Privacy notice

Pejd is a product of Moen & Co AS, a company registered in Norway. For personal data we handle about you as a customer or visitor, Moen & Co AS is the data controller. For the content you put into the service — your storefront data, your products, your ads — we act as a processor on your instructions; see the Data Processing Agreement.

Contact: privacy@pejd.com.

What we collect

• Account data. Your email address and an authentication record. We never see or store your password; authentication is handled by Supabase Auth.
• Content you create. The store URLs you submit, the brand profiles and products we extract from public storefronts, your campaigns, generated images and ad copy.
• Usage data. Product analytics events such as “analysis started” or “ad approved”, page views, and technical information your browser sends. Only when you accept analytics.
• Billing data. When paid plans launch, Stripe processes your payment details. We never receive your card number.
• Meta connection. If you connect a Meta ad account, we store an access token, encrypted, so we can publish ads you approve. You can disconnect at any time.

Why we are allowed to

• Contract. Running the service you signed up for: accounts, analysis, generation, publishing, support.
• Legitimate interest. Keeping the service secure, preventing abuse, and understanding which parts of the product work.
• Consent. Product analytics in your browser. You can decline, and change your mind by clearing the pejd_consent cookie.
• Legal obligation. Accounting and tax records.

Cookies

We use no advertising cookies and no third-party trackers. What we set:

• Session cookies (Supabase Auth) — strictly necessary, they are what keeps you signed in.
• pejd_pending_url — remembers the store URL you pasted on the landing page so the analysis can start after you sign up. Expires after one hour.
• pejd_consent — your analytics choice.
• pejd_anon_id and PostHog cookies — product analytics, set only if you accept.

Who else processes your data

We use the subprocessors below. Where a provider processes data outside the EEA, transfers rely on EU Standard Contractual Clauses.

We do not sell personal data, and we do not use your content to train anyone’s models beyond generating your own output.

How long we keep it

• Account and content data: while your account exists.
• After you delete your account: removed within 30 days, apart from what accounting law requires us to keep.
• Analytics events: 12 months.

Your rights

Under the GDPR you can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to privacy@pejd.com and we will answer within 30 days. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

Security

Data is encrypted in transit and at rest. Generated images and uploaded references live in private storage buckets served through short-lived signed links. Access tokens for third-party accounts are encrypted before they are stored. Only server-side code touches the database.

Changes

We will update this notice as the product grows and will tell you by email before a material change takes effect.