Your data, straight up.

We collect the minimum data needed to run your account and generate useful recommendations. Your briefs, campaigns and platform data are yours. We never sell them, never train shared models on identifiable content, and you can revoke any connection or export your data at any time.

Three buckets:

• Account info. Name, work email, company, role, password hash. Used to log you in and contact you about your account.
• Platform data. When you connect an ad platform (Meta, Google, TikTok, LinkedIn, DV360), Medusa pulls campaign structure, spend, impressions and performance metrics through official APIs. We do not read DMs, personal profiles or anything outside the advertising scope you grant.
• Plan content. Briefs you upload, personas you generate, audiences you save, allocations and tactics. This is the workspace data you create inside Medusa.

Strictly to deliver the product. Concretely, that means: generating personas and audiences from your brief, recommending channel mixes, showing pacing vs plan, surfacing AI recommendations and improving those recommendations as more data flows in.

We do not use your data to train generic foundation models for other customers, sell to data brokers, or build advertising profiles outside Medusa.

When you upload a brief or ask Medusa a question about your plan, the system uses Retrieval-Augmented Generation (RAG). In plain terms: we turn relevant pieces of your content into mathematical embeddings (vectors) and store them in a vector database. When you ask something, the closest matching vectors are retrieved and used as context for the language model to compose an answer.

This pattern matters for privacy because:

• Your content stays in your tenant in the vector store. Vectors are scoped per account.
• The language model only sees the small slice of context retrieved for that specific query, never the whole library.
• No customer's vectors are mixed into another customer's retrieval pool.

Before content is embedded, we run an anonymization pass that strips obvious identifiers: people's names, email addresses, phone numbers, account IDs and similar PII. What ends up as a vector is the structural and strategic content of your work, not who it's for.

For metrics from ad platforms, Medusa stores aggregates and campaign identifiers, not the underlying audience members that platforms showed your ads to (we don't have access to that data anyway).

To deliver the AI features (brief parsing, persona generation, channel recommendations, copy suggestions), Medusa sends prompts and the minimum necessary context to third-party AI model providers such as Anthropic and OpenAI.

What we send:

• Anonymized, task-relevant context from your workspace (the slice retrieved by RAG for that specific request).
• Embeddings generated from your content for semantic retrieval.

What we do not send:

• Your account credentials, OAuth tokens, or platform login details.
• PII identified by the anonymization pass (names, emails, phone numbers, customer-level data).
• Whole-account data dumps.

We use these providers under their enterprise/API terms, which contractually prohibit using your content to train shared models and require zero-retention or short-retention handling. Where a provider offers a zero-retention mode, we use it. The current list of AI sub-processors is available on request from Info@getmedusa.ai.

We do use aggregated, de-identified usage signals to improve Medusa: feature usage counts, error rates, latency, and patterns like "how often does a persona get edited after generation". These signals don't contain your content and can't be tied back to a person.

We do not train shared AI models on your briefs, plans, audiences, performance data, or any other workspace content. If we ever want to use your content to train models that benefit other customers, that will be a separate, explicit, opt-in offer, not a default.

When you submit a form on the marketing site (the contact form, a demo request, or a newsletter sign-up), here's what happens:

• The fields you fill in (name, email, company, role, message) are sent over TLS to our backend.
• They're stored in our customer-relationship database so a human on our team can reply.
• A copy is routed to our shared inbox via transactional email (sub-processor: an email provider bound by a DPA).

What we don't do:

• Send your form content to AI model providers.
• Use it to train AI models.
• Share it with marketing partners or sell it to third parties.

Form submissions are retained while we have an active conversation with you and for a reasonable follow-up window after; you can request deletion at any time by emailing Info@getmedusa.ai.

Connecting an ad platform stores an OAuth token, not your password. Tokens are encrypted at rest using envelope encryption with rotated keys. You can revoke any connection from the Platforms screen inside Medusa, which deletes the token from our store and revokes our read access at the source.

When you connect a Google Ads account, Medusa requests access through Google OAuth (scope https://www.googleapis.com/auth/adwords). We use it only to read your Google Ads account details (account name, currency, time zone), campaign names and statuses, and daily campaign performance metrics (impressions, clicks, cost, conversions and conversion value). Medusa never creates, edits or deletes campaigns, ads, budgets or any other Google Ads data.

We use this data solely to provide Medusa's features to you: performance dashboards and reporting, budget optimisation, forecasting, and AI-generated recommendations for your own account. We do not sell Google user data, use it for advertising, or use it to train generalised AI or machine-learning models. Where AI features process this data, we send it to OpenAI for inference only, and it is not used to train OpenAI's models.

OAuth tokens are encrypted at rest (AES-256-GCM), and data is stored in the European Union (Germany). You can disconnect Google Ads at any time from the Platforms page in Medusa, or revoke access at https://myaccount.google.com/permissions. When you delete your account, your data is permanently erased within 30 days. For questions, contact privacy@getmedusa.ai.

Data is hosted on industry-standard cloud infrastructure (currently AWS in the EU and US regions) with encryption in transit (TLS 1.2+) and at rest (AES-256). Access to production systems is restricted to a small operations team, gated behind SSO and MFA, and audit-logged.

We run regular security reviews and have a coordinated disclosure policy. If you spot something concerning, email Info@getmedusa.ai.

We do not sell your data. We share it only with sub-processors who help us run the service: cloud hosting, payment processing, transactional email, product analytics, and marketing analytics (currently LinkedIn and Reddit, for measuring which ads bring visitors to this site). Each is bound by a data processing agreement where one applies.

We will disclose data if compelled by valid legal process, and where allowed we will tell you first.

Depending on where you live (GDPR, UK GDPR, CCPA and friends), you have rights to access, correct, delete or port your data, and to object to certain processing. Email Info@getmedusa.ai and we'll get it done. No dark patterns, no friction.

Account and workspace data is retained while your account is active. If you delete your account, we purge your data within 30 days, except where we're required to keep limited records (billing, tax) longer. You can also export your plans at any time.

Marketing site cookies. The site at getmedusa.ai uses essential cookies for session state and a small set of marketing analytics cookies described below. No third-party advertising cookies are dropped from cold visits other than the ones listed here.

LinkedIn Insight Tag. We use the LinkedIn Insight Tag on this marketing site to measure which LinkedIn ads bring visitors to us and to build retargeting audiences on LinkedIn. The tag loads a small script from snap.licdn.com and may set cookies on your browser. LinkedIn receives your IP address, browser and device information, page URL and referrer when the tag fires. We never send LinkedIn your name, email, or any account data.

LinkedIn acts as an independent controller for the data the Insight Tag collects. Their handling is governed by LinkedIn's Privacy Policy. You can opt out of LinkedIn advertising cookies from LinkedIn's opt-out page, and you can block third-party cookies in your browser settings or via the Global Privacy Control signal (which we honour).

Reddit Pixel. We use the Reddit Pixel on this marketing site to measure which Reddit ads bring visitors to us and to build retargeting audiences on Reddit. The pixel loads a small script from www.redditstatic.com and may set cookies on your browser. Reddit receives your IP address, browser and device information, page URL and referrer when the pixel fires. We never send Reddit your name, email, or any account data.

Reddit acts as an independent controller for the data the pixel collects. Their handling is governed by Reddit's Privacy Policy. Both pixels only load after you accept analytics cookies, and neither loads if your browser sends a Global Privacy Control signal.

Product app cookies. The product app at app.getmedusa.ai uses cookies for authentication and lightweight product analytics (event names and timings, not content).

When we update this policy materially, we'll email account holders and date-stamp the new version at the top. Minor wording fixes (typos, clarifications) go in quietly.

Questions, a data request, or a security report? Email Info@getmedusa.ai. A human replies within one working day.