Who we are
Wilmor (wilmor.ai) is an AI ad-management service. You connect your ad accounts, tell Wilmor what you're promoting, and it writes and designs the ads, sets up the campaigns and keeps them running inside the rules you set. “We” and “us” on this page mean Wilmor. If anything here is unclear, write to hello@wilmor.ai and a person will answer.
What we collect
Your account
Your name, your email address and a password. We store the password as a one-way hash, so we can check it but never read it.
Your connected ad accounts
When you connect Meta, you sign in on Meta's site and approve the access. Meta then gives us an access token, which is a key that lets Wilmor act on the ad accounts you chose. We store that token encrypted (AES-256-GCM, with a key kept outside the database), along with the basic details of those accounts: their names and IDs, and the Facebook Pages your ads run from. It is decrypted only for the moment a request to the ad platform is made. We never see or store your Meta password.
Your website content
Wilmor reads the public pages of the website you give it, the same pages any visitor can see, to build a brand profile: your business name, what you sell, how you talk, your colours and your product photos. We store that profile. We also store any photos you upload yourself, such as product shots or before-and-after photos of your work.
Your campaigns and their results
The campaigns, ad sets and ads Wilmor builds or syncs for you, including budgets, targeting, ad copy, images and video. We also read performance numbers from the ad platforms, such as spend, impressions, clicks and conversions. These are totals. We do not receive the names or contact details of the people who see or click your ads.
The free trial
If you make a free ad on our home page, we keep the email address and website you entered and the headline of the ad we made. We don't keep the ad image or the brand profile we built to make it. To limit the trial to one per person and keep bots out, we also store a scrambled (hashed) version of your IP address with each request. We never store the IP address itself, and the hash can't be turned back into it.
The waitlist
If you join the early-access waitlist on our home page, we keep your email address, the date you joined, and where you came from: the campaign tags in the link you followed (for example, an ad), or “direct” if there were none. That's all. We don't store your IP address or your browser details with it, and to stop the form being flooded we only check how often your network has submitted it recently, in memory, without writing that down.
Basic technical data
Like most websites, our hosting provider's servers record things such as your IP address, browser type and the pages you request. We use a cookie to keep you signed in. We don't run advertising trackers on wilmor.ai.
How we use it
- To run the service: build your brand profile, create ads, set up and manage campaigns, and report back on how they're doing.
- To keep your spending inside the limits and approvals you've set.
- To talk to you about your account, such as problems with it or changes to the service.
- If you joined the waitlist, to email you when you can connect your Meta account. We don't use that address for anything else.
- To keep Wilmor secure, prevent abuse and fix bugs.
We don't sell your data. We don't share it with advertisers or data brokers.
Wilmor keeps a record of what you and Wilmor change on your ad account and what happened afterwards: what was changed or refused, why, and how the ads did. We read those records ourselves to improve Wilmor. Nothing trains automatically on your data today, and if that changes we'll tell account holders before it does. Two things never change: your business information, creative and results are never shown to another customer, and your brand, products and copy are never used in anyone else's ads.
Data we receive from Meta is used only to run the features you see in Wilmor and to improve them, in line with Meta's Platform Terms.
Who else is involved
Running Wilmor means working with a few other companies. Each one only gets what it needs to do its job.
- Meta. We use Meta's official Marketing API to read your ad accounts and to create and manage campaigns for you. What you publish through Wilmor is also handled under Meta's own terms and privacy policy.
- Companies that work for us. The companies that process data on our behalf, and what each one gets, are listed at wilmor.ai/subprocessors.
- When the law requires it. We'll hand over information if we're legally required to, and we'll tell you when we're allowed to.
If Wilmor is ever bought or merged, your data would move to the new owner under the same promises made here, and we'd tell you first.
Some of these companies are in the United States or other countries, so your data may be processed outside the country you live in.
How long we keep it
- While your account is open, we keep your account, connected accounts, brand profile, uploads and campaign data so the service works.
- When you disconnect an ad account (the Disconnect button in its brand kit on the Accounts page), its access token, brand profile, uploaded photos, campaigns and creatives are deleted from Wilmor immediately.
- When you delete your Wilmor account (Delete my account, on the Settings page), everything tied to it is deleted immediately, including any free trial or waitlist entry made with the same email address.
- Backups. Deleted data can remain in our database backups for up to 30 days before it is purged from those too.
- Waitlist entries are kept until you ask us to delete yours, or until you delete a Wilmor account opened with the same email address, which deletes it too.
- Free trial entries made without an account don't expire on their own. We keep them so the one-free-ad-per-person limit keeps working, until you ask us to delete yours. The hashed IP records aren't linked to your email address or to any account.
- We may keep a small amount for longer where the law requires it.
Deleting data from Wilmor doesn't delete campaigns that already exist in your Meta ad accounts. Those belong to you and stay under your control there. The step-by-step version is on our data deletion page.
Security
All traffic to and from Wilmor is encrypted in transit. Passwords are hashed. Ad platform access tokens are encrypted at rest. Access to production data is limited to the people who need it to run the service. We connect to ad platforms only through their official sign-in flows, and you can cut off our access at any time, either in Wilmor or from the ad platform's own settings.
No system is perfectly secure. If a breach ever affects your data, we'll tell you promptly and say what happened and what we're doing about it.
Your rights
Wherever you live, you can ask us to:
- show you the data we hold about you, and give you a copy;
- correct anything that's wrong;
- delete your data;
- stop using your data in a particular way.
You can delete your data yourself at any time from the Settings page. For anything else, email hello@wilmor.ai from the address on your account and we'll respond within 30 days. We won't charge you or treat you differently for asking. If you're in the EU, the UK or California, these rights are backed by law (GDPR, UK GDPR and the CCPA), and you can also complain to your local data protection authority.
Children
Wilmor is a tool for businesses. It isn't meant for anyone under 18, and we don't knowingly collect their data.
Changes to this policy
If we change this policy we'll update the date at the top. If a change is significant, we'll email account holders before it takes effect.
Contact
Questions, requests or complaints: hello@wilmor.ai.
This policy is effective from October 4, 2026.