Privacy Policy

1. Our role

Voltano plays two different roles depending on the information involved.

As a controller, for information about you as a visitor to our websites and as a user of the Service — your account details, contact information, and how you use the platform.

As a service provider and processor, for Customer Data that our business customers connect or submit to the Service. We process that data on our customer's instructions and for no other purpose. If you are an individual whose information appears in a customer's data, your relationship is with that customer, and requests about that data should be directed to them.

2. Information we collect

Information you provide

Account and contact details such as your name, work email, company, and role; communications you send to us; and content or settings you submit when configuring the Service.

Information collected automatically

Device, browser, and usage data, including IP address, pages viewed, features used, timestamps, and approximate location derived from your IP. We collect this through cookies and similar technologies.

Information from connected platforms

When you connect an advertising, retail media, or analytics account, we receive the data those platforms make available through their APIs, subject to the permissions you grant. This is primarily commercial performance data — campaign structures, ad spend, impressions, clicks, orders, revenue, keywords, and attribution metrics. It is not intended to include, and we do not ask for, personal information about individual shoppers.

3. How we use information

• To provide, operate, and maintain the Service, including consolidating and normalizing your marketing data.
• To generate insights, recommendations, and the automated optimizations you approve.
• To authenticate users, secure accounts, and prevent fraud or abuse.
• To communicate with you about updates, support, and, where permitted, relevant product information.
• To analyze and improve the Service and develop new features, using de-identified and aggregated data as described in Section 5.
• To comply with legal obligations and enforce our agreements.

4. Connected advertising accounts

Data accessed from connected platforms is used solely to deliver the Service to you — to report on performance and to execute the optimizations you approve. We do not use your connected-account data to build profiles for unrelated purposes, and we do not use it for the benefit of any other customer except in de-identified, aggregated form as described in Section 5.

You can disconnect an account at any time from your settings, which stops further data collection from that source and ends any automated execution against it.

5. AI and automated processing

The Service uses artificial intelligence and machine-learning systems, including third-party large language models, to normalize data, compute metrics, generate analyses, and produce recommendations.

We do not use Customer Data to train our own models. Our AI sub-processors are contractually prohibited from using Customer Data to train theirs. The AI providers we use are identified in Section 7.

De-identified and aggregated data. We may create and use de-identified, aggregated data derived from Customer Data to operate, benchmark, and improve the Service. This data does not identify any customer, user, or individual, and we do not disclose it in a form that would allow a third party to attribute it to a particular customer.

Human review. Our team reviews system-generated recommendations before they are presented, and verifies implementations after they are executed. Personnel access to Customer Data for this purpose is described in Section 12.

6. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only in these circumstances:

• Sub-processors who process data on our behalf, listed in Section 7, under contractual confidentiality, security, and use-limitation obligations.
• Advertising platforms you connect, to read data and, where you authorize it, to apply changes you approve.
• Legal and safety reasons, when required by law or legal process, or to protect rights, property, or safety.
• Business transfers, such as a merger, acquisition, or sale of assets, with notice where required.

7. Sub-processors

We use the following sub-processors to deliver the Service. Each is bound by contractual confidentiality, security, and use-limitation obligations consistent with this policy.

• Google Cloud Platform (incl. BigQuery) — data warehousing, storage, and compute. Processing location: United States.
• Google Data Studio — reporting and dashboards. Processing location: United States.
• Adverity — advertising data extraction and pipeline. Processing location: United States.
• Make (Celonis) — workflow automation. Processing location: United States.
• Anthropic (Claude) — large language model processing for analysis and recommendations. Processing location: United States (storage); inference may be routed to other regions.
• Mailgun (Sinch) — transactional and notification email. Processing location: United States.

We will provide reasonable advance notice — by updating this page or by email to your designated contact — before adding a sub-processor that materially changes the categories or locations of Customer Data processing.

8. Data retention

Operational data

During your subscription we retain up to fifteen (15) months of campaign-, ad-set-, and ad-level data, and up to sixty (60) days of keyword- and search-term-level data. Older data is purged on a rolling basis. You are responsible for exporting anything you wish to keep beyond these windows.

Account and contact information

Retained while your account is active and thereafter only as required to meet legal, accounting, or reporting obligations.

After termination

On written request received within ninety (90) days after termination, we will export the normalized cross-platform dataset we maintained on your behalf in a commercially reasonable structured format. After that window closes, we delete Customer Data within sixty (60) days, except for data we are required to retain by law, data existing only in routine backups (deleted in the ordinary course), and de-identified or aggregated data.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, audit logging, secrets management, least-privilege practices, and security due diligence on sub-processors.

We will promptly notify affected customers of any confirmed unauthorized acquisition of, or access to, Customer Data, and will cooperate in good faith with a customer's reasonable investigation.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights and choices

Depending on your location, you may have the right to access, correct, delete, port, or restrict processing of your personal information, and to object to certain processing or withdraw consent. To exercise these rights, email privacy@voltano.ai or use the contact form at voltano.ai. We will respond within the timeframe required by applicable law, and we will not discriminate against you for exercising a right.

If your information was provided to us by one of our business customers, we will refer your request to that customer, who is responsible for responding.

You may also lodge a complaint with your local data protection authority.

11. California privacy rights

For personal information within Customer Data, Voltano acts as a service provider under the California Consumer Privacy Act, as amended by the CPRA. We do not retain, use, or disclose that information for any purpose other than performing the services specified in our agreement with the customer, and we do not sell it or share it for cross-context behavioral advertising.

For personal information we collect as a controller — website visitors and platform users — California residents may request to know the categories and specific pieces of personal information we have collected, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it; request deletion or correction; and exercise these rights without discrimination. Requests go to privacy@voltano.ai.

12. International transfers and personnel locations

We may process and store information in countries other than where you reside. Where we transfer personal data internationally, we rely on appropriate safeguards such as standard contractual clauses.

Voltano personnel — including employees and contractors located in the United States and Argentina — may access Customer Data as necessary to operate, maintain, support, and improve the Service. All personnel are bound by written confidentiality obligations consistent with this policy. We will provide reasonable advance notice before adding personnel access in a new country that materially changes the categories or locations of Customer Data processing.

13. Cookies and tracking

We use cookies and similar technologies for authentication, preferences, security, and analytics. You can control cookies through your browser settings; disabling some cookies may affect the functionality of the Service.

14. Children's privacy

The Service is intended for business use and is not directed to individuals under 16. We do not knowingly collect personal information from children.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated "Last updated" date and, for material changes, provide additional notice where required.

16. Contact us

• Privacy questions or requests: privacy@voltano.ai
• Legal: legal@voltano.ai
• Support: support@voltano.ai

Voltano is operated by Marketing Engine LLC, a California limited liability company.