Privacy Policy

1. Who we are

Freshlytics is a campaign optimization and reporting platform for TikTok Ads, operated by Noa Digital ("Freshlytics", "we", "us"). For personal data described in this policy, Noa Digital is the controller unless stated otherwise. You can reach us at privacy@freshlytics.site.

2. Scope of this policy

This policy covers the Freshlytics website at freshlytics.site, the Freshlytics web application, and the communications we send to customers and people who contact us. It does not cover TikTok's own processing of your data — see the TikTok Privacy Policy and the terms of your TikTok advertiser account for that.

3. Data we collect

3.1 Data you give us

• Account data: name, work email address, company name, role, and a password hash or single sign-on identifier.
• Workspace configuration: target CPA and ROAS values, alert routing, saved views, automation rules and similar settings you create.
• Communications: the content of emails, beta access requests and support messages you send us, including anything you choose to include in them.

3.2 Data we receive from TikTok on your instruction

When you authorize Freshlytics for one or more TikTok ad accounts, we receive advertising data through the TikTok Marketing API. This is described in section 4.

3.3 Data collected automatically

• Application logs: IP address, browser user agent, timestamps and the requests made to our application, used for security, debugging and abuse prevention.
• Website server logs: standard access logs kept by our hosting and CDN providers.

We do not use advertising trackers, third-party analytics scripts, session recording or fingerprinting on this website.

4. TikTok advertising data

Freshlytics accesses TikTok data only through the official TikTok Marketing API, only for ad accounts you explicitly authorize, and only with the permissions listed on our how it works page. We never scrape TikTok, never use unofficial endpoints and never ask for your TikTok password.

What we receive: ad account details (name, ID, currency, time zone), campaign, ad group and ad structure, delivery settings, creative metadata and thumbnails, and aggregated performance metrics such as spend, impressions, clicks, conversions and video engagement.

What we do not receive or request: personal data about the TikTok users who saw, clicked or converted on your ads; audience or Custom Audience member lists; email or phone identifiers; organic account content, followers, comments or direct messages.

How we use it: solely to provide the Freshlytics service to your workspace — producing your reports, analysis, alerts and, where you enable it, the changes you approve. We do not sell TikTok data, do not share it with other customers, do not use it to build cross-customer benchmarks, and do not use it to train machine learning models for other customers or third parties.

Deletion: you can disconnect an ad account at any time, which stops all further collection. On request we delete the associated data as described in section 9 and on our data deletion page. We also honour deletion requirements imposed by TikTok's developer terms.

Where you are the advertiser, you act as the controller of the advertising data in your ad accounts and we act as your processor.

5. How we use data

• To provide, operate and secure the Freshlytics service
• To sync, normalize, analyse and display your advertising data
• To send you the alerts, reports and notifications you configure
• To answer support requests and beta access enquiries
• To monitor for abuse, debug problems and improve reliability
• To send occasional service messages, such as changes to this policy or to pricing
• To comply with legal obligations

We do not use your data for behavioural advertising, and we do not sell or share personal data as those terms are defined under the CCPA/CPRA.

6. Legal bases (GDPR)

• Contract: providing the service to you and your workspace.
• Legitimate interests: securing the service, preventing abuse, improving reliability, and responding to your enquiries — balanced against your rights.
• Consent: where required, for example optional product update emails, which you can withdraw at any time.
• Legal obligation: for accounting, tax and lawful requests.

7. Sharing and sub-processors

We share data only with the service providers needed to run Freshlytics, under contracts that restrict their use of it. The current list is published on our Security & data page and includes our hosting provider, our CDN provider and our transactional email provider.

We may also disclose data if required by law, to protect our rights or the safety of others, or as part of a merger or acquisition — in which case we will notify affected customers in advance and the acquirer will remain bound by this policy.

We do not sell personal data. We do not disclose your advertising data to other customers.

8. International transfers

Our servers are located in the European Union. Where a sub-processor is outside the EEA or the UK, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism. A copy of the relevant safeguards is available on request.

9. Retention

• Account data: for as long as your account exists, then deleted within 30 days of a deletion request.
• TikTok authorization tokens: until you disconnect the ad account or revoke access in TikTok Business Center, then deleted promptly.
• Advertising data: rolling 13 months, so year-on-year comparisons work; deleted earlier on request.
• Application and access logs: 30 days.
• Business records: invoices and similar records for as long as tax law requires.
• Backups: encrypted backups roll over within 14 days, after which deleted data no longer exists in them.

10. Security

We use TLS for data in transit, AES-256 encryption at rest, encrypted storage of OAuth tokens, role-based access control, mandatory two-factor authentication for staff with production access, and audit logging. Details are on the Security & data page. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant supervisory authority as required by law, without undue delay and within 72 hours of becoming aware.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you
• correct inaccurate data
• delete your data ("right to be forgotten")
• restrict or object to processing, including profiling
• receive your data in a portable, machine-readable format
• withdraw consent at any time, without affecting prior processing
• not be discriminated against for exercising CCPA/CPRA rights
• lodge a complaint with your data protection authority

To exercise any of these, email privacy@freshlytics.site. We answer within 30 days and may ask you to verify your identity first. If you are an end user of one of our customers, please contact that customer — we will forward your request to them and assist as their processor.

12. Cookies

This marketing website sets no cookies and loads no third-party trackers. The Freshlytics web application uses strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We do not use advertising or analytics cookies in the application. If that ever changes, we will ask for consent first and update this section.

13. Children

Freshlytics is a business tool and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the product changes. The "last updated" date at the top always reflects the current version, and we notify workspace owners by email before any material change takes effect.

15. Contact

Noa Digital — Freshlytics
Privacy and data requests: privacy@freshlytics.site
General enquiries: support@freshlytics.site
Website: freshlytics.site