Privacy Policy

Last updated: October 14, 2026

This Privacy Policy explains how Grupo Mozzaca LLC, doing business as Lotus Media ("Lotus"), collects, uses and protects personal information through lotusmedia.ai and the Lotus OS platform.

1. Information we collect

Account information: name, work email, company, role and login activity.
Billing information: billing contact and payment details. Card and bank details are collected and stored by our payment processor, Stripe; Lotus does not store full card or bank account numbers.
Connected platform data: when you connect advertising accounts (for example Google Ads or Meta), we access campaign, ad, audience, budget and performance data through each platform's official API, with the permissions you grant.
Usage data: how the Services are used, including AI feature usage and credits, for security, billing and improvement.
Communications: messages you send us or the in-app assistant.

We do not seek to collect sensitive personal information and ask you not to submit it.

2. How we use information

To provide and secure the Services; to audit, optimize and report on connected accounts as you instruct; to bill you; to support you; to improve the Services and to create aggregated and de-identified benchmarks that do not identify you, your clients or any individual, only with your authorization; for data received from Google APIs, only as described in section 3; and to comply with law.

3. Google user data

Lotus OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads data only for the features you see in Lotus OS: your report, your audit, your alerts and, if you allow it, the AI features described in section 5. We do not sell it, we do not use it for advertising to you or anyone else, and we do not use it to train general-purpose AI models.

Google Ads data, only for your account. Google Ads data is used only for the features of the account that provided it. It is not combined with other accounts' data in aggregated datasets, raw or derived, and it is not included in benchmarks.

Improving Lotus OS. Data from your accounts on other connected platforms may be combined and de-identified to operate and improve the features you see in Lotus OS: for example, to calibrate the rules and thresholds of the audit. For this purpose it stays inside Lotus and is never sold, shared with other customers or third parties, used for advertising or used to train general-purpose AI models.

Benchmarks. With your express, separate authorization, which you give or withdraw in Settings, we include performance results derived from your accounts on other connected platforms, never from Google Ads (such as changes in spend, cost per result and results over time), in the benchmarks shown inside Lotus OS, combined with those of other customers so that no customer, account or individual can be identified. A benchmark is shown only when it combines at least 5 customers. The authorization is optional, is not required to use the Services, and can be withdrawn at any time in Settings; after withdrawal, your results are excluded from every benchmark calculated from then on. Figures already delivered cannot be recalled.

People at Lotus see your Google Ads data only if you allow it for support, for security, or when the law requires it. Automated processing that runs the Services (synchronization, audits, alerts and, for accounts at the Optimize or Autopilot level, the platform fee calculation) does not involve people reading your data.

When you give ads@lotusmedia.ai access in Google Ads, or link your account to the Lotus MCC, the Lotus team sees that account because you gave it access; that access is your permission. To withdraw it, remove that access in Google Ads or remove the account in Lotus OS.

When you unlink a Google Ads account, disconnect Google in Lotus OS or revoke Lotus OS's access in your Google Account, Lotus OS stops reading that account and, 30 days later, automatically deletes the campaigns, daily metrics, history and audits it read from that account through the Google Ads API. If you give access to the same account again within those 30 days, nothing is deleted. Reports already generated in Lotus OS are kept until you ask us to delete them at privacy@lotusmedia.ai. Deleted data may remain in our daily database backups for up to 7 days, until those backups are automatically discarded.

4. Meta platform data

We access Meta data through the Meta Marketing API under Meta's Platform Terms, only to provide the features you request. You can disconnect access at any time from Lotus OS or from your Meta business settings, and you can ask us to delete data obtained from Meta by writing to privacy@lotusmedia.ai.

5. AI processing

Lotus OS's AI features ("Lotus OS AI") process the data needed for each request with the AI model providers listed in section 6, under terms that do not allow them to use your data to train their models. From your Google Ads accounts, Lotus OS AI uses campaign names and performance figures (spend, clicks, conversions and similar), never your keywords, search terms or audit results, and only if you accept: when you connect your accounts with "Connect Google Ads" or, if the Lotus team connects your accounts for you, with your acceptance when you create your account. You can connect without AI features and withdraw that permission at any time in Lotus OS (in Accounts or Connections); without it, those features work without AI. Credits and AI usage are recorded for billing and security.

6. Sharing

We share data only with these providers, which process it on behalf of Lotus Media under their data processing addendum:

Supabase: database and sign-in (United States).
Vercel: application hosting.
Anthropic: AI models for Lotus OS AI, only with your permission; it does not train on your data.
Resend: application emails (alerts and invitations).
Google (Workspace): sign-in email and Lotus email.
Stripe: payments; Lotus does not store card or bank details.
Cloudflare: bot protection and DNS.

We also share information with the advertising platforms you connect, when required by law, or in a merger or acquisition subject to this Policy. We do not sell personal information.

7. International transfers

Lotus is based in the United States and serves customers in Latin America. Information may be processed in the United States and other countries with safeguards appropriate to applicable law.

8. Retention

We keep information while your account is active and as needed for legal, billing and security purposes. Data received from Google APIs is deleted as described in section 3. Other data from connected accounts is deleted or de-identified within 90 days after you disconnect the account or close your account, unless law requires otherwise.

9. Security

We use encryption in transit, isolated workspaces per agency and customer, role-based access, multi-factor authentication for administrators and activity logs. No system is perfectly secure; we will notify you of a breach affecting your information as required by law.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, port or object to the processing of your personal information, including rights under US state privacy laws, Mexico's Federal Law on Protection of Personal Data Held by Private Parties (ARCO rights), Colombia's Law 1581 of 2012 and the Dominican Republic's Law 172-13. Write to privacy@lotusmedia.ai and we will respond within the time required by law.

11. Children

The Services are for businesses and are not directed to children under 18.

12. Changes and contact

We will post updates here and notify you of material changes. Contact: Grupo Mozzaca LLC (DBA Lotus Media), 2180 Brickell Ave, Unit 1, Miami, FL 33129, USA · privacy@lotusmedia.ai