Privacy Policy

Last updated: August 25, 2026  ·  Version 2.1

1. Data we collect

1.1. Data you provide

• Identification: name, email and user ID provided through Facebook Login or Google OAuth
• Authentication credentials: Meta, Google and TikTok OAuth tokens (encrypted with AES-256-CBC before being stored)
• Subscription data: payment information processed by Stripe or Asaas (we do not store card data)
• Preferences: chosen theme, language, favorite accounts, saved filters

1.2. Data collected automatically

• Usage data: access logs, IP, user-agent, pages visited
• Session cookies: only those required for authentication (HTTPOnly, Secure)
• Ad metrics: data from your Meta Ads, Google Ads and TikTok Ads accounts (spend, impressions, clicks, conversions, ROAS) accessed through official APIs

1.3. Data we do NOT collect

• Facebook, Google, Meta or TikTok passwords (authentication is through OAuth: we never see your password)
• Credit card data (processed by the payment gateways)
• Private content from your social networks
• Third-party data unrelated to your ad account

2. How we use your data

• Providing the Service: allowing you to manage ads, create campaigns and view metrics
• Authentication: identifying and authenticating you through OAuth
• API integration: interacting with the Meta Marketing API, Google Ads API and TikTok Marketing API on your behalf
• Notifications: sending relevant alerts (low balance, automated rules, sales recorded through webhooks)
• Support: answering questions and solving problems
• Improvements: analyzing aggregate usage to improve the platform (without individual identification)
• Legal compliance: meeting tax, accounting and regulatory obligations

We do not use your data to: sell it to third parties, run targeted advertising on other platforms, or make automated decisions that affect your rights without human review.

3. Legal basis (LGPD)

• Performance of a contract (art. 7, V): to provide the contracted Service
• Consent (art. 7, I): to send non-essential notifications
• Legitimate interest (art. 7, IX): for security, fraud prevention and product improvement
• Compliance with a legal obligation (art. 7, II): for tax and regulatory data

4. Data sharing

We only share data with:

• Meta Platforms: to perform operations on your Meta Ads accounts through the official API (only the operations you request)
• Google LLC: to perform operations on your Google Ads accounts through the official API (only the operations requested)
• TikTok Pte. Ltd.: to perform operations on your TikTok Ads accounts through the official API (only the operations you request)
• Payment gateways (Stripe, Asaas): to process subscriptions
• Infrastructure providers (Cloudflare, our own server): for hosting and database, with no human access to the data except in the case of authorized technical support
• Competent authorities: only upon court order, applicable law or official investigation

We do not sell, rent or share data with third parties for marketing purposes.

5. Storage and security

5.1. Where we store it

Data is stored in our own PostgreSQL database, with automatic backups. The infrastructure is hosted on servers in Europe and Brazil, with access restricted by SSH key.

5.2. Encryption

• OAuth tokens (Meta, Google, TikTok): AES-256-CBC at rest
• Connections: TLS 1.2+ on all requests
• Session cookies: HTTPOnly + Secure + SameSite=Lax
• Passwords for protected reports: bcrypt with salt

5.3. Retention

• Account data: kept for as long as the account exists
• OAuth tokens: invalidated upon disconnection or every 60 days
• Access logs: 90 days
• Data after account deletion: removed within 30 days (except for legal obligations)

6. Your rights (LGPD)

You have the right to:

• Access (art. 18, II): request a copy of your data
• Correction (art. 18, III): correct incomplete or inaccurate data
• Anonymization or deletion (art. 18, IV and VI): request the removal of your data
• Portability (art. 18, V): receive your data in a structured format
• Withdrawal of consent (art. 18, IX): cancel at any time
• Information about sharing (art. 18, VII): know who we share data with

6.1. How to exercise your rights

• Delete your account: disconnect Meta, Google and TikTok in the settings and request deletion by email
• Revoke Meta access: Facebook Settings → Apps
• Revoke Google access: My Google Account → Third-party app access
• Revoke TikTok access: TikTok Business Center → Settings → Partners and apps
• Direct contact: [email protected]. We respond within 72 hours

7. Cookies and tracking

We only use essential cookies:

• user_session: to identify you between requests
• fb_access_token: to restore your session with Meta
• metaads_theme: to remember your visual preference

We do not use third-party analytics cookies or advertising tracking pixels within the platform.

8. International transfer

Some providers (Meta, Google, TikTok, Cloudflare) store data on servers outside Brazil. These transfers take place under international adequacy (art. 33 of the LGPD) or standard contractual clauses.

9. Minors

Ads Editor is intended for professionals over 18 years of age. We do not knowingly collect data from minors. If we identify any, we remove it immediately.

10. Changes to this Policy

We may update this Policy from time to time. Significant changes will be communicated by email and/or by a notice on the platform at least 15 days in advance.

11. Contact of the data protection officer (DPO)

This Policy complies with the LGPD (Brazilian General Data Protection Law, Law No. 13,709/2018), the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet, Law No. 12,965/2014) and the policies of the Meta Developer Platform, the Google API Services User Data Policy and the TikTok Business Products (Data) Terms.