Privacy Policy

This Privacy Policy describes how Amrak Integrated Marketing, Inc. (owner of the Passion+ brand and referred to herein as "Passion+," "we," "us," or "our"), collects, uses, shares, and protects information through (i) our marketing website at passionplusmedia.com and (ii) our self-service advertising application at wiz.passionplusmedia.com (the "Wizard" and, together with the marketing website, the "Services").

This Privacy Policy does not cover information about the consumers who see or interact with the advertisements that our advertisers run through the Services. Those consumers are subject to the privacy practices of the publishers whose websites and apps display the advertisements, and of the underlying programmatic platforms (including Magnite). For information about how those programmatic data flows work, see the IAB Transparency and Consent Framework and the privacy practices of the publishers where you saw a Passion+-served advertisement.

1. Who this Privacy Policy is for

This Privacy Policy applies to (a) visitors to passionplusmedia.com (whether or not you create an account); (b) users who create accounts on the Wizard and become Passion+ advertisers ("Advertisers"); and (c) representatives of organizations that we communicate with for business-development purposes.

2. Information we collect

We collect information in three ways: directly from you, automatically as you use the Services, and from third-party sources we engage to operate the Services.

2.1 Information you provide directly

• Account information. When you create a Wizard account, we collect your first name, last name, and email address. We use a passwordless "magic link" sign-in method, so we do not collect or store passwords.
• Business profile information. As part of creating a campaign, you provide information about your business, including your job title, company name, website URL, social media URLs, the products or services you are promoting, your competitors, and your intended audience.
• Campaign information. You provide a campaign budget, start and end dates, a destination URL, and creative materials (images and/or videos) that you upload.
• Payment information. Payment card and billing information is collected and processed by Stripe, Inc. ("Stripe"). We do not see or store your full payment card details; we receive only a payment-confirmation token and limited transaction metadata from Stripe.
• Communications. If you contact us by email, fill out a contact form, or subscribe to our marketing emails, we collect the information you provide in the message and your contact preferences.

2.2 Information collected automatically

• Device and usage information. When you visit the Services, we automatically collect IP address, browser type, operating system, device identifiers, the pages you view, the actions you take, and the dates and times of access.
• Cookies and similar technologies. We and our service providers use cookies and similar technologies to operate the Services, remember your settings, measure performance, and (on the marketing website) understand visitor interest in our offerings. You can manage cookies through your browser settings; disabling cookies may affect the Services' functionality.
• Wizard product analytics. We use PostHog to understand completion, reliability, and feature usage within the Wizard. We send intentionally defined product events and limited browser and device information. We configure PostHog to discard client IP addresses, disable automatic interaction capture and session replay, and avoid sending your Wizard responses, campaign-plan content, name, or email address as analytics event properties. PostHog may use browser local storage to maintain an analytics identifier across Wizard visits.
• Google Analytics. We use Google Analytics 4 to understand how people use the Services. Google Analytics may collect information through cookies and similar technologies, including pages viewed, actions taken, dates and times of access, approximate location derived from IP address, and browser, device, and operating-system information. When a Wizard campaign session is created or restored, whether before or after authentication, we also send Google Analytics an opaque internal identifier for that campaign session as a User-ID. The identifier is not your name, email address, or another value that directly identifies you to Google, but it allows us to associate activity connected with the same Wizard campaign session across visits and devices. A new campaign session receives a new identifier, so this identifier does not by itself deduplicate one account across different campaign sessions. We do not use Google Analytics' user-provided data feature to send Google your name, email address, or other directly identifying account information.
• Advertising measurement. On campaign landing pages such as our Fashion page, we use the OpenAI Ads Measurement Pixel and Conversions API to understand whether a visit from an advertisement in ChatGPT results in a demo request or a purchased plan. These tools may collect or receive an OpenAI-provided click identifier, a first-party measurement cookie, the page URL, event type and time, browser and device information, IP address, user agent, a unique event identifier, purchase amount and currency, and contact information that is normalized and hashed using SHA-256 before it is sent. We do not send OpenAI your name or raw email address through these measurement events.
• Pontiac conversion measurement. We also use conversion pixels from Pontiac Intelligence, a demand-side advertising platform operated by Programmatic Mechanics LLC and Pontiac Intelligence LLC, to measure visits to the Fashion page, completed demo requests, and purchased plans. When a Pontiac pixel loads, Pontiac may receive the pixel identifier, IP address, cookie or online identifier, browser request information, and the date and time of the event. We do not place your name, email address, form responses, purchase amount, or other directly identifying form data in the Pontiac pixel URL.

2.3 Information from advertiser conversion tracking

If you implement our optional postback conversion tracking, your servers send us conversion events that include the event type, conversion value (in cents), an optional order ID, and a hash of the converting visitor's IP address. We use a five-minute deduplication window based on token, event type, and IP hash.

The hashed IP is considered personal information under California Civil Code § 1798.140 and several other state privacy laws. We treat it accordingly.

2.4 Information from our service providers and partners

We receive limited information from our service providers (e.g., Stripe payment-confirmation tokens, email-deliverability metrics from our email-service provider) and from the programmatic platforms that operate the underlying advertising infrastructure (e.g., delivery and performance metrics from Magnite). We do not receive identifiable consumer profiles from these sources for the purposes of running your campaigns.

3. How we use information

We use the information described in Section 2 to:

• create and maintain your Wizard account;
• generate the Wizard's AI-assisted business persona and campaign plan based on your inputs (you can edit any field of the generated persona before launching);
• traffic, deliver, optimize, and report on your campaign;
• bill you for the Services and prevent fraud;
• communicate with you about your account, your campaigns, and the Services, including transactional emails (payment confirmations, pre-billing reminders, cancellation confirmations, and similar);
• send marketing communications, if you have opted in to receive them, and provide a one-click unsubscribe in every marketing email;
• operate, secure, debug, and improve the Services;
• analyze use of the Services, associate activity belonging to the same Wizard campaign session across visits and devices, reduce duplicate counting within that campaign session, and understand which features and user journeys are effective;
• measure and attribute demo requests and purchases resulting from our advertising, produce campaign-performance reports, and optimize our advertising;
• comply with our legal obligations and enforce our agreements.

We use Advertiser-supplied conversion data only for the originating Advertiser's reporting and the optimization of that Advertiser's own campaigns. We do not use one Advertiser's conversion data to benchmark, model, or optimize any other Advertiser's campaigns, and we do not sell, license, or share conversion data with any third party other than the limited service providers (such as our infrastructure provider) that need access to operate the Services on our behalf.

4. How we share information

We share information in the following limited circumstances:

• Service providers. With third parties that perform services on our behalf, including Stripe (payment processing), our hosting and database providers, our email-service providers (including Mailchimp for marketing email and our transactional-email provider), Snowflake and LiveRamp (data infrastructure), PostHog (privacy-limited product analytics for the Wizard), Google (Google Analytics 4, including measurement across visits and devices associated with the same Wizard campaign session using an opaque internal identifier; learn more about how Google uses information from sites and apps that use its services), LangChain (LangSmith, which provides observability and quality monitoring for our AI planning system and receives the business and campaign information you submit to the Wizard along with the personas and campaign plans it generates), and Magnite, StackAdapt, and ClearLine (advertising delivery), and Cloudflare (network security and bot protection on our public forms — see Section 8). These providers are contractually limited to using the information to perform services for us.
• Programmatic ad infrastructure. When we run your campaign, we provide the underlying programmatic platforms (Magnite, the DSPs we route through, and other ad-tech providers) with the targeting parameters, creative materials, and budget needed to deliver the campaign. We do not provide them with your account credentials or with conversion data tied to your account.
• Advertising and measurement partners. We share the advertising measurement information described in Section 2.2 with OpenAI, L.L.C. through the OpenAI Ads Measurement Pixel and Conversions API. OpenAI uses that information to attribute conversions, report campaign performance, and support advertising measurement and optimization. OpenAI may act as an independent controller for this processing as described in its Advertising Terms, Ad Tools Data Processing Addendum, and applicable privacy disclosures.
• Pontiac Intelligence. We disclose the limited pixel-request information described in Section 2.2 to Programmatic Mechanics LLC and Pontiac Intelligence LLC to attribute visits, demo requests, and purchased plans to our campaigns and report their performance. Pontiac describes its collection, advertising, attribution, and opt-out practices in its Privacy Policy.
• Business transfers. If we are involved in a merger, acquisition, financing, sale of assets, reorganization, or bankruptcy, information about you may be transferred as part of that transaction, subject to the protections of this Privacy Policy.
• Legal requirements. When we believe in good faith that disclosure is necessary to comply with law, respond to legal process, protect our rights or property, protect the safety of any person, investigate fraud, or respond to a government request.
• With your consent. In any other case where you have given us consent to share information.

We do not sell personal information for money. Our disclosure of measurement information to advertising partners may be considered "sharing" or targeted advertising under some state privacy laws. Where applicable, you may opt out as described in Section 6.

5. Data retention

We retain information for as long as needed to operate the Services and to comply with our legal obligations.

• Account and billing records: for the duration of your account and for seven years after account closure, to comply with tax, accounting, and other legal record-keeping requirements.
• Campaign data, including creative materials, targeting parameters, and performance reporting: for 365 days after the campaign ends, after which we delete the materials and aggregate the performance data.
• Conversion data, including hashed IP addresses: for 365 days after the campaign ends.
• OpenAI Ads attribution information stored by Passion+: for up to 365 days after the associated demo request or campaign ends. OpenAI retains information it receives according to its own applicable terms and privacy disclosures.
• Pontiac pixel information: Pontiac retains information it receives under its own privacy policy and applicable agreements. Passion+ retains the resulting aggregate campaign reports as part of campaign performance data.
• Google Analytics information: Google retains event-level and user-level analytics information according to the retention settings configured in our Google Analytics property and may retain aggregated reports for longer. We periodically review those settings and retain the information only for as long as reasonably needed for the measurement and service-improvement purposes described in this Policy.
• Marketing-list information: for as long as you remain subscribed, plus 30 days after unsubscribe to confirm and document the unsubscribe.
• Server logs: for 90 days.

6. Your privacy rights

Depending on where you live, you may have the following rights with respect to your personal information:

• Right to access the personal information we hold about you.
• Right to delete your personal information, subject to limited exceptions (for example, where we need to retain information to comply with our legal obligations).
• Right to correct inaccurate information.
• Right to data portability to receive a copy of your information in a usable format.
• Right to opt out of "sales" and "sharing" (as those terms are defined under California law) and of targeted advertising. You may use a browser that sends a Global Privacy Control signal or submit a request using the contact information below.
• Right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, contact us at [email protected]. We will verify your identity before responding and will respond within the time period required by applicable law (typically 45 days under U.S. state laws, with one 45-day extension if reasonably necessary).

For California residents specifically: in the prior 12 months, we have collected the categories of personal information described in Section 2, used them for the purposes described in Section 3, and disclosed them to the categories of recipients described in Section 4. We do not knowingly sell or share personal information of minors under 16.

We honor Global Privacy Control (GPC) signals as a valid opt-out mechanism for the categories of activity to which the opt-out applies.

You can limit Google Analytics collection by blocking or deleting cookies in your browser or by installing the Google Analytics Opt-out Browser Add-on. Blocking cookies may affect some features of the Services. These controls do not delete information that was collected before you opted out; you may request deletion as described above, subject to applicable exceptions.

7. Children

The Services are not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe we have collected personal information from a child under 18, contact us at [email protected] and we will delete it.

The Wizard's underlying advertising infrastructure (Magnite Quality Guidelines and others) prohibits children's-data targeting. We do not target advertisements to children under 13 and do not permit Advertisers to use the Wizard to target children under 13.

8. Security

Bot protection. Our contact and demo-request forms are protected by Cloudflare Turnstile, which verifies that a submission comes from a person rather than an automated script. Turnstile runs invisibly: it collects information about your browser and device, and about how you interact with the page, in order to make that assessment. Cloudflare processes this information as described in the Cloudflare Turnstile Privacy Addendum and its privacy policy. The information is used to distinguish humans from bots and is not used to serve advertising to you.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. No security program is perfect; we cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential and notifying us promptly if you believe your account has been compromised.

9. International data transfers

We are based in the United States, and the Services are offered to customers located in the United States. Your information is stored and processed in the United States and may be subject to U.S. law. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with local law.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make a material change, we will post the updated Privacy Policy on the Services and update the "Last Updated" date above. If the change is materially adverse to you, we will provide additional notice (for example, by email to your account email address). Your continued use of the Services after the change becomes effective constitutes your acceptance of the updated Privacy Policy.

11. Contact us

Amrak Integrated Marketing, Inc.

Email: [email protected]

For privacy-rights requests, please use the contact information above and identify your request as a privacy-rights request.