Privacy Policy

Comestare (“Comestare”, “we”, “us”) provides an AI marketing platform and related services. This policy applies to personal data we process when you use our website, applications, and Services. For privacy questions or to exercise your rights, contact us at hello@comestare.com.

• Account information — your name, email address, and login credentials (passwords are stored only in hashed form; we also support Google sign-in).
• Content you submit — URLs, business descriptions, screenshots, business ideas, and other materials you provide so we can generate strategies, ads, and launch bundles for you.
• Meta connection data — when you connect your Meta account, we process the access tokens it issues (stored encrypted), and identifiers such as your ad account and Facebook Page IDs. Where you run Lead Ads, this includes the leads captured by your lead-ad forms (such as the names, emails, and phone numbers your prospects submit), which we process on your behalf so you can access them.
• Payment and wallet records — your wallet balance, transactions, purchases, and subscription status. Card details are handled by our payment processors; we do not store full card numbers.
• Usage and log data — device and browser information, IP address, approximate location (for example, to detect your currency/region), pages viewed, actions taken, and diagnostic logs.

• to provide the Services and generate your requested outputs (strategies, ads, launch bundles, and idea suggestions);
• to process your content through AI providers (for example, Anthropic) so the platform can produce AI Output;
• to create and publish advertising and Lead Ads to your connected Meta account at your direction, and to retrieve the resulting leads for you;
• to process payments, manage your wallet and subscriptions, and prevent fraud;
• to provide customer support and respond to your requests;
• to maintain, secure, debug, and improve the product and develop new features; and
• to comply with legal obligations and enforce our terms.

Where the law requires a legal basis (for example, under the GDPR), we rely on performance of our contract with you, your consent (which you can withdraw), our legitimate interests in operating and improving the Services, and compliance with legal obligations.

We share personal data with trusted service providers who process it on our behalf under contract, and only as needed to run the Services:

• AI model providers (for example, Anthropic) to generate AI Output from the content you submit;
• Meta / Facebook Graph API to connect your account, publish ads and Lead Ads, and retrieve leads and campaign data;
• hosting and infrastructure providers that store and serve the application and its data;
• payment processors to handle wallet top-ups, charges, and subscriptions; and
• email delivery providers for transactional and support messages.

We do not sell your personal data. We may also disclose data where required by law, to protect rights and safety, or in connection with a business transfer (such as a merger or acquisition), subject to this policy.

We keep personal data for as long as your account is active and as needed to provide the Services, then for as long as necessary to meet legal, accounting, security, and dispute-resolution obligations. Lead-ad data you collect is retained so you can access it until you or we delete it. When data is no longer needed, we delete or anonymize it.

We use technical and organizational measures designed to protect personal data, including encryption of sensitive credentials such as Meta access tokens at rest, encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to address incidents promptly.

Depending on where you live, you may have rights to access, correct, delete, and export your personal data, to object to or restrict certain processing, and to withdraw consent. These rights are relevant under the EU/UK GDPR, the Saudi Personal Data Protection Law (PDPL), and the UAE Personal Data Protection Law (PDPL), among others. To exercise any right, email hello@comestare.com; we will respond within the time required by applicable law. You may also have the right to complain to your local data protection authority.

We operate globally and serve customers worldwide, including across the MENA and Gulf region. Your data may be processed in countries other than your own, including by the sub-processors listed above. Where required, we put appropriate safeguards in place for such transfers (for example, standard contractual clauses or equivalent mechanisms).

We use essential cookies and browser local storage to keep you signed in, remember your language and theme preferences, and operate core features (for example, your authentication session and locale). These are necessary for the Services to function. You can clear them through your browser, but doing so may sign you out and reset preferences.

The Services are intended for adults and are not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Please review this page periodically.

To ask a privacy question, exercise your rights, or request deletion of your account and associated data, email hello@comestare.com or message us on WhatsApp at +962 78 202 6022. Please include the email address associated with your account so we can verify your request.