Privacy notice

Pejd is a product of Moen & Co AS, a company registered in Norway. For personal data we handle about you as a customer or visitor, Moen & Co AS is the data controller. For the content you put into the service — your storefront data, your products, your ads — we act as a processor on your instructions; see the Data Processing Agreement.

Contact: privacy@pejd.com.

What we collect

• Account data. Your email address and an authentication record. We never see or store your password; authentication is handled by Supabase Auth.
• Content you create. The store URLs you submit, the brand profiles and products we extract from public storefronts, your campaigns, generated images and ad copy.
• Usage data. Product analytics events such as “analysis started” or “ad approved”, page views, and technical information your browser sends. Only when you accept analytics.
• Billing data. When paid plans launch, Stripe processes your payment details. We never receive your card number.
• Meta connection. If you connect a Meta ad account, we store an access token, encrypted, so we can publish ads you approve. You can disconnect at any time.

Why we are allowed to

• Contract. Running the service you signed up for: accounts, analysis, generation, publishing, support.
• Legitimate interest. Keeping the service secure, preventing abuse, and understanding which parts of the product work.
• Consent. Product analytics and marketing measurement in your browser, each asked for separately. You can refuse either, and change your mind at any time from Cookie settings at the bottom of any page.
• Legal obligation. Accounting and tax records.

Cookies

Four categories. Strictly necessary cookies are always on because the site does not work without them; analytics, marketing and functional ones are set only if you say yes to that specific category. Dismissing the banner counts as refusing everything optional. What we set:

• Session cookies (Supabase Auth) — strictly necessary, they are what keeps you signed in.
• pejd_pending_url — remembers the store URL you pasted on the landing page so the analysis can start after you sign up. Expires after one hour.
• pejd_cookie_consent — the four choices you made, kept for 12 months and then asked again. Strictly necessary.
• pejd_anon_id and PostHog cookies — product analytics, set only if you allow the analytics category.
• _fbp, _fbc (Meta) — lets us measure which of our own ads brought you here, set only if you allow the marketing category. Refusing also deletes them.

When you buy something we also send Meta a server-side record of the purchase, matched to you by a one-way hash of your email address, so we can tell which advertising works. It carries the same event id as the browser event so the two count once, and it is only sent if you allowed the marketing category.

We keep a record of the cookie choices themselves — the categories, the time, your browser’s user-agent string and a daily hash of it. Not your IP address: the page cannot read one, and we do not want one.

Who else processes your data

We use the subprocessors below. Where a provider processes data outside the EEA, transfers rely on EU Standard Contractual Clauses.

We do not sell personal data, and we do not use your content to train anyone’s models beyond generating your own output.

How long we keep it

• Account and content data: while your account exists.
• After you delete your account: removed within 30 days, apart from what accounting law requires us to keep.
• Analytics events: 12 months.

Your rights

Under the GDPR you can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to privacy@pejd.com and we will answer within 30 days. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

Security

Data is encrypted in transit and at rest. Generated images and uploaded references live in private storage buckets served through short-lived signed links. Access tokens for third-party accounts are encrypted before they are stored. Only server-side code touches the database.

Changes

We will update this notice as the product grows and will tell you by email before a material change takes effect.