Privacy Policy

This policy explains what Dira ("we") collects when you sign up for or use Dira, why we collect it, and the choices you have. If you have questions, email privacy@diraads.com.

What we collect

When you sign up for our monthly notes

• Your email address.
• The page you signed up from.

When you use Dira

• Your account. Your name, email address and profile picture, from the sign-in service you use. Auth0 handles sign-in for us, so we never see your password.
• Your ad accounts. When you connect an ad platform such as Google Ads, Meta or TikTok Ads, we receive the account ID and currency, and performance data such as spend, impressions, clicks and conversions.
• Access to your ad accounts. The access a platform grants us is stored encrypted (AES-256-GCM). We never show it to anyone or include it in an export, including yours.
• Your bookings. When you upload a bookings file or connect a booking tool, we store each booking's date, status, value and service type (such as the job title, and the names of its line items when your booking tool has them), and where the customer said they found you. We use this to match bookings to your ads.
• Your customers' contact details. When a booking or lead includes an email address or phone number, we store only a SHA-256 hash of it, never the email or phone itself. We use the hash to match a booking to an ad, and to send booked jobs back to the ad platforms you connected. Hashes follow the retention periods below and are removed when you erase your data.
• Booking files. Files you upload are kept only until Dira has read them, and are deleted within 7 days.
• Billing. When you start a trial or a plan, Stripe takes your card and your payments. Dira keeps your plan, trial dates, invoices, and the card's brand, last 4 digits and expiry date. Dira never sees or stores the full card number.
• Activity in your workspace. A log of changes, such as settings updates and connected accounts, with who made them and when.
• How you use Dira. Which pages you open, which actions you take, and error reports.

How we use it

• To run Dira: compare your ad platforms, calculate cost per lead and cost per booked job, give you recommendations and, when you turn it on, manage your budget within the limits you set.
• To contact you about your account, your trial and important changes to the service, and to send our monthly notes if you signed up for them.
• To keep Dira secure, prevent abuse and fix problems.
• To understand how Dira is used, so we can improve it.

We do not sell your personal information.

Analytics and cookies

On diraads.com

We count visits with Fathom and PostHog, without cookies. Nothing is stored in your browser. PostHog counts visitors with a daily hash that can't be used to follow you from one day to the next or across other sites.

Google Ads on diraads.com

We advertise Dira on Google, and use the Google Ads tag on diraads.com to see which of our ads bring people to the site. When you allow it, the tag sets Google advertising cookies in your browser. Google uses them to connect your visit to the ad you clicked, and to measure and personalise ads, as described in Google's Privacy Policy. Google sets how long these cookies last.

• In the EEA, the UK, Switzerland and Quebec, the tag sets no advertising cookies until you choose Accept in the cookie banner.
• Everywhere else, advertising cookies are on until you turn them off.

You can change your choice at any time with Cookie settings at the bottom of any page. While advertising cookies are off, the tag still tells Google that a page was visited, without advertising cookies, so Google can estimate how many visits came from ads. Your choice is kept in your browser's local storage, not in a cookie.

The Google Ads tag runs only on diraads.com, not in the Dira app.

In the Dira app

We use PostHog to understand how Dira is used and to fix problems. It records:

• Which pages you open and which actions you take, such as connecting an ad account or approving a budget change. We record these with your Dira user ID and your workspace ID, not your name or email.
• Error reports from the app and our servers.
• Recordings of your sessions, with all text and everything you type hidden, and charts and images left out.

We don't send PostHog your name, email address, your customers' details, your booking records, your questions to Ask Dira, or any spend or budget amounts. PostHog uses your IP address to estimate your country and then discards it.

The app uses a cookie to keep you signed in. It also stores a PostHog identifier in a cookie and in your browser's local storage, so your visits can be linked together. The identifier is cleared when you sign out.

Data from Google

When you connect a Google Ads account, you sign in with Google and choose the account Dira may use. Dira then reads, for that account only:

• The Google account and the Google Ads account you selected, including the account ID and currency.
• Campaigns, ad groups, ads and daily budgets.
• Daily performance, including spend, impressions, clicks and conversions.
• Lead form submissions, including the ad they came from.

Dira uses this data only to show you how your Google ads compare with your other platforms and with the jobs your business actually booked, and to recommend a budget change or, if you approve it, apply one within the limits you set.

Dira stores this data on its servers, encrypted. The permission Google gives Dira is stored encrypted and is never shown, exported or sent to another app. Dira does not sell Google user data, does not use it for advertising, and shares it only with the companies that host and run Dira, listed below, so they can do that work.

You can disconnect Google at any time, from Dira or from your Google Account. Disconnecting stops Dira reading new data. You can also erase the stored data from your workspace settings, or by emailing privacy@diraads.com.

Dira's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Data from Meta

When you connect Meta, you sign in with Facebook and choose the ad account Dira may use. Dira then reads, for that account only:

• The ad account you selected, including its ID and currency.
• Campaigns, ad sets and ads, with their names, status, objective and budgets.
• Daily performance, including spend, impressions, clicks and conversions.
• The list of Facebook Pages you manage, so you can choose which Pages' lead ads Dira counts.

Leads from your lead ads

For the Pages you choose, Dira reads each lead form and the leads it receives, and Meta tells Dira when a new lead arrives. For each lead, Dira keeps:

• When it arrived, and the campaign, ad set, ad and form it came from.
• A SHA-256 hash of the lead's email address and phone number, made as the lead is read.
• The names of the questions on the form.

Every other answer, including the lead's name and address, is dropped as the lead is read and is not stored. Dira uses the hashes only to match a lead to a job your business booked. The access Meta gives Dira to each Page is used only while leads are read and is not stored.

You can change which Pages Dira reads from Ad accounts in Dira at any time.

Booked jobs Dira sends to Meta

If you turn on sending booked jobs to Meta, Dira sends each job your business books to your Meta dataset as a conversion, so Meta can tell which ads lead to real jobs. For each job, Dira sends:

• Whether the job was booked or completed, and when.
• A SHA-256 hash of the customer's email address and phone number, which is the form Meta accepts.

Dira never sends customers' names, addresses or unhashed contact details. Dira keeps a record of each send with Meta's reply, but not the hashes it sent. Meta handles what it receives under the Meta Business Tools Terms. You can turn this off at any time.

Changes Dira makes in Meta

Dira changes one thing in your Meta ad account: a daily budget, on the campaign or ad set that holds it. It does so only after you turn on budget moves and grant Dira a separate permission to make changes, and the same limits, checks and one-step undo described for Google apply. Dira does not create, pause or edit your campaigns, ads, audiences, bids or lead forms.

Dira stores this data on its servers, encrypted. The access Meta gives Dira is stored encrypted and is never shown, exported or sent to another app. Dira does not sell Meta data, does not use it for advertising, and shares it only with the companies that host and run Dira, listed below, so they can do that work.

Deleting your Meta data

• Stop Dira reading new data. Disconnect Meta from Ad accounts in Dira, or remove Dira under Business Integrations in your Facebook settings.
• Erase what Dira stored. An admin can erase the workspace's data from Workspace, Data & privacy in Dira. This removes your Meta account data, leads, lead hashes and the record of booked jobs sent.
• Ask us. Email privacy@diraads.com from the address you sign in with, and we'll erase your Meta data within 30 days and confirm when it's done.

Who we share it with

We share data only with the companies that help us run Dira, and only what each needs to do its job:

• Auth0, for sign-in.
• DigitalOcean, which hosts our servers and our database in Toronto, Canada.
• Cloudflare, which runs diraads.com and protects traffic to the Dira app.
• Resend, which sends account, trial and weekly summary emails.
• Google Gemini, which writes the summaries in your Ad Report and weekly email, answers your questions in Ask Dira, and helps read your bookings: it suggests which columns of an uploaded bookings file hold which details, works out which ad platform "how did you hear about us" answers name, and sorts each booking's service type into a standard list for your trade. Names, emails, phone numbers and addresses are masked before anything is sent to Gemini.
• Google Ads, which measures which of our ads bring visitors to diraads.com, through the Google Ads tag and the cookies you allow.
• Stripe, which takes card payments, keeps your card, charges sales tax and sends invoices for your plan.
• Twilio, which provides call tracking numbers and routes calls, when you use call tracking.
• Fathom, which counts visits to diraads.com and the Dira app.
• PostHog, for product analytics, error reports and session recordings in the Dira app, and visit counts on diraads.com.

How long we keep it

Your choices

• See and export your data. Workspace admins can export everything Dira stores for a workspace from Workspace settings.
• Delete your data. You can erase your personal data from your profile, and admins can erase a workspace's data. Erasing also deletes the matching analytics data from PostHog. You can also email us.
• Disconnect an ad account. You can remove Dira's access from the ad platform's own settings at any time.
• Stop weekly emails. Use the link at the bottom of any weekly email, or turn them off in your profile.
• Turn off advertising cookies. Use Cookie settings at the bottom of any page on diraads.com.
• Stop the monthly notes. Reply to any note or write to privacy@diraads.com.

Depending on where you live, you may have further rights, such as correcting your data or objecting to how we use it. Email us and we'll respond within 30 days.

Where your data is stored

Dira's servers and database are in Toronto, Canada. PostHog stores analytics data in the United States, and some of the other companies listed above may process data outside Canada. When your data leaves Canada, we use appropriate safeguards for international transfers.

Children

Dira is for businesses. It isn't meant for anyone under 16, and we don't knowingly collect their data.

Changes to this policy

If we make a significant change, we'll email you before it takes effect and update the date at the top.

Contact

Dira. Email privacy@diraads.com.