces for you improve over time;
• Use connected publishing credentials only to create or update content in systems you designate, subject to your Approves and product settings;
• Send newsletters, updates, and marketing messages you have opted into (you can opt out at any time);
• Understand how visitors use demg.ai through analytics;
• Detect, prevent, and address security issues, fraud, or technical problems;
• Comply with legal obligations and enforce our Terms.

We do not use Google user data (from Search Console, Analytics, or Google Ads) or Meta platform data to serve ads to you or to unrelated third parties, and we do not sell that data.

5. Cookies and tracking technologies

We use cookies and similar technologies to operate the Services, remember preferences, and understand usage. These include:

• Essential cookies needed for the Services to function (including authentication on the ACE portal);
• Analytics and performance cookies — for example, through Google Tag Manager and Google Analytics on demg.ai — that help us measure traffic and improve content.

You can control cookies through your browser settings. Some features may not work if cookies are blocked. You can opt out of Google Analytics using Google’s opt-out browser add-on.

6. How we share your information

We do not sell your personal information. We share it only as described here:

• Service providers. Vendors that host or operate the Services for us (for example website hosting, databases, authentication, email, CRM, scheduling, payment processing, and analytics such as Netlify, Supabase, Google, and GoHighLevel). They may process information only on our behalf and consistent with this Policy.
• Google. When you Connect Google, Google’s processing of your Google Account data is governed by Google’s policies. We receive only what you authorize through the OAuth consent screen.
• Advertising and social platforms. When you connect Meta, Google Ads, or another platform, we exchange data with that platform to retrieve your data and, where you grant permission, to post comments as your account on your own posts. Each platform’s processing is governed by its own terms and privacy policy.
• AI and cloud processing providers. Vendors that run the AI models and infrastructure ACE uses to analyze data and draft content. They process data only on our behalf, and may not use it to train their own models.
• Legal and safety. When required by law, legal process, or to protect the rights, property, or safety of DEMG, our clients, or others.
• Business transfers. If DEMG is involved in a merger, acquisition, financing, or sale of assets.
• With your direction. When you ask us to or otherwise consent.

7. Google API Services User Data Policy

DEMG’s use and transfer to any other app of information received from Google APIs, including the Search Console, Analytics, and Google Ads APIs, adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve user-facing features that are prominent in ACE;
• We do not transfer Google user data to others except as necessary to provide or improve those features, for security, or as required by law;
• We do not use Google user data for serving advertisements;
• We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine-learning models;
• Human read access is limited to providing support, securing the Services, complying with law, or when you give clear consent.

8. Third-party links

The Services may link to third-party websites and tools we do not control. This Policy does not apply to those sites. Review their privacy policies before providing information.

9. Data retention

We keep personal information and connected-account data for as long as needed to provide the Services, maintain business records, and comply with law. OAuth tokens and connected property selections are retained until you disconnect the integration or close the relevant workspace, unless a longer period is required for security or legal reasons. When information is no longer needed, we take reasonable steps to delete or de-identify it.

Data pulled from connected advertising and social accounts is kept while the connection is active so that ACE can show trends over time. When you disconnect, we stop collecting immediately, delete the access tokens, and delete stored platform data (such as posts, comments, insights, and ad metrics) within 30 days. Reports already delivered to your workspace, and what your Marketing Brain has learned, may keep summary findings until you close the workspace or ask us to delete them. A data deletion request removes both.

10. Data security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption of secrets and OAuth tokens at rest where the product stores them. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your privacy rights

Depending on where you live, you may have rights including to access, correct, or delete personal information; opt out of marketing; and opt out of “sale” or “sharing” of personal information (we do not sell your personal information).

California residents. Under the CCPA/CPRA you may request to know, delete, or correct personal information, and to opt out of sale/sharing. We do not sell or share personal information as those terms are defined under California law, and we will not discriminate against you for exercising your rights.

Nevada residents. Nevada law allows opting out of certain sales of covered information. We do not sell covered information; you may still email support@demg.io.

To exercise rights, email support@demg.io. We may verify your identity and will respond within the time required by applicable law.

You may also revoke Google access at https://myaccount.google.com/permissions. You may revoke Meta access in Facebook Settings → Security and login → Business integrations, and access for other platforms in each platform’s app settings. See Data deletion requests in section 3.

12. Email and marketing choices

Opt out of marketing emails via “unsubscribe” or by emailing support@demg.io. We may still send non-marketing messages about your account, inquiries, or services.

13. Children’s privacy

The Services are not directed to children under 18, and we do not knowingly collect personal information from them. Contact us if you believe a child has provided information, and we will delete it.

14. Visitors outside the United States

DEMG is based in the United States. If you access the Services from outside the U.S., you understand your information may be processed in the United States, where laws may differ from those in your country.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date at the top. Material changes take effect when posted. Continued use of the Services means you accept the updated Policy.

16. Contact us

Digital Evolution Marketing Group
1005 Terminal Way, Suite 100
Reno, Nevada 89502
support@demg.io