Privacy Policy

Applies to: Creative Factory, the We Are 365 application that turns a retailer’s Publitas brochures into advertising images, as deployed for pilot customers.

1. Who is responsible

Creative Factory is operated by We Are 365 LLC, 800 SE 4th Ave, Hallandale Beach, FL 33009, United States. We Are 365 is responsible for the processing of the account data of the people who sign in to the application (operators). The retailer content that operators work with (brochures, product data, logos, campaign copy) is processed on behalf of the customer under the pilot agreement and its data processing addendum. Contact for privacy matters: hello@weare365.io.

2. What data is processed

Operator account data. On sign-in the application receives from Google the account identifier and the email address of the person signing in. It records the first and last sign-in and which deployments the person has used. This is the only personal data the application collects about individuals, and it concerns pilot staff, never the retailer’s shoppers.

Operator activity. Projects created by the operator (name, campaign type, target platforms, selected pages and products, headlines, brief, call-to-action, disclaimer, store context, sizes, status), review verdicts on generated creatives with the reviewer’s email, and an operational log entry per generated creative containing the operator’s email and account identifier, the texts typed into the free-text fields, product identifiers, the publication reference, token usage, cost and errors. Standard technical request data, such as IP address and timestamps, may be recorded by the hosting infrastructure’s access logs.

Retailer content. Brochure pages selected by the operator, rasterised to images; product records read from Publitas (name, description, price, brand, availability, photo, webshop link and identifier); logos uploaded by the operator; and the retailer’s brand guidance where provided. This content is the retailer’s published marketing material and contains personal data only if the retailer placed it there or an operator typed it into a free-text field.

3. Where the data comes from

Google sign-in. The application sits behind Google Cloud Identity-Aware Proxy and has no public endpoint. Access is granted per deployment through a list maintained as infrastructure code. The application requests no OAuth scopes on the person’s Google account and cannot read Gmail, Drive, Calendar, Contacts or any other Google service.

Publitas connection. Through Publitas’ partner API, read-only, the application reads the content of retailers that enabled content sharing with We Are 365 in their own Publitas account: publications that are online or scheduled, their pages, and the products tagged on them. A second credential reads the location of the retailer’s product feed as configured in Publitas. If the retailer has not enabled sharing, its catalogue does not load; if sharing is switched off, the content is no longer readable. The connection cannot access shopper or end-consumer data, viewing statistics, Publitas account users or billing. Each deployment additionally carries a server-side allowlist of Publitas group ids; anything outside it is not served.

Operator input. Text typed into the application and files uploaded by the operator.

4. Purposes and legal basis

Operator account data is processed to authenticate requests, to keep each person’s projects separate, to attribute review verdicts and generation cost, to monitor the service and to diagnose incidents. The legal basis is the performance of the pilot agreement and We Are 365's legitimate interest in the security and operation of the service. Retailer content is processed solely to provide the service requested by the customer, on the customer’s instructions.

5. Use of artificial intelligence

Creative Factory generates images with OpenAI’s image editing API (model gpt-image-2). For each creative the application sends: the prompt text it assembles (including the operator’s brief, headlines, call-to-action, disclaimer, store context and the retailer’s brand guidance), the selected brochure pages as images, the selected product images and the logo(s). It does not send the operator’s identity, email or account identifier, Publitas credentials, product links or project identifiers. The request to OpenAI is built from a fixed set of fields and carries no user identifier, cookies or forwarded headers; the OpenAI credential is held on the server and the browser never contacts OpenAI.

Under OpenAI’s API terms, content is not used to train OpenAI’s models and may be retained for up to 30 days for abuse monitoring. We Are 365 has executed OpenAI’s Data Processing Addendum and has applied for OpenAI’s Zero Data Retention for the endpoint in use; customers will be informed of the outcome. Every generated creative is reviewed by the operator before download. Nothing is published automatically, and no advertising platform (including Meta or Google Ads) is connected to the application.

6. Recipients

OpenAI: image generation, as described in section 5. The only AI provider.
Google Cloud: hosting, database, file storage, secrets, logs and sign-in. Everything stored by the application.
Publitas: source of retailer content. Receives read requests identified by group and publication ids only.
The retailer’s own content delivery network and, where configured, its SFTP server: product images and product feed, read by the server.
GitHub: build pipeline. Source code only; no customer or personal data.
The application contains no third-party analytics, advertising or tracking tools. Any new provider will be notified to customers in advance, in accordance with the pilot agreement.

7. Where data is stored

All storage and processing by We Are 365 currently takes place in Google Cloud region us-central1 (Iowa, United States), in a single project and region. OpenAI processes generation requests in the United States. Content read from Publitas is therefore transferred to the United States; the transfer mechanism relied on for each provider is set out in the data processing addendum. An EU-region deployment can be provisioned for a pilot when agreed before onboarding. Access to the underlying cloud project is limited to a small number of named We Are 365 staff.

8. Retention and deletion

Operators can delete a project, or a single creative, at any time. Deletion is restricted to the project’s owner and removes the project, its generation runs, every creative and its files. Shared retailer assets (logos, rasterised pages) remain only while another project of the same retailer still uses them.
The brochure PDF is held in server memory for at most 15 minutes and is never stored. Product images are fetched from the retailer at each generation and never stored. The product feed and any credentials in its location are held in memory only.
Deleted files remain recoverable by We Are 365 for 7 days through the storage platform’s soft-delete behaviour, after which they are gone. Log entries expire automatically after the retention period stated in the data processing addendum.
Unless the pilot agreement provides otherwise, the entire pilot workspace is deleted within 30 days after the pilot ends, or earlier on the customer’s written request, with written confirmation. Deletion of a specific person’s account record and projects is honoured on request.
9. Security

Every request must pass Google’s sign-in and is verified by the server against a token signed by Google. The browser holds no cloud credentials; all reads and writes go through the server, and no public or signed links to stored files exist. Credentials for Publitas and OpenAI are stored in a secrets manager and never reach the browser. Uploaded files are validated before storage and stripped of metadata. Data is encrypted in transit and at rest by the hosting platform. Access to the application and to the cloud project is granted per person and reviewed as infrastructure code.

10. Cookies

The application uses only strictly necessary cookies: the session cookies set by Google Cloud Identity-Aware Proxy to keep the person signed in, and a cookie that remembers the chosen interface language. No advertising or analytics cookies are used.

11. Rights of individuals

Operators may request access to, rectification or deletion of their account data, restriction of or objection to its processing, and a copy of it in a portable format, by writing to hello@weare365.io. Requests concerning retailer content are handled with the customer under the pilot agreement. Individuals in the European Union may also lodge a complaint with their local data protection authority.

12. Changes

This policy will be updated when the application, its providers or its hosting change. The effective date above indicates the current version; customers are informed of material changes in advance.