Privacy Policy

Information we collect

Account information, for each person who signs in:

• Email address and name.
• A salted hash of your password. We never store the password itself. If you enable two-factor sign-in, its secret is stored encrypted and recovery codes are stored as hashes.
• Session records (hashed session tokens and their timestamps) so you stay signed in.
• Your organization memberships, roles and invitations.
• An audit log of the actions you take in the product: who did what, to which record, and when. It does not record your IP address.

Advertising account information, only for the ad accounts you or your organization choose to connect:

• Access tokens issued by Meta or Google when you approve the connection. They are encrypted before they are stored and are used only to call the provider on your behalf.
• The identifier, name, currency, time zone and granted permissions of each connected ad account.
• Campaigns, ad sets, ad groups, ads, budgets and related settings of those accounts, and the Facebook Pages and pixels the accounts can use.
• Daily performance and conversion metrics reported by the provider.
• A history of changes to those campaigns and a record of each change made through the product.

We use your network address only transiently, to limit repeated sign-in attempts. We do not collect information about the people who see or click your ads beyond the aggregated metrics the providers report.

How we use information

• To sign you in and keep your account secure.
• To show your organization the structure and performance of its connected ad accounts.
• To create and edit campaigns, ad sets, ads and budgets when an authorized member asks us to.
• To record changes so your organization can review what happened and who did it.
• To send service email such as invitations and password resets.

We do not sell your information, we do not use it for advertising or profiling, and we do not use it to train machine-learning models.

Meta and Google data

Data we receive through the Meta Marketing API and the Google Ads API is used only to provide the features described above to the organization that connected the account. It is visible only to members of that organization and to the staff we assign to support it.

The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our use of Meta data follows the Meta Platform Terms.

Sharing

We share information only with service providers that host the product and deliver its email, acting on our instructions, and when the law requires it. Requests you make through the product are sent to Meta or Google for the ad account they concern.

Cookies

We use only the cookies needed to keep you signed in and to protect your session. We do not use advertising or analytics cookies.

Security

Each organization's data is isolated from every other organization's in the database. Provider access tokens are encrypted at rest, connections to the product use HTTPS, and access is limited by role.

Retention and deletion

We keep your information while your organization uses the product. Disconnecting an ad account stops all further access to it. You can ask us at any time to delete the stored tokens and advertising data of your organization; see Data deletion for how, and for what is kept afterwards.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information and to object to or restrict its use. To exercise any of these rights, write to [email protected].

Changes

When this policy changes we update the date at the top of this page, and we tell organization administrators about material changes.

Contact

sixtynine digital, Schiemond 20, 3024 EE Rotterdam, the Netherlands. Email: [email protected].