This policy explains how Regents Inc dba Gushwork ("Gushwork", "we", "us") handles information in Gushwork Ads, our managed Meta lead ads service for businesses ("clients"), including the Gushwork Ads app on Meta (listed on Meta as Plethos) and this website. It applies alongside our website privacy policy. Where they differ, this policy governs Gushwork Ads and any data we receive from Meta.
1. Who we are and our role
Regents Inc dba Gushwork
16192 Coastal Hwy, Lewes, DE 19958, United States
Privacy and data requests: admin@gushwork.ai
Sales: growth@gushwork.ai · Phone: +1 (888) 451 5522
For the data in a client's Meta assets and leads, the client decides why it is collected and is responsible for it (the "business" or "controller"). Gushwork processes that data only on the client's behalf and at its direction, as its service provider. Meta is a separate company that provides the ad platform under its own terms. For our own business records, such as client contacts and sign-in details, Gushwork is responsible.
2. Data we get from Meta
When a client connects Gushwork Ads through Facebook Login for Business ("Continue with Facebook"), or shares assets with Regents Inc as a partner, and only while that access is active, we receive:
| Data | Details |
|---|---|
| The connection | Which business portfolio and assets the client granted, the permissions granted, and when. We use the Facebook name and ID of the person who connects only to complete the login; we don't keep them. |
| Business assets | IDs and names of the business portfolio, Pages and ad accounts the client selects; Page details such as name and category; and the username of a connected Instagram account. |
| Advertising data | Campaigns, ad sets, ads, creative and lead forms that Gushwork Ads creates; budgets and targeting settings; ad review and account status; account currency, time zone, spending limit and whether a payment method is present; and results such as spend, impressions, reach, clicks and leads. |
| Leads | Answers people submit in lead forms that Gushwork Ads created for the client, such as name, email, phone number, company and answers to the form's questions, with the time and the ad they came from. |
| Access tokens | Credentials that let Gushwork Ads act only on the assets the client selected. They expire and are renewed every 60 days while the client stays connected. |
We do not receive payment card details: ads are paid for between the client and Meta. We never ask for or collect Facebook passwords.
3. Data we get from clients and their teams
- Account and sign-in: names, work emails and phone numbers of the client's team, and sign-in details (a password or Google sign-in).
- Agreement records: who accepted our terms for the client, their title, when, and the IP address and browser used.
- Business information and materials: the client's services, offers, prices, locations, website, brand material, images and videos, and approvals.
- Customer lists a client chooses to upload for ad audiences: emails, phone numbers and names are converted to one-way codes (hashed) in Gushwork Ads before being sent to Meta, and the file is not kept.
- Lead follow-up: statuses and notes the client adds to its own leads, and the email addresses the client confirms for lead alerts.
- The client's website and SEO data, where Gushwork provides SEO services or the client shares it.
4. This website
This site does not use analytics, advertising cookies or trackers, and sets no cookies. Our hosting provider keeps standard server logs, such as IP address and browser, for security. Pages load fonts from Google Fonts and images from our website host, which receive your IP address to deliver them. If you email us, we use your message only to reply.
5. Why we use it
We use each client's data only to provide Gushwork Ads to that client:
- Running that client's ads: creating, launching, monitoring and improving campaigns and lead forms, keeping spend within the agreed limit, and checking account health.
- Showing that client's leads in its dashboard and alerting the recipients it confirms.
- Reporting results to that client.
- Providing sign-in, support, billing and account administration.
- Keeping the service secure, and meeting legal obligations and Meta's platform terms.
6. Who we share it with
- The client and the people it chooses: the client's own team in Gushwork Ads, and the email addresses it confirms for lead alerts. Lead alert emails contain a link to the dashboard, not the lead's contact details.
- The person who submitted a lead form: on the client's behalf, we may send a confirmation or follow-up email to the address that person gave, about the enquiry they made. Every such email says which client it is from and how to stop receiving them.
- Service providers that process data only for us and at our direction, for no purpose of their own, under written terms that require them to protect it and delete it when we stop using them: Amazon Web Services (hosting, storage, encryption, sign-in emails and the AI services described in section 7, in the United States), Loops (lead alert, notification and lead follow-up emails), Google (sign-in, where a user chooses it, and our own work email) and Slack (internal operational alerts). Our team administers these services from India and the United States. We keep this list current and can provide it, with the written terms behind it, on request.
- Meta, when we run the client's ads in its accounts, as the client has directed.
- Authorities, where the law requires it. Where the law allows, we tell the client first.
We never:
- sell, license or buy data we receive from Meta, or share it for others' advertising;
- use one client's data or leads for another client or for Gushwork's own purposes;
- combine one client's data with another client's, build shared audiences across clients, or use it to build profiles of people;
- use data from Meta to retarget people, or combine it with ad data from other platforms;
- use data we receive from Meta to discriminate against people, to make decisions about eligibility for housing, employment, insurance, education, credit, government benefits or immigration, or for surveillance;
- try to re-identify hashed or anonymised data.
7. AI
Gushwork Ads uses AI services to help run the service, for example drafting ad copy and images, summarising a client's own results, and checking incoming leads. Every AI feature follows these rules, and we will update this policy before we use AI on a new kind of data:
- AI services that handle data we receive from Meta, including lead records, run on Amazon Web Services in the United States, under terms where the provider processes the data only on our instruction, keeps nothing after the request, and does not train models on it.
- Lead records may be checked automatically to spot spam, duplicate and incomplete submissions and to route each lead to the right client, so that clients receive real enquiries. A person can review any of these checks.
- No AI system decides whether a person qualifies for a loan, a home, a job, insurance, credit, education or any other benefit, and none is used to set the terms of one. We do not use data from Meta for eligibility decisions of any kind.
- Each client's AI work uses only that client's own information. No client's data is used to train AI models, ours or anyone else's.
- A person at Gushwork reviews AI-drafted ads before they run.
8. How long we keep it
| Data | Kept for |
|---|---|
| Leads | The length of the client's contract. A client can delete a lead in Gushwork Ads at any time, which removes it at once. |
| Advertising data and results | The length of the client's contract. |
| Access tokens | Until the client disconnects Gushwork Ads or the contract ends, when we revoke them. Replaced every 60 days while connected. |
| Customer list files | Not kept. Only the hashed codes are sent to Meta. |
| Records of actions taken in the client's accounts | 12 months, for security and to answer the client's questions. |
| Server and security logs | 90 days. |
| Backups | Up to 35 days. If a backup is ever restored, completed deletions are applied again. |
| Everything above, when a client deletes it in Gushwork Ads, asks us to, or its contract ends | Deleted within 30 days, except records we must keep by law, such as invoices, and a record that the deletion was done. |
9. Security
- Data is stored on Amazon Web Services in the United States, encrypted at rest with managed keys. If your business is outside the United States, you instruct us to transfer your data there when you use Gushwork Ads. We do not currently serve clients in the UK or EU. Access tokens and lead contact details are encrypted again with separate keys.
- Data is encrypted in transit with TLS 1.2 or higher.
- Access tokens and our app secret are kept in a secrets manager and are never placed in browser code, web addresses or logs.
- Each client's data is kept separate from every other client's.
- Only staff who work on a client's account can reach its data, with multi-factor sign-in. Lead contact details are hidden from staff by default, and staff cannot export leads. Access is reviewed regularly and removed the day someone leaves. Staff do not keep Meta data on laptops or phones.
- Systems are checked for vulnerabilities and tested at least once a year.
- If a security incident affects a client's data, we notify the client without undue delay and within 72 hours, and notify Meta where its data is involved.
To report a security vulnerability, see Security or email admin@gushwork.ai.
Privacy pages for lead forms
Meta requires every lead form to link to the advertiser's privacy policy. Gushwork Ads can host one for each client, generated from a template the client reviews and accepts, with the client's own contact details and a rights section. The client is responsible for that page; the template is not legal advice.
10. Your choices and rights
Disconnecting
Remove Gushwork Ads (listed on Meta as Plethos) at any time in Business Settings › Integrations › Connected apps, or in Facebook under Settings & privacy › Settings › Business integrations. If you shared assets with Regents Inc as a partner, remove it in Business Settings › Users › Partners. We stop receiving data immediately. To delete the data we already hold, follow the steps on our Data Deletion page.
Deleting your data
Anyone can ask us to delete their data. Follow the steps on our data deletion page.
If you filled in a lead form
The business whose ad you answered is responsible for your information. You can contact that business directly. If you contact us, we pass your request to that business within 5 business days, and we delete your details from Gushwork Ads within 30 days.
US state privacy rights
Depending on your state, including California, Colorado, Connecticut, Virginia and others, you may have the right to know what personal information we hold about you, to access, correct or delete it, and to opt out of its sale, sharing or use for targeted advertising. We do not sell or share personal information, and we do not use sensitive personal information. To use these rights, email admin@gushwork.ai or call +1 (888) 451 5522. We confirm your request within 10 business days and respond within 45 days, verify your identity before acting, and will not discriminate against you for making a request. An authorized agent may make a request for you. If we deny your request, you can appeal by replying to our decision. Where we hold data as a client's service provider, we pass your request to that client and act on its instructions.
11. Children
Gushwork Ads is a service for businesses. It is not directed to children under 13, lead forms are not targeted at minors, and we do not knowingly collect children's personal information. If you believe we have, email admin@gushwork.ai and we will delete it.
12. Changes to this policy
We will post changes here and update the effective date. We will email active clients about material changes before they take effect, and we will not use data received from Meta in a new way until this policy describes it. Use of Gushwork Ads is also subject to the Gushwork Ads Terms.
13. Contact
Regents Inc dba Gushwork
16192 Coastal Hwy, Lewes, DE 19958, United States
Privacy and data requests: admin@gushwork.ai
Sales: growth@gushwork.ai · Phone: +1 (888) 451 5522