Privacy Policy
Privacy Policy
This Privacy Policy explains how OptimusPhil.io, OptimusBlogs, OptimusAds (Bright & Epic Ads Intelligence) and OptimusSocial collect, use, protect and provide control over information, including data authorized through Google and Meta APIs.
1. Who we are
OptimusPhil.io is operated by Bright & Epic USA Inc.. The website presents digital marketing, development, automation, infrastructure and AI visibility services. OptimusAds, also referred to as Bright & Epic Ads Intelligence, is our Google Ads connection, analysis and campaign-management application. OptimusSocial is our restricted social-media publishing integration for Facebook Pages and Instagram professional accounts that Bright & Epic is authorized to manage. For privacy questions or data requests, contact hello@optimusphil.io.
2. Information we collect
We may collect information you provide directly, information collected automatically through website technology, and limited technical data generated when you use website tools.
- Contact form data: name, email address, optional phone number, country, industry, project type, budget range, message content and consent confirmation.
- Technical data: IP address, browser type, device type, referring pages, visited pages, approximate location, timestamps and interaction events.
- AI Visibility Scanner data: the submitted target URL, scan metadata and technical output may be stored for compliance, abuse prevention, security review, debugging and service improvement.
- Marketing and analytics data: events collected through tools such as Meta/Facebook Pixel, analytics platforms, Google services or similar tracking technologies.
- Google Ads and Ads Intelligence data: authorized Google Ads account and campaign data, customer business profiles, audits, recommendations, campaign drafts, approvals and related activity records.
- Meta and OptimusSocial data: authorized Facebook Page and Instagram professional-account identifiers, Page names, Instagram usernames, account relationships, granted permissions, publishing credentials, campaign content, captions, hashtags, accessibility text, images or videos, schedules, publication status, returned post or media identifiers, and technical success or error records.
- Firebase-related data: if Firebase services are used for tool functionality, logs, hosting, analytics, authentication, storage or diagnostics, Firebase may process technical data needed to provide those services.
3. How we use information
- To respond to inquiries and project requests.
- To provide, maintain, secure and improve the website, free tools, OptimusBlogs and Bright & Epic Ads Intelligence.
- To authenticate authorized administrators and provide Google Ads connection, synchronization, analysis, recommendation, reporting and explicitly approved campaign-management features.
- To verify authorized Facebook Pages and Instagram professional accounts; prepare, schedule and publish approved social-media content; confirm delivery; prevent duplicate publication; and diagnose failed publication attempts through OptimusSocial.
- To analyze website performance, traffic sources, conversion behavior and user experience.
- To run remarketing, advertising measurement and audience optimization where permitted.
- To prevent spam, abuse, automated submissions and misuse of scanner functionality.
- To comply with legal, security, operational and documentation obligations.
4. OptimusSocial and Meta Platform data
OptimusSocial is a restricted business tool operated by Bright & Epic USA Inc. to publish approved organic content to Facebook Pages and Instagram professional accounts. It is not offered as a public consumer application. Access is limited to Bright & Epic personnel, system users and business assets that have been expressly assigned or shared by an authorized business administrator.
Depending on the permissions granted by Meta and the connected business, the application may access Facebook Page identifiers and names, Instagram professional-account identifiers and usernames, the relationship between a Page and an Instagram account, permission and account-status information, and content required for publication. The application may create Page posts and Instagram media containers, publish photos or videos and captions, read the limited account metadata needed to verify the destination, and receive publication identifiers and technical status information from Meta.
The application does not use Meta Platform data for data brokerage, credit decisions, surveillance, unrelated advertising or the creation of independent consumer profiles. It does not request private-message, comment-management or advertising permissions as part of its social-publishing function.
5. Meta access credentials and continuing account access
Meta access tokens and related credentials are stored only in restricted secret-management or server configuration systems and are not intentionally placed in source-code repositories, campaign packages, public files, screenshots or ordinary application logs. Credentials are used only to perform authorized account verification and publishing operations.
A Page or Instagram account administrator may stop future access by removing the applicable partner, system user, business integration or asset assignment in Meta Business Settings; revoking the application through Meta's account or business settings where available; requesting token revocation; or contacting us. Removing access may prevent scheduled content from being published.
6. Meta data retention and deletion
Campaign content, publishing schedules, account identifiers, post identifiers, duplicate-prevention records and operational logs may be retained while the applicable customer relationship or publishing campaign remains active and for a reasonable period afterward for security, troubleshooting, documentation and legal compliance. Access tokens are retained only while continuing access is authorized or operationally required and are revoked, replaced or deleted when access ends or credentials are rotated.
To request deletion of information associated with OptimusSocial, email hello@optimusphil.io with the subject “OptimusSocial Data Deletion” and identify the relevant business, Facebook Page or Instagram username. Do not send passwords, access tokens or other secrets. After verifying authority over the applicable business asset, we will delete or de-identify the associated data unless limited retention is required for security, dispute resolution or law. This section serves as the user-data deletion instructions for the application.
7. Bright & Epic Ads Intelligence and Google Ads data
Bright & Epic Ads Intelligence, available at ads.optimusphil.io, is a business application for connecting, analyzing and managing authorized Google Ads accounts. It requests the Google Ads API scope https://www.googleapis.com/auth/adwords only after an authorized user chooses to connect an account. Google Ads provides this single scope for the account-reading and account-management functions used by the Application.
With the user's authorization, the Application may access customer and manager account identifiers, account names, campaigns, campaign status, budgets, bidding settings, targeting, schedules, ad groups, advertisements, creative text, final URLs, keywords, search terms, assets, conversion goals, performance metrics and change information returned by the Google Ads API.
This data is used to show available advertiser accounts; import and synchronize campaign information; audit and monitor performance; generate visible reports, recommendations, advertising copy and improved campaign drafts; and create paused campaigns or apply campaign, ad group, advertisement or keyword changes only after an authorized user explicitly reviews and approves the applicable action.
Google Ads API data is not used for unrelated advertising, retargeting, credit decisions, data brokerage or surveillance.
8. OAuth credentials and continuing account access
During account connection, Google OAuth credentials are encrypted while the short connection workflow is active. They are used to identify accessible advertiser accounts and, when requested, complete the connection between the selected advertiser and the Bright & Epic Google Ads manager account. Temporary user OAuth credentials are cleared and a revocation request is made after the connection succeeds, is cancelled or expires.
After a successful connection, scheduled synchronization, monitoring, analysis and approved campaign operations are performed through Bright & Epic's configured service account and the Google Ads manager relationship, rather than by retaining the connecting user's OAuth refresh token.
An authorized user may stop future access by removing the manager-account relationship in Google Ads, removing the customer workspace in the Application, revoking the application's Google authorization through Google Account connections, or contacting us.
9. AI processing and service providers
Relevant Google Ads evidence, campaign settings and customer-provided business context may be processed by OpenAI to produce the Application's user-facing audits, summaries, recommendations, advertising copy and campaign plans. Hosting, database, infrastructure, email, security, backup and other contracted providers may also process limited data solely as needed to operate and secure the requested services.
Google Ads data is not sold, rented or shared with unrelated third parties and is not used by Bright & Epic for interest-based advertising. Service providers act only to deliver the Application's visible functionality, maintain security or satisfy legal obligations and are expected to protect the information they process.
10. Google Ads data retention and deletion
Imported Google Ads data, audits, campaign drafts, proposals and related customer records are retained while the customer workspace is active and as reasonably necessary to provide the requested service. An authorized administrator can delete a customer workspace from the Application. This removes the local customer record and associated imported campaigns, audits, reviews, drafts and proposals. Limited security, transaction or activity records may be retained where necessary to document authorized actions, prevent abuse, resolve disputes or comply with law. Residual backup copies expire according to our operational backup cycle.
Deleting a local workspace does not delete campaigns from Google Ads. To terminate continuing manager-account access, the advertiser should also remove the applicable manager link in Google Ads or ask us to do so. Requests to access, correct or delete data can be sent to hello@optimusphil.io.
11. Google API Services User Data Policy
Bright & Epic USA Inc.'s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Google user data is used only to provide or improve user-facing features that are visible and relevant within the requesting Application.
- Google user data is not sold, used for serving advertisements, transferred to data brokers or used to determine creditworthiness.
- Human access is limited to situations where the user gives affirmative permission, access is required for security or support, access is required by law, or the data has been aggregated for lawful internal operations.
12. Cookies, analytics and advertising pixels
The website may use cookies, pixels, tags, local storage and similar technologies. These technologies may support essential website functionality, analytics, conversion measurement, Meta/Facebook Pixel, advertising optimization, security and preference handling. More detail is available in the Cookie Policy.
13. Service providers
We may use trusted third-party providers for website hosting, source control and automation, email delivery, analytics, advertising, Firebase services, security, form processing, backups, diagnostics and AI-related tool functionality. Meta processes Facebook and Instagram data under its own terms and policies. These providers may process data only as needed to deliver their services.
14. General data retention
Contact inquiries are retained as long as reasonably necessary for business communication, follow-up, documentation and legal compliance. Scanner URL submissions and related technical records may be retained for compliance, security, debugging and abuse prevention. Analytics and advertising data may be retained according to the settings and policies of the relevant providers.
15. Your choices and rights
Depending on your location, you may have rights to request access, correction, deletion, restriction or a copy of personal information. You may also opt out of certain analytics or marketing technologies through browser settings, consent tools, platform settings or industry opt-out mechanisms.
16. Security
We use reasonable technical and organizational safeguards designed to protect information, including encrypted transmission, access controls, restricted secret storage, encrypted temporary OAuth credentials, restricted infrastructure access and activity records for sensitive actions. No website, transmission or storage method can be guaranteed to be completely secure.
17. Contact
For privacy-related requests, contact hello@optimusphil.io.
OptimusBlogs · WordPress + ChatGPT
18. How OptimusBlogs works
OptimusBlogs is the WordPress plugin and connected ChatGPT app developed by Philipp Marvin Mueller under the OptimusPhil.io brand. The service at blogs.optimusphil.io is operated by Bright & Epic USA Inc. This policy covers its account, connection and publishing services as well as the main website.
You install and authorize the WordPress plugin separately on each blog. Your OptimusBlogs account links the websites you authorize to the ChatGPT app. Requests pass through our service to the selected blog, and the requested results return to your ChatGPT conversation. Connecting one website does not authorize another.
AI writing and image generation take place through the tools available in your own ChatGPT account. OptimusBlogs does not require you to provide an OpenAI API key. The app receives the specific tool inputs, files and resources supplied for your request; it does not retrieve your full ChatGPT conversation history.
19. Data we process and why
| Information | Purpose and location |
|---|---|
| Account and access | Username, email address, password hash, account language, verification and password-reset records, authorization permissions and tokens. Stored on the service to provide sign-in, account emails and authorized access. Passwords belong in the secure sign-in form, not in a ChatGPT message. |
| Blog connections | Website URL and identifiers, connection endpoints, the associated account, connection status and encrypted website access credentials. These route requests to the blog you selected. The blog stores its own authorization information and the WordPress user who approved access. |
| Blog content and writing profile | Titles, URLs, categories, author information, post status, article text, relevant pages, SEO fields, language, audience, tone, writing preferences and saved analysis. The selected content passes between your WordPress site, our service and ChatGPT for analysis, topic review, internal linking and editing. The saved profile and your posts live in your WordPress installation. |
| Unpublished content | Authorized inventory and editing requests can include private posts, drafts, pending and scheduled posts, so topic checks consider existing work. This information is shared with ChatGPT when returned by the relevant tool. Public website analysis uses public content. Authorization is not limited to material already visible to visitors. |
| Images and files | Files or temporary download references supplied by ChatGPT, filenames, media identifiers, alt text, captions and your selected original logo. The WordPress blog imports the image, applies the logo and stores the resulting JPG in its media library. Our service relays file references and metadata; it does not operate a central image library for customer blogs. |
| Plan and operation records | Account allowances, website and post identifiers, publication dates and status, plus records that prevent duplicate actions. The hub stores usage records; the blog also stores operation results and content fingerprints. When the host supplies a conversation identifier, the hub stores a hashed association to the selected blog to prevent requests switching to another website. |
| Support and security | Messages you send us, connection errors and technical request data such as IP addresses and timestamps may be processed by our hosting, email and security systems to deliver support and protect the service. Do not include passwords, access tokens or sensitive personal information in support messages or article prompts. |
Article text passes through our service when a requested action needs it. The connector does not maintain a separate central library of customers’ articles. Operational records and provider logs are separate from the articles and media stored on your blog.
We use this information to perform your requested actions, manage permissions and allowances, diagnose failures and prevent abuse. OptimusBlogs does not use connected-blog content for advertising profiles or sell it to data brokers. It has no feature that uses your blog content to train our own general-purpose AI model. OpenAI’s handling of content in your ChatGPT account is governed separately by its policies and your account controls.
20. Who receives information
- OpenAI / ChatGPT: receives tool results and selected blog content to respond to your requests. Your ChatGPT conversation, generated content and settings are handled under OpenAI’s Privacy Policy and applicable account terms.
- Your WordPress hosting provider: stores your posts, media and plugin settings and processes requests to your website. The plugins you install there may also process the content; for example, your selected SEO plugin handles SEO metadata.
- Our infrastructure providers: Hetzner provides OptimusBlogs hub hosting; SiteGround provides hosting for the main website and the configured email service. Hosting, email, security and backup providers process the information needed to operate those services. Account emails include sign-up and password-reset messages.
- Authorized personnel: may access necessary information to respond to your support request, operate the service or investigate security incidents. Information may also be disclosed where required by law or necessary to protect legal rights.
- Your readers: receive content when you choose to publish it. A draft is not made public merely because it is saved to WordPress; sharing preview links or changing its status can change who can see it.
We are based in the United States. Information may be processed in the United States and in other countries where you or the relevant providers operate. Applicable data-protection requirements continue to apply; provider terms and the safeguards applicable to a particular transfer depend on the service used.
21. Retention and deletion
| Record | Retention or expiry |
|---|---|
| Service account and blog connections | Kept while the account or connection is maintained. Removing a blog from the service removes that connection entry. Disconnecting a blog or removing the ChatGPT app does not itself delete your service account. Request account deletion through the contact route below. |
| Temporary authorization records | Access tokens expire after one hour; refresh tokens expire after 30 days unless refreshed or revoked sooner. Blog-connection requests expire after one hour and image-upload tickets after 15 minutes. Expiry ends their validity; it is not an immediate deletion guarantee. The connector’s cleanup removes token records more than one day past expiry when cleanup runs. |
| Publication and duplicate-prevention records | Kept to enforce allowances, reconcile interrupted operations and avoid repeating a completed action. These records do not currently have a fixed automatic deletion period. They are included in the review of an account-deletion request, with any necessary legal or security exception explained to you. |
| Your WordPress posts, media and profile | Remain on your blog until you or an authorized administrator deletes them under your hosting and WordPress settings. Disconnecting or uninstalling the connector is not a command to delete that material. We cannot remove independent copies held by your hosting provider, visitors or other recipients merely by closing the service account. |
| ChatGPT conversations and files | Managed separately through your OpenAI account and its retention controls. Deleting your OptimusBlogs account does not delete a ChatGPT conversation. |
| Support, security logs and backups | Retention depends on the purpose of the record and the relevant hosting, email or backup system. A deletion request includes a review of these records and any residual backup copies. Where limited retention is necessary for security, disputes or legal obligations, we explain the applicable reason and retention criteria rather than promising immediate removal from every backup. |
22. Your controls and data requests
- Review and edit the writing profile in your blog’s OptimusBlogs settings. Your deliberate edits take priority over later analysis suggestions.
- Keep the blog in Drafts only mode to prevent publication through the connector. Allow publishing only when you want to permit publication or scheduling on request.
- Use the blog’s Disconnect control to revoke that installation’s access. You can also ask us to remove a connection from your service account and disconnect the app in ChatGPT. These controls affect different connections; use the relevant controls on both sides when ending access completely.
- To request account deletion, access, correction or an export of your service data, use our contact page or email welcome@optimusphil.io with “OptimusBlogs data request,” your account email and the relevant blog URL. Do not send passwords or tokens. We verify your authority using proportionate information and respond within the period required by applicable law.
Depending on the law that applies to you, you may also have rights to object, restrict processing, receive portable data, withdraw consent for consent-based processing, or complain to your local data-protection authority. Withdrawing consent does not affect processing already lawfully carried out. Where applicable data-protection law requires a legal basis, account administration and requested services rely on performing our agreement with you; proportionate security and support processing relies on our legitimate interests in operating a reliable service; records required by law rely on legal obligations; and optional consent-based features rely on your consent. The basis depends on the particular processing and the law that applies.