User Data Deletion Instructions

1. Purpose

This document explains how you can request deletion of personal data that OpenWay AI, Inc. ("OpenWay AI", "we", "our", or "us") holds about you, including data we obtain through integrations with Meta (Facebook, Instagram, WhatsApp), Google (Workspace, Ads, Analytics, Search Console), and other connected platforms.

This document is published to satisfy:

• The User Data Deletion requirement of the Meta Platform Terms and Meta Developer Policies, which require an active, publicly accessible URL where users can find clear instructions on how to request deletion of their data.
• The right to erasure under the EU General Data Protection Regulation (GDPR), UK GDPR, the California Consumer Privacy Act / California Privacy Rights Act (CCPA / CPRA), and other applicable data-protection laws.
• The data-deletion expectations of the Google API Services User Data Policy.

This document is part of, and should be read together with, our Privacy Policy and our Terms of Service.

2. Scope: What Data Can Be Deleted

You may request deletion of the following categories of data:

• Account data: name, email, password hash, profile information, organization membership.
• User Content: marketing campaigns, landing pages, ad creatives, audience descriptions, business documents, prompts, AI Outputs, drafts, and any other content you have created or uploaded.
• Usage and telemetry data: usage logs, session data, feature interaction data linked to your account.
• Meta Platform Data: any data obtained from Meta APIs in connection with your account (Facebook user ID, Pages metadata, Ad Account metadata, campaign data, Pixel/Conversions API records, Instagram and WhatsApp business data).
• Google user data: any data obtained from Google APIs in connection with your account (Google profile data, Drive files we have processed, Gmail metadata, Google Ads campaign data, Google Analytics or Search Console data).
• Other third-party integration data: data obtained from LinkedIn, TikTok, HubSpot, Salesforce, Shopify, or other connectors you have authorized.
• Communications: support tickets and correspondence, where deletion is permissible.

Deletion does not extend to data we are legally required to retain (see Section 8 below).

3. How to Request Deletion

You have four ways to request deletion. Choose the method that best fits your situation.

Method A — In-product self-service (fastest)

• Sign in to OpenWay AI at https://app.openway.ai.
• Navigate to Settings → Privacy & Data → Delete my data.
• Choose what to delete: specific User Content (campaigns, generated assets, uploads); disconnect a third-party integration (Google, Meta, etc.) — this revokes our access and triggers deletion of cached data from that integration within 30 days; or delete your entire account — this initiates deletion of all data associated with your account.
• Confirm the request. We will display a confirmation code for your records.

Method B — Email request

Send an email to team@openway.ai from the email address associated with your account, with the subject line "Data Deletion Request — [your account email]".

Include in the body:

• The data you wish to delete (e.g., "entire account", "all Google integration data", "specific campaign ID 12345").
• Your full name and any account identifiers (such as workspace name).
• The country of your residence (so we can apply the correct legal procedure).
• Whether you are submitting on behalf of a child or another person (and your authority to do so).

We will acknowledge your request within 5 business days and confirm completion within the timeframe required by applicable law (typically 30 days for GDPR, up to 45 days extendable for CCPA).

Method C — Disconnect a third-party account directly

You can revoke OpenWay AI's access to a connected third-party account at any time. This will prevent any further data flow from that account to OpenWay AI, and we will delete cached third-party data within 30 days.

• Google: visit https://myaccount.google.com/permissions — find "OpenWay AI" and remove access.
• Meta (Facebook / Instagram): visit https://www.facebook.com/settings?tab=business_tools — find "OpenWay AI" and remove. For personal Facebook accounts: Settings → Apps and Websites.
• LinkedIn: Settings → Data Privacy → Permitted Services → remove OpenWay AI.
• Other integrations: the relevant third-party account or app dashboard.

Method D — Meta-initiated deletion request (for Facebook/Instagram/WhatsApp users)

If you are a Facebook, Instagram, or WhatsApp user and you have used OpenWay AI through Meta integration, you can also request deletion of your data through Meta:

• Go to your Facebook Settings & Privacy → Settings → Apps and Websites.
• Find OpenWay AI in your active or removed apps.
• Click Remove, then View Removed Apps and Websites → View → Send Request.

Meta will forward your deletion request to OpenWay AI through our Data Deletion Request Callback endpoint. Within reasonable time (typically no more than 30 days), we will initiate deletion of all data associated with your Meta user identifier, and provide you with a tracking URL and confirmation code where you can check the status of your request.

If you prefer to verify your deletion status directly with us instead of via Meta, you can email team@openway.ai with the confirmation code Meta provides.

4. Verification of Identity

To protect you from unauthorized deletion requests, we will verify your identity before processing certain requests. Verification may include:

• Confirming control of the email address associated with your account.
• Re-authenticating into the Service.
• For requests via Meta or Google, validating the signed request payload from the platform.
• For agents acting on your behalf, written authorization plus your verification.

If we cannot verify your identity with reasonable certainty, we may decline to fulfill the request and will explain why.

5. Timeframes

• Acknowledgment of request — within 5 business days.
• Identity verification — up to 10 business days.
• Completion of deletion (standard) — within 30 days of verified request.
• Completion (CCPA/CPRA) — within 45 days, extendable once by 45 days where reasonably necessary, with notice to you.
• Completion of Google user data deletion after disconnection — within 30 days.
• Completion of Meta Platform Data deletion after disconnection or callback — within 30 days.
• Confirmation of completion — sent to your email and (where applicable) via the tracking URL.

We may extend timeframes only where lawfully permitted and will notify you of any extension and the reasons.

6. What Happens When You Request Deletion

When we process a verified deletion request, we will:

• Delete or irreversibly anonymize the requested data from our production systems.
• Instruct our subprocessors (cloud hosting, AI/ML providers, analytics, etc.) to delete corresponding copies, in accordance with our data-processing agreements.
• Remove data from active backups as those backups are rotated out (typically within 90 days). Encrypted backup snapshots that have not yet rotated are isolated and access-restricted; they are not used for any purpose other than disaster recovery and are overwritten on the next rotation.
• Disconnect linked third-party accounts and notify the relevant platform that we have processed the deletion (where required, e.g., Meta callback response).
• Send you confirmation of completion, including a confirmation code where applicable.

For Meta-initiated requests, we will also return a JSON response to Meta containing a status URL and a confirmation code, in compliance with the Meta Data Deletion Callback specification.

You can check the status of any deletion request at https://app.openway.ai/data-deletion-status by entering the confirmation code we provided.

7. Special Cases

7.1 Multi-user workspaces

If you are part of a shared workspace or organization account, deleting your individual account will remove your personal data and contributions, but content created on behalf of, or shared with, the workspace may remain unless the workspace administrator also requests deletion. We will notify you if this is the case.

7.2 Data shared with other users

Data you have shared with collaborators (e.g., a campaign you co-edited) may remain accessible to those collaborators in their own accounts, even after you delete your account. We will remove your authorship attribution and any personal identifiers.

7.3 Active legal hold

If your data is subject to an active legal hold, litigation, or regulatory investigation, we may be required to retain it until the hold is lifted. We will notify you if this applies.

7.4 Sub-13 / minors

We do not knowingly collect data from individuals under 18 (and never under 13). If you believe a minor has created an account, please contact team@openway.ai and we will delete the data without verification beyond confirming the age claim.

8. Retention Required by Law

We may retain certain data after a deletion request, only for as long as required and only for the specified purpose:

• Billing and tax records: compliance with U.S. and foreign tax law — up to 7 years.
• Anti-fraud and abuse signals: prevention of repeat abuse — up to 24 months, in pseudonymized form.
• Records of the deletion request itself: demonstrating compliance with deletion obligations — up to 24 months.
• Data subject to litigation hold: legal obligation — until hold released.
• Aggregated, de-identified analytics: already not personal data — indefinitely.

In all cases, retained data is access-restricted and not used for any other purpose.

9. Your Other Rights

In addition to deletion, you may have the following rights under applicable law:

• Access: request a copy of your personal data.
• Rectification / correction: correct inaccurate data.
• Restriction: restrict processing in certain cases.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact team@openway.ai or use the in-product Settings → Privacy menu. See our Privacy Policy for details.

10. Contact

For all data deletion requests and questions about this document:

• OpenWay AI, Inc.
• Attn: Privacy Team
• 901 N Market Street, Suite #100
• Wilmington, Delaware, 19801
• United States of America

• Email: team@openway.ai
• In-product: Settings → Privacy & Data → Delete my data
• Status check: https://app.openway.ai/data-deletion-status

If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. For users in the EU, the relevant authority is the data protection authority of the EU member state in which you reside or work, or where the alleged infringement occurred. For users in the UK, the relevant authority is the Information Commissioner's Office (ICO) at https://ico.org.uk.