Privacy policy

Last updated October 1, 2026

Wrangled is a marketing tool for businesses. Each business that uses it gets its own walled-off workspace. People in the business connect their ad accounts and other marketing tools, and Wrangled copies their marketing data into the workspace so the business and the AI assistants it chooses can read it. This page says what we keep, why, who can see it, how long we keep it, and how to have it deleted.

What we keep

• Your sign-in. We use Clerk to sign people in. Clerk keeps your name, email address and which business organizations you belong to. We keep the Clerk ids of your account and organization.
• Facebook sign-ins. When someone presses "Connect with Facebook", we keep the access token Facebook gives us, the permissions it grants, and the Facebook user id and name of the person who approved. The token is encrypted before we store it, and the app never shows it to anyone.
• Other keys and sign-ins. Keys a business pastes in for its other tools, such as GoHighLevel or Stripe, are encrypted the same way. We keep the settings of each connected source, such as which ad accounts to copy.
• Meta ad data. For the ad accounts a business picks, we copy its ad accounts, campaigns, ad sets and ads (including their names, text, audience settings and budgets), daily and weekly performance numbers, and each ad's creative: its headline, main text, button, image and video. Images and videos go into private file storage.
• Data from other tools. If a business connects its CRM, payment or tracking tools, we copy the records it picks from them. These can include its own customers' contact details and purchases. We hold them for the business and use them only to provide Wrangled to it.
• Events sent to us. A business can give its tools a web address that sends us events, such as a form being filled in. We keep each event as it arrives.
• Tool runs and the creative ledger. When someone in a workspace runs a tool, such as making an ad image, we keep what they asked for, what came back, what it cost, and any images or videos it made. The creative ledger keeps a record of each ad creative with its own code.
• API keys. We keep a one-way scrambled copy of each key a workspace makes, never the key itself, and when it was last used.

Why we keep it

Only to run Wrangled for the business that connected it: to show how its ads are doing, to let its team and its AI assistants study the numbers, to suggest new ads and ad changes for a person to approve, and to keep its connections working. We do not sell any of it, we do not use it to show ads to anyone, and we do not use one business's data for another.

Who can see it

• The members of the business's workspace, and the API keys they make, which see that workspace only.
• The services we use to run Wrangled: Vercel hosts the app, Supabase holds the database and files, and Clerk handles sign-in. When someone runs a tool, we send that tool's provider what the tool needs, such as the prompt for an image.
• The people who operate Wrangled, when they need to in order to keep it running or to answer a request from the business.

Each workspace is walled off. One business cannot see another business's data.

How long we keep it

• A key or sign-in stays until someone in the workspace removes it, which deletes the key or token at once. If the person who approved a Facebook sign-in removes Wrangled on Facebook, we stop using their sign-in but keep it until they ask Facebook to send us a deletion request, or until someone asks us by email.
• Copied ad data and other copied records stay in the workspace until the business asks us to delete them. They belong to the business, so removing one person's Facebook sign-in does not delete them.
• Events sent to us are kept until the business deletes the address that received them or removes the source.
• Tool runs, the images and videos they made, and the creative ledger stay until the business asks us to delete them.

How to have data deleted

• An admin of the workspace can press "Remove key" on the Sources page. That deletes the saved key or token at once and stops every source that used it. For a Facebook sign-in, the person's Facebook user id and name stay on our record of it until Facebook sends us their deletion request, or until someone asks us by email.
• Anyone who connected with Facebook can first remove Wrangled in their Facebook settings, under Apps and Websites (or Business Integrations). That only stops us using their sign-in. To have their data deleted, they then open the list of removed apps, select Wrangled, and send the deletion request. Facebook passes it to us, and we delete their access token, Facebook user id and name, and give them a confirmation code. The data-deletion page explains each step and shows the status of a request.
• Anyone can also ask us by email to delete their data, and a business can ask us to delete its copied data or its whole workspace: support@wrangled.co.

Keeping it safe

Keys and tokens are encrypted before we store them. Each workspace's data sits in its own part of the database, which only that workspace can read. Images and videos sit in private storage and open only through links that stop working after 10 minutes.

Changes and questions

If we change this policy, we will update this page and the date at the top. Questions go to support@wrangled.co.