Privacy Policy

Medware Solutions Pty Ltd (ACN 667 659 985) operates AdSafe, including AdSafe Social. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what we collect, why, who we share it with and how to have it deleted.

1. What we collect

Website scans and reports

• Content you submit for scanning: the URL and selected public marketing pages, or pasted marketing text. We process that text to prepare your report. New reports retain the relevant evidence excerpts, page locations and scan coverage rather than a full copy of the retrieved text.
• When browser checks are available, we process privacy-masked desktop/mobile screenshots transiently and retain only generic layout observations, accessibility counts and recognised analytics resource hostnames. Images and recognised patient narratives are excluded; masking is not a guarantee of complete de-identification.
• Contact details: your email address if you provide it or purchase a report.

AdSafe Social

• Your account: your email address. To sign in we email you a one-time code; we store only a one-way hash of that code. A signed cookie keeps you signed in for up to 30 days.
• Caption and ad checks (in AdSafe, the AdSafe browser extension and the AdSafe app for Canva): the text you ask us to check. It is processed to produce the check and is not stored. We keep a usage record of each check: when it ran, where from, the risk level and the number of findings.
• Connected Facebook Pages and Instagram professional accounts: when you connect an account through Facebook Login, you choose what to share with us. We then read the account's name and username, your recent posts (caption, link, date, media type and a link to the post's thumbnail image) and the comments on those posts. We store an access token for each account, encrypted, so we can keep checking new posts and comments. We do not store image or video files.
• Comments on your posts: comments are written by members of the public and can mention health. Before a comment is checked we mask the commenter's name and username and any email address, phone number or @handle in it. The full comment is processed in memory only. If a comment is flagged we keep only the masked wording, the rule it may breach and the comment's Meta identifier (so you can hide it from AdSafe). We never store who wrote a comment.
• Captions: for posts we check we keep a fingerprint (hash) of the caption to notice edits, and the quoted wording inside any finding.
• Post via AdSafe: captions and photos you write or upload to publish or schedule. Photos are stored privately and made available to Meta only through a link that expires after one hour. Captions and photos are deleted 30 days after a post is published or fails; photos you upload but do not post are deleted after two days.
• Device codes: when you connect the browser extension or the Canva app, we create a code that is stored in that browser or app. We store only a one-way hash of it. You can disconnect devices from your dashboard at any time.
• Browser extension: the extension reads only the text in the post box on instagram.com, facebook.com and business.facebook.com, and only when you click the AdSafe shield or press Share. It does not read your browsing history, other pages, messages or comments.

Payments and technical data

• Payment information: handled by Stripe. We never see or store your card number. We receive confirmation of payment, your billing email and, for subscriptions, Stripe customer and subscription identifiers and the subscription's status.
• Technical data: standard server logs (IP address, browser type, timestamps) for security and reliability.

Do not submit patient information or health information about identifiable individuals. AdSafe is designed for marketing content only, and we do not knowingly collect health information. Where it reaches us in public comments, we mask identifying details as described above.

2. Why we collect it

• To generate your reports and checks and deliver them to you.
• To monitor connected accounts you ask us to monitor, alert you to posts and comments that may need review, and hide comments when you ask us to.
• To publish or schedule posts you write in AdSafe, to the accounts you choose.
• To process payments, manage subscriptions and provide receipts.
• To respond to support requests, prevent abuse and improve the Service.
• With your consent, to send you product updates. Every marketing email includes an unsubscribe link.

We do not sell personal information, and we do not use your content, your posts or the comments on them to train AI models.

3. Who we share it with

We use these service providers to operate AdSafe:

• Supabase: database and file storage in Sydney, Australia (reports, accounts, findings and Post via AdSafe drafts are stored here).
• Anthropic: content you submit for checking, captions and masked comments from connected accounts, and masked screenshots when available, are processed by Anthropic's AI service in the United States to produce findings.
• Meta (Facebook and Instagram): when you connect an account, we exchange data with Meta to read posts and comments, hide comments you choose and publish posts you send. Meta's own privacy policy applies to your use of Facebook and Instagram.
• Canva: if you use the AdSafe app inside Canva, the text you select is sent from Canva to us for checking.
• ScrapingBee: when enabled, retrieves selected public website pages through its scraping service. Page URLs and retrieved content are processed by that provider; this is not limited to Australian processing.
• Vercel: web hosting and content delivery, which may involve processing in the United States.
• Stripe: payment processing and subscription billing.
• Resend: email delivery (sign-in codes, reports and alerts), processed in the United States.

Where information is disclosed overseas (primarily the United States), we take reasonable steps to ensure recipients handle it consistently with the Australian Privacy Principles.

4. Retention and security

Reports, supporting excerpts and coverage are retained so your report link keeps working. Older reports may also retain the submitted scan text. We do not retain screenshots, raw HTML archives or form field values as part of a scan. AdSafe Social findings are kept while your account is active. We use encryption in transit, encryption of stored Meta access tokens, access controls and Australian-region storage.

5. Disconnecting and deleting your data

• Disconnect an account: in AdSafe Social, open your dashboard and choose Disconnect next to the account. We stop reading it and delete its stored access token straight away; to use it again you reconnect through Facebook Login. You can also remove AdSafe in Facebook under Settings, Business integrations.
• Remove AdSafe in Facebook: if you remove AdSafe under Facebook Settings, Business integrations, Facebook tells us and we stop reading your accounts and delete their stored access straight away. If you ask Facebook to delete the data AdSafe received, we also delete the connected accounts and their checked posts and flagged comments, and Facebook gives you a confirmation code you can check at adsafescan.com.au/social/deletion.
• Disconnect a device: remove the browser extension or Canva app from your dashboard.
• Delete your data: email support@adsafescan.com.au from your account email and ask us to delete your AdSafe account, connected accounts and findings, or a scan and its report. We will confirm deletion within 30 days. This is also how to request deletion of data we received through Facebook Login.

6. Access, correction and complaints

You may request access to or correction of your personal information by emailing support@adsafescan.com.au. If you have a privacy complaint, contact us first and we will respond within 30 days. If unresolved, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).