1. Scope and who we are
AI Explorer Media ("we", "us") is a marketing and technology consultancy based in Denver, Colorado, United States. This Privacy Policy applies to aiexplorermedia.com, all of its subdomains, landing pages, lead-capture forms, help documentation, affiliate redirect links and client portals, and to the personal data we process on our own behalf as a controller.
When we operate advertising, analytics, CRM or content systems on behalf of a client, that client is the controller and we act as a processor under a written data-processing agreement. In those engagements the client's own privacy notice governs the processing, and we act only on documented instructions.
This policy should be read together with our Cookie Policy, Affiliate Disclosure and Terms of Service, which form part of the same framework.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use data obtained from Google or Meta APIs to build advertising profiles or to train generalised artificial-intelligence models.
2. Personal data we collect
We keep collection proportionate to purpose. We do not request special-category data (health, biometrics, political or religious belief, sexual orientation, trade-union membership), and we do not knowingly collect data from anyone under sixteen. If we learn that a child's data has reached us, we delete it promptly.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, business email, phone number, company name, website URL, role | Provided by you in a form, call or contract |
| Engagement and usage | Pages viewed, referrer, campaign parameters, clicks, scroll depth, session duration, form interactions | Collected automatically, subject to your consent choices |
| Technical | IP address (truncated where feasible), browser, device type, operating system, language, coarse country and city from edge geolocation | Collected automatically by our hosting and edge network |
| Affiliate link data | Link slug, timestamp, destination, referring page, and country or city derived from edge headers | Recorded when a disclosed partner link is used |
| Commercial | Proposals, contracts, statements of work, invoices, payment references, correspondence | Created during a client engagement |
| Marketing preferences | Subscription status, consent records, opt-out history, consent timestamps | Provided by you and logged by our consent tooling |
| Client platform data | Advertising, analytics and search-console metrics accessed with your explicit authorisation | Read from Google, Meta and similar APIs under your permission |
3. How and why we use it
Every processing activity is tied to a documented purpose and a legal basis under the GDPR and UK GDPR, or to a disclosed business purpose under US state privacy laws.
| Purpose | Legal basis | Typical retention |
|---|---|---|
| Respond to enquiries and prepare proposals | Pre-contractual steps at your request | 24 months from last contact |
| Deliver contracted services, reporting and support | Performance of a contract | Engagement term + 7 years |
| Measure site performance and conversion paths | Consent (analytics cookies) or legitimate interest for aggregate data | Up to 14 months |
| Advertising measurement and remarketing | Consent | 90 days to 13 months |
| Affiliate click attribution and fraud prevention | Legitimate interest in accurate, source-neutral attribution | 7 days, then automatically purged |
| Send marketing communications | Consent, withdrawable at any time | Until you unsubscribe |
| Tax, accounting, anti-fraud and legal defence | Compliance with a legal obligation; legitimate interest | 7 years |
| Security monitoring and access logging | Legitimate interest in protecting our systems | 90 days |
4. Artificial intelligence and automated decision-making
We use artificial intelligence internally to draft advertising copy, keyword sets and content outlines. Every AI-generated asset passes through human review before it is published or applied to a live account — no campaign, budget or creative decision is made solely by an automated system.
We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not carry out profiling of that kind.
Personal data is not submitted to AI providers for model training. Where an AI provider processes content for us, it does so as a processor under contractual terms that prohibit the use of our inputs to train their models.
6. Google platform commitments
Our services involve Google Ads, Google Analytics, Google Search Console and the Google Ads API. In addition to the general terms of this policy, we make the following specific commitments, consistent with Google's API Services User Data Policy (including the Limited Use requirements), the Google Ads API Terms and the Google EU User Consent Policy.
- Limited use: data obtained through Google APIs is used only to provide or improve the features you have asked us to operate for you, and is never transferred to others except as necessary for those features, for security purposes, or to comply with applicable law.
- No advertising use: we do not use Google API data to serve advertisements, build advertising profiles, or sell it to any party.
- No human reading: we do not allow humans to read Google API data except with your explicit permission for specific messages, for security or abuse investigations, to comply with law, or where the data is aggregated and de-identified.
- No model training: Google API data is not used to develop, improve or train generalised artificial-intelligence or machine-learning models.
- Read-only by default: our Google Analytics and Search Console integrations request read-only scopes. Write access to an advertising account is requested only where you have asked us to manage campaigns, and any change is logged.
- Revocable access: you can revoke our access at any time in your Google Account permissions page or by removing our user access from the relevant account. Revocation stops all further reads immediately.
- Consent for EEA and UK users: where required, we obtain legally valid consent for the use of cookies and identifiers for personalisation and measurement before Google tags are allowed to fire.
- Customer Match and audience data: we upload customer lists to advertising platforms only when a client confirms it holds a lawful basis and the required notices and consents for that upload.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Meta and other third-party platforms
Where Meta Pixel or Conversions API is deployed on our site or for a client, processing follows Meta's Business Tools Terms and Data Processing Terms. Events are sent only after consent, identifiers are hashed before transmission where the platform supports it, and no special-category or prohibited data is transmitted.
Advertising platforms act as independent or joint controllers for the data they receive through their own tags and APIs, and their own privacy notices govern that processing. Reviewing those notices is the best way to understand and control what each platform does with your data.
We also participate in affiliate programmes. Affiliate links are disclosed, redirect through our own source-neutral endpoint, and pass no personal identifiers to the merchant beyond the referral identifier required to credit the referral. See our Affiliate Disclosure for full detail.
9. Retention and deletion
We keep personal data only for as long as the purpose requires, then delete it or irreversibly anonymise it. The retention column in section 3 sets out our standard periods.
Two periods are worth calling out. Affiliate click records — including the coarse country derived from edge headers — are automatically purged after seven days by a scheduled job; we do not store the visitor's IP address with those records. Server and access logs rotate after ninety days.
Where a longer period is required to establish, exercise or defend a legal claim, we retain the minimum data needed for that purpose and isolate it from active use.
10. How we protect your data
Access to production data is role-based and least-privilege, protected by mandatory multi-factor authentication. Credentials, API keys and OAuth tokens are held in an encrypted vault and are never stored in application code or version control. Row-level security policies scope every database read to its authorised owner, and administrative access is logged and reviewed on a rolling basis.
Data is encrypted in transit with TLS and at rest by our infrastructure providers. Backups are encrypted and access-controlled, and staff receive security and confidentiality training.
No system is perfectly secure. If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it and inform affected individuals without undue delay where the risk is high.
11. Your rights
Subject to your local law, you may exercise the following rights free of charge. We will not discriminate against you for exercising them.
- Access a copy of the personal data we hold about you, and information about how it is processed.
- Rectify inaccurate or incomplete records.
- Erase data where we no longer have a lawful reason to keep it.
- Restrict or object to processing that relies on legitimate interest, including direct marketing at any time.
- Receive your data in a portable, machine-readable format, or have it transmitted to another controller where technically feasible.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- For California residents: know, delete, correct and opt out of any sale or sharing — we do not sell or share — and limit the use of sensitive personal information, which we do not collect. You may use an authorised agent, and we will verify the request.
- Lodge a complaint with your local data protection authority, or with the Colorado Attorney General for US state privacy matters.
To exercise a right, email info@aiexplorermedia.com with the subject line "Privacy request". We may ask for information to verify your identity, used solely for that purpose. We acknowledge requests within two business days and respond within thirty days, extendable once where the request is complex, with notice to you.
12. Changes to this policy
We review this policy at least annually and whenever our processing materially changes. Material changes are published on this page with a revised effective date, and where the change affects consent-based processing we will ask you to re-confirm your preferences before relying on it.
Previous versions are available on request so you can see what changed and when.
13. Contact us
If you have questions about this document, contact our compliance desk at info@aiexplorermedia.com or write to AI Explorer Media, Denver, Colorado, United States. You can also reach us by phone at +1 2565 706 118 during business hours (Mon–Fri).
We aim to acknowledge every written enquiry within two business days and to resolve substantive requests within thirty days.