Privacy policy

This policy explains what data ScaleYourOnlineAds processes, why, and what rights you have. ScaleYourOnlineAds is operated by Tube Marketing Ninja LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States ("we"). Privacy contact: privacy@scaleyouronlineads.com.

Roles

• For the accounts of our team and of our clients, and for the ad account data we read, we are the controller.
• For the visitors of a client's website, the client is the controller and we process the data on its behalf, under a data processing agreement. Visitors who want to exercise their rights should contact the website owner; we help the owner answer.

Data we process

Users of the platform

Name, email address, password hash, two-factor authentication settings, role in each workspace, and a log of important actions (sign-ins, changes, publications) kept for security.

Ad account data (Meta, Google Ads, TikTok)

When a person who manages an ad account connects it, we receive an access token and read, for that account only:

• the list of ad accounts the person can access, with name, currency and time zone;
• campaigns, ad sets (ad groups) and ads: identifiers, names, status, budget and parent;
• daily performance: spend, impressions, clicks, and the conversions and conversion value reported by the platform.

The connection is read-only: we do not create, change or delete anything in the ad account through it. Tokens are stored encrypted and are never shown again after the connection; the interface only displays the last four characters. We do not read personal data of the people who saw the ads, and we do not sell, rent or use ad account data for advertising of our own.

Google user data. ScaleYourOnlineAds's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from the Google Ads API is used only to show the connected account's reporting inside ScaleYourOnlineAds; it is not transferred to third parties except the infrastructure providers listed below, and it is not read by humans except to provide support at your request, for security, or to comply with the law.

Visitors of client websites

The tracking script, installed by the website owner, records: pages viewed, referrer, campaign parameters and ad click identifiers in the address, approximate location derived from the IP address, browser, operating system and device type, screen size and language, form submissions and purchases. Email addresses and phone numbers entered in forms are stored by the website owner's workspace; the analytics store only keeps their cryptographic hashes.

Where the website owner enables it, the script also collects device signals (screen and display characteristics, processor and memory class, graphics card, operating system and model, time zone, languages, system preferences, installed fonts, and canvas and audio rendering characteristics) to recognize the same device across visits and browsers. This is never done on websites set to cookieless mode, after a visitor opts out, or when the browser sends the Global Privacy Control signal. The website owner is responsible for obtaining consent where the law requires it.

Conversions sent to ad platforms

When the website owner enables it, confirmed conversions (for example a purchase) are sent to the conversion API of Meta or TikTok with the event name, time, value, currency, ad click identifiers and email or phone number hashed with SHA-256. Clear contact data is removed from our queue once the event is sent.

Purposes and legal bases

• Providing the platform to our team and clients: performance of a contract.
• Reading ad account data and comparing it with website tracking: performance of a contract with the client who owns the account.
• Security, fraud prevention and audit logs: legitimate interest.
• Website tracking and device signals: on behalf of the website owner, on the legal basis it determines (usually consent).

Providers

• Cloudflare, Inc.: hosting, storage, databases, email delivery and bot protection.
• Anthropic, PBC: AI features (copywriting and campaign assistant) on the content our team sends to it. Ad account data is sent only when a team member asks the assistant about it.
• Pipeboard: management of campaigns (creation and edits) that our team performs explicitly; it is separate from the read-only connection described above.

Some providers are in the United States; transfers rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

Retention

• Platform accounts: while the account is active, then deleted within 30 days.
• Ad account data: while the connection is active. Disconnecting stops reading at once and deletes the token; reporting already collected stays in the client's workspace until the client deletes it.
• Website tracking: raw events 90 days by default (configurable by the website owner), journeys up to 13 months, aggregated statistics without personal data indefinitely. Device signals follow the same rules as the visitor they belong to.

Your rights

You can ask for access, correction, deletion, restriction, portability and object to processing, and withdraw consent at any time, by writing to privacy@scaleyouronlineads.com. You can also lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali). To remove an ad account connection and its data, see Data deletion.

Changes

We will publish any change on this page with a new date. Material changes are also announced inside the platform.