Privacy Policy
Disclaimer: This document is a draft template for guidance only and is not legal advice. Have a qualified attorney review it for your business, jurisdictions, and data practices before publishing.
Last updated: June 22, 2026
Introduction & Who We Are
CampaignRx (“CampaignRx,” “we,” “us,” or “our”) is a software-as-a-service (SaaS) product operated by Cypress Maker LLC. We provide online tools and related services through campaignrx.com and associated applications (collectively, the “Service”).
This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, create an account, subscribe, or use the Service. It also describes your privacy rights and how to contact us.
We serve users worldwide. Depending on where you live, additional rights or disclosures may apply. Sections labeled for specific regions are included for that purpose.
Assumption: Cypress Maker LLC is the data controller for personal data processed through the Service, unless we state otherwise for a specific feature.
Personal Data We Collect (by category)
We collect personal data in the following categories, depending on how you interact with us:
Account and profile data
- Name, email address, and login credentials (or sign-in details if you use a third-party login provider)
- Account preferences and settings
- Communications you send to us (support requests, feedback)
Billing and subscription data
- Subscription plan, billing status, and transaction history
- Payment-related identifiers (processed by our payment provider; we do not store full payment card numbers)
Note: Stripe collects and processes payment card details on our behalf. See Sharing & Processors.
Service and usage data
- Actions you take in the Service (for example, features used, reports generated, and configuration choices)
- Connected advertising account data you authorize us to access (for example, campaign, ad set, and performance metrics needed to provide audits and recommendations)
- Technical logs such as IP address, browser type, device information, timestamps, and error logs
Analytics and cookies data
- Website and product usage data collected through cookies and similar technologies
- Aggregated or pseudonymous analytics from Google Analytics 4 (GA4), such as pages viewed, referral source, and general interaction patterns
Marketing and communications data (if applicable)
- Your marketing preferences
- Records of emails or messages we send you and whether you opened or clicked them
We do not intentionally collect sensitive categories of data (such as health, biometric, or government ID data) unless you voluntarily provide them in a support message and we need them to help you.
How We Use Data (purposes + legal bases where applicable)
We use personal data for the purposes below. Where GDPR or UK GDPR applies, we rely on the legal bases noted.
| Purpose | Examples | Legal basis (EU/UK) |
|---|---|---|
| Provide the Service | Create and manage your account; run audits; display reports; connect integrations you authorize | Contract |
| Billing and administration | Process subscriptions; send receipts; manage renewals and cancellations | Contract; Legal obligation (tax/accounting where applicable) |
| Customer support | Respond to questions; troubleshoot issues; improve help resources | Contract; Legitimate interests |
| Security and fraud prevention | Monitor for abuse; protect accounts; maintain system integrity | Legitimate interests; Legal obligation where required |
| Analytics and product improvement | Understand how the Service is used; fix bugs; develop features | Legitimate interests; Consent where required for non-essential cookies |
| Marketing (if you opt in) | Send product updates or offers | Consent; you may withdraw at any time |
| Legal compliance | Respond to lawful requests; enforce our terms | Legal obligation; Legitimate interests |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects, unless we clearly tell you and provide required choices.
California note: We do not “sell” or “share” personal information for cross-context behavioral advertising as those terms are commonly defined under California law. If that changes, we will update this policy and provide required opt-out mechanisms.
Sharing & Processors (with examples)
We share personal data only as needed to operate the Service, comply with law, or with your direction. We do not sell your personal data.
Service providers (processors)
We use trusted vendors that process data on our instructions, including:
| Provider | Role | Typical data shared |
|---|---|---|
| Stripe | Payment processing and subscription management | Name, email, billing details, transaction metadata |
| Google Analytics (GA4) | Website/product analytics | Online identifiers, usage events, device/browser data |
| Amazon Web Services (AWS) | Cloud hosting, storage, and infrastructure | Account data, Service content, logs, and backups as needed to run the Service |
These providers may access data only to perform services for us and are contractually required to protect it.
Connected third-party accounts
If you connect an external advertising or business account, we access data you authorize solely to provide the Service. That third party’s own privacy policy also applies to data held on their platform.
Other disclosures
We may disclose data:
- To professional advisers (lawyers, accountants) under confidentiality obligations
- In connection with a merger, acquisition, or asset sale (with notice where required)
- When required by law, court order, or to protect rights, safety, and security
International Transfers (if any)
Cypress Maker LLC is based in the United States. If you access the Service from outside the U.S., your data may be transferred to, stored in, or accessed from the U.S. and other countries where we or our providers operate.
EU/UK: When we transfer personal data from the European Economic Area, UK, or Switzerland to countries without an adequacy decision, we use appropriate safeguards such as Standard Contractual Clauses and supplementary measures where needed.
You may request more information about transfer safeguards by contacting us.
Data Retention
We keep personal data only as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law.
| Data type | Typical retention |
|---|---|
| Account data | For the life of your account, plus a reasonable period after deletion for backups and legal needs |
| Billing records | As required for tax, accounting, and dispute resolution (often several years) |
| Support communications | As long as needed to resolve issues and improve support |
| Analytics data | According to GA4 settings and our internal retention schedules |
| Logs and security data | Short to medium term, unless needed for incident investigation |
When data is no longer needed, we delete or anonymize it where feasible.
Custom input needed: Confirm your backup retention period and whether connected ad account data is deleted immediately or after [X days] following disconnection.
Your Rights (GDPR/UK GDPR, CCPA/CPRA)
Your rights depend on where you live. We will not discriminate against you for exercising privacy rights.
EU/UK residents (GDPR / UK GDPR)
You may have the right to:
- Access a copy of your personal data
- Rectify inaccurate data
- Erase data in certain circumstances
- Restrict or object to certain processing
- Data portability for data you provided, where applicable
- Withdraw consent at any time (without affecting prior lawful processing)
- Lodge a complaint with your local supervisory authority
To exercise these rights, contact us at contact@campaignrx.com. We may need to verify your identity. We respond within the timeframes required by law (generally one month under GDPR/UK GDPR).
California residents (CCPA/CPRA)
You may have the right to:
- Know what personal information we collect, use, disclose, and retain
- Access specific pieces of personal information
- Delete personal information, subject to exceptions
- Correct inaccurate personal information
- Opt out of sale or sharing for cross-context behavioral advertising (we do not sell/share as described above)
- Limit use of sensitive personal information (we do not collect sensitive categories for unrelated purposes)
Authorized agents: California residents may use an authorized agent to submit requests. We may require verification of the agent’s authority.
Shine the Light: California residents may request information about disclosures to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing.
Submit requests to contact@campaignrx.com with “California Privacy Request” in the subject line. We will verify your request as required by law.
Other U.S. states
Residents of Colorado, Connecticut, Virginia, Utah, and other states with privacy laws may have similar rights. Contact us and we will honor applicable requests.
Cookies & Analytics (link to Cookie Policy if separate)
We use cookies and similar technologies to operate the website, remember preferences, measure performance, and understand usage.
Types of cookies
- Strictly necessary: Required for security, authentication, and core functionality
- Analytics: Help us understand traffic and usage (including GA4)
- Functional or preference: Remember choices you make
Where required, we ask for your consent before placing non-essential cookies.
Managing cookies
You can control cookies through:
- Our cookie banner or preference center (if enabled)
- Your browser settings (block or delete cookies)
- Google’s opt-out tools for analytics: https://tools.google.com/dlpage/gaoptout
Custom input needed: If you publish a separate Cookie Policy, link it here: [Cookie Policy URL]
Blocking certain cookies may affect how the Service works.
Security Measures
We use administrative, technical, and organizational measures designed to protect personal data, including:
- Encryption in transit (HTTPS/TLS)
- Access controls and authentication for systems and staff
- Infrastructure hosted on reputable cloud providers (AWS)
- Monitoring and logging for security events
- Vendor due diligence for processors handling personal data
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us promptly at contact@campaignrx.com.
Children’s Privacy
The Service is not directed to children under 16 (or 13 where local law sets a lower age for online consent without parental approval). We do not knowingly collect personal data from children.
If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on campaignrx.com and update the “Last updated” date. Where required, we will provide additional notice (for example, by email or in-product message).
Your continued use of the Service after the effective date of an updated policy means you accept the changes, except where further consent is required by law.
Contact Information
Data controller: Cypress Maker LLC (CampaignRx)
Website: https://campaignrx.com
Email: contact@campaignrx.com
Custom input needed:
- Postal address for Cypress Maker LLC (required in many jurisdictions)
- EU/UK representative (if you target or monitor individuals in the EU/UK and are required to appoint one)
- Data Protection Officer (DPO) — if appointed, add name and contact details; otherwise state: “We have not appointed a DPO. For privacy inquiries, use the email above.”
For privacy requests, include enough detail for us to identify your account and the right you wish to exercise.