Privacy Policy

Last updated 2 August 2026

Draft — not yet reviewed by a lawyerThis document is a working draft prepared in good faith and is pending review by qualified legal counsel. It describes how DLight Ad Studio actually operates today, but it has not been vetted as a legal instrument. If anything here matters to a decision you are making, email support@dlightms.com and ask before relying on it.

This policy describes what DLight Ad Studio actually does with data. Every statement below was written against the running code, not from a template. Where something could not be confirmed from the code it is marked [VERIFY] and is being checked — please treat those points as provisional.

Controller: DLight Ad Studio, Arab Republic of Egypt. [VERIFY: registered legal entity name, commercial registration number and registered address]. Contact: support@dlightms.com.

1. What we collect, and why

Account and workspace data

When you create a workspace we store your company/brokerage name, your email address, your name, your role, and a hash of your password (never the password itself — see security below). We use it to identify you, keep your workspace separate from every other tenant, and contact you about the service.

Campaign and brief content

Everything you type into a brief: project name, developer name, broker name, hero copy, unit type and details, area, price, payment plan, call to action, captions and notes — in both English and Arabic — plus the campaign's status and timestamps. This is the raw material the service exists to process.

Uploaded files

Property photos, brand logos, reference images, custom font files (.ttf/.otf/.woff/.woff2, up to 10 MB each), and brand-manual PDFs you upload for colour and text extraction. If you upload a photograph containing an identifiable person, you are uploading their personal data — make sure you have the right to.

Generated output

The rendered ad creatives (PNG and PDF), AI-drafted copy, saved custom palettes, saved voice or tone profiles, custom layouts built in the Layout Studio, and — if you use the video feature — generated voice audio and avatar video.

Client-review responses (from people who never signed up)

When you share a review link with a client, that person can approve a creative or request changes and leave a comment of up to 500 characters. We store the verdict, the comment and a timestamp against the creative, so you can see the feedback in your workspace. We do not ask reviewers for a name, an email address or any account. Their IP address is used transiently to rate-limit submissions (see below) and is not stored against the feedback. If you share a review link, you are the one who chose to share your campaign with that person; please tell them their comments are visible to you and stored by us on your behalf.

Technical data

Ordinary server request logs from our hosting provider, and IP addresses used briefly for abuse prevention. We run no analytics, no tracking pixels and no advertising trackers of any kind — there is no Google Analytics, no Meta pixel, no session recorder in this application.

2. Legal bases

Performance of a contract — account data, campaign content, uploads, generated output, billing. Without processing these there is no service.
Legitimate interests — security, abuse prevention (login and review rate limiting), debugging, and protecting the service and our customers.
Legal obligation — tax and accounting records relating to payments.
Consent — where we ask for it explicitly, for example before sending non-essential email. You can withdraw it at any time.

3. Sub-processors — who receives what

These are the third parties that actually receive data, and precisely what reaches each one. Nothing else in the application makes an outbound call with your data.

Vercel (hosting, serverless functions, Blob storage) — United States

The application runs on Vercel, so all traffic passes through it. Vercel Blob is our object store: it holds your saved project state (brief content and embedded images), uploaded photos, logos and fonts, generated creatives, custom palettes, voice profiles and layouts, client-review records including verdicts and comments, password-reset tokens, and app settings. Vercel also keeps ordinary request logs.

Be aware: objects in our Blob store are written with public access, meaning a person who has an object's exact URL can open it without signing in. The URLs are built from random identifiers (UUIDs) and are never listed or indexed publicly, and the app only hands them to a browser after checking your session — but they are not cryptographically protected against someone you forward one to. Treat a creative URL like a share link.

Supabase (managed PostgreSQL) — hosted database

Our primary database. It holds broker/tenant rows (name, slug, plan, status, billing status, trial end, Stripe customer and subscription IDs, billing period dates), user rows (email, name, role, tenant, password hash) and campaign rows (all brief content, status, timestamps). [VERIFY: the Supabase project's region — this determines where the database physically sits].

OpenAI — United States

Used for every AI text and image feature. What is sent, and only when you trigger that feature:

Brief text and campaign field values, when you ask it to draft or rewrite ad copy or captions.
Text you paste in — a developer's WhatsApp blast, brochure text, brand guidelines — when you use autofill or the voice/tone profile extractor.
Images. Reference images and background photos are sent to OpenAI's vision endpoint when you ask for palette suggestions, a drafted brief from a reference, or a tone profile from an image. These are downscaled in your browser before sending, not sent at full resolution.
Full property photos. When you use the "extend photo" / outpainting feature, the photo itself is uploaded to OpenAI's image-editing endpoint so it can be extended to a new aspect ratio.
Your video script prompt, and layout-generation instructions, when you use those features.

No AI feature runs on its own. If you never touch them, nothing about your campaign goes to OpenAI.

ElevenLabs — voice synthesis

Receives the text of the video script you generate, and returns audio. No images, no brief data, no account data.

D-ID — avatar video

Receives the identifier of the stock presenter you selected and a URL to the voice audio file generated in the previous step, which D-ID fetches in order to produce the clip. No photograph of you or your client is uploaded — the presenters are D-ID's own stock avatars. [VERIFY: D-ID's contracting entity and processing region].

Stripe — payments

Handles checkout, the billing portal and subscription webhooks. Stripe receives your email address and an internal reference to your workspace. Card details go from your browser straight to Stripe and never touch our servers — we store only the Stripe customer ID, subscription ID, subscription status and billing period dates that Stripe sends back.

Resend — transactional email

Used for exactly one thing today: sending the password-reset email. It receives the recipient's email address and the reset link. We do not run marketing email through it.

Upstash / Vercel KV (Redis) — rate limiting

When configured, holds short-lived abuse counters: a key combining your email address and IP address for failed login and password-reset attempts, and an IP-only key for review-verdict submissions. The window is 15 minutes; nothing here is retained beyond it or used for any other purpose. Without this service configured, the same counters live in the server's memory.

What is not a recipient

Google Fonts. The Space Grotesk typeface is downloaded and self-hosted at build time. Your browser makes no request to Google, and Google receives nothing about visitors.
The rendering engine. Ads are rendered by a headless Chromium browser running inside our own server function. Your brief and photos are not sent to any rendering service. The Chromium binary itself is fetched from our own storage.
Advertising and analytics networks. None are integrated.

[VERIFY: that a signed data-processing agreement is in place with each sub-processor above].

4. International transfers

We are based in Egypt, but the service is not hosted in Egypt. Hosting, storage, the database and every AI and payment provider listed above operate outside Egypt, principally in the United States and the European Union. Using the service means your data — including campaign content and uploaded photos — is transferred and stored abroad. Where a provider offers standard contractual clauses or equivalent transfer safeguards, we rely on them. [VERIFY: which transfer mechanism applies per provider].

5. Cookies and browser storage

We set no advertising or analytics cookies. The complete list:

dlight_session — the sign-in cookie. It contains a base64-encoded payload (your user ID, role, workspace ID, email, name, a self-serve flag, and issue time) plus an HMAC-SHA256 signature that proves we issued it. While a DLight administrator is temporarily impersonating your workspace for support, this payload additionally carries a reference to the administrator's own account and a shorter, harder expiry (2 hours instead of 14 days) so that session can't outlive the support session. It is HttpOnly (not readable by JavaScript), SameSite=Lax, markedSecure in production, and expires after 14 days (2 hours during impersonation). Note it is signed, not encrypted. Strictly necessary — you cannot sign in without it.
dlight_actor_session — set only when a DLight administrator is temporarily viewing a workspace for support, so they can return to their own account. Same properties and lifetime.
dlight-theme (browser localStorage) — remembers whether you chose light, dark or system appearance. Never sent to us.
dlight_landing_lang (browser localStorage) — remembers whether you viewed the public landing page in English or Arabic. Never sent to us.

Because all four are strictly necessary or purely local preferences, we do not show a cookie consent banner.

6. How long we keep things — stated honestly

There is no automated retention window and no scheduled purge. Data you create stays until it is deleted. Specifically:

Deleting a draft campaign in the app removes its database record. It does not automatically remove the files already written to object storage for that campaign (saved project state, session images, generated creatives).
Deleting a workspace is an administrator action that removes its user records and the workspace record. It likewise does not purge that workspace's object storage.
There is no self-serve "delete my account" button. To have your workspace and its stored files erased, email support@dlightms.com from your account address. We will confirm the request, delete the records and the stored objects, and confirm back. [VERIFY: commit to a target turnaround for erasure requests — none is enforced by the system today].
Revoking a client-review link immediately stops it from opening. The stored record, including verdicts and comments, remains until deleted on request.
Password-reset tokens expire one hour after they are issued.
Rate-limiting counters expire after 15 minutes.
Billing records held by Stripe are retained under Stripe's own policy and our tax obligations, independently of any deletion request here.
[VERIFY: how long the hosting provider retains server request logs on our plan].

7. Security — what is actually implemented

Passwords are never stored. Each is run through scrypt (Node's built-in implementation) with a fresh 16-byte random salt and a 64-byte derived key, stored as scrypt$salt$hash. Verification uses a constant-time comparison, so the check itself leaks nothing. A minimum of 10 characters is enforced at signup.
Sessions are signed with HMAC-SHA256 using a server-side secret; the signature is verified on the server for every request that touches your data. The app refuses to start in production without that secret configured.
Tenant isolation — every API handler re-checks the session and the workspace it belongs to before reading or writing anything.
Brute-force protection — 10 failed login attempts, or 10 requests for a password-reset email, per email-and-IP combination within 15 minutes triggers a temporary block. The final step of a reset (submitting a new password with your reset link) is rate-limited by IP address alone, not email — on a shared or NAT'd IP, failed attempts by one person can temporarily block that step for others on the same IP. Review submissions are rate-limited by IP.
Password reset uses single-use tokens that expire in one hour, and the endpoint deliberately gives the same answer whether or not the email is registered.
Traffic is served over HTTPS.

The known limitation is the one stated above: object-storage URLs are publicly fetchable if someone obtains the exact URL. No system is perfectly secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you are, you may have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent. To exercise any of these, email support@dlightms.com from the address on your account. We may need to verify your identity before acting. You also have the right to complain to your local data-protection authority.

If you are a client reviewer who left feedback through a shared link rather than a customer: the workspace that shared the link with you controls that feedback. Email us and we will route your request to them and act on our side.

9. Children

This is a business tool for brokers and marketing teams. It is not directed at anyone under 18 and we do not knowingly collect data from children. If you believe a minor has given us data, email us and we will delete it.

10. Changes to this policy

We will update this page when the service changes — in particular whenever a sub-processor is added or removed. The date at the top reflects the current version; material changes will be notified in the app or by email.

11. Contact

Privacy questions, data requests, or a correction to anything on this page: support@dlightms.com. See also the Terms of Service and the FAQ.