Privacy Policy

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, when you connect an advertising account, or when you contact us. The personal information we collect may include the following:

• Email addresses — used to create your account and to send you the sign-in link. We do not use passwords.
• Contact or authentication data — the access token issued by Meta when you connect an advertising account, and the local API key you enter to connect your antidetect browser.

Sensitive information. We do not process sensitive information.

Information we receive from Meta

When you connect a Facebook advertising account, Meta asks you to approve a specific set of permissions. We request only the following, and use each of them only as described here:

• ads_read — to read your advertising accounts, their status and currency, and the impressions, clicks, spend, and delivery status of your ads. This is what the analytics in Obelista is built from.
• ads_management — to create and change campaigns, ad sets, and ads at your explicit instruction. Everything Obelista creates is created paused.
• business_management — to determine which business portfolio an advertising account belongs to, so accounts are grouped correctly.
• pages_show_list and pages_read_engagement — to list the Pages you may run ads from and to read the Instagram account linked to a Page.
• public_profile — to show your name in the interface so you can tell connected accounts apart.

We do not request and do not read your private messages, friends list, news feed, photos, or anything unrelated to advertising accounts.

Information automatically collected

In short: Some information — such as your IP address and browser characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include your IP address, browser type and settings, operating system, language preferences, referring URLs, and information about how and when you use our Services. It is needed to maintain the security and operation of our Services and for our internal analytics and reporting purposes.

Log and usage data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files.

In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

• To facilitate account creation and authentication and otherwise manage user accounts. So you can create and sign in to your account and keep it in working order.
• To deliver and facilitate delivery of services to the user. To provide you with the analytics and campaign tools you asked for.
• To respond to user inquiries and offer support.
• To send administrative information. Including the sign-in link you request, and changes to our terms and policies.
• To protect our Services. Including diagnosing problems, and monitoring and preventing fraud and abuse.
• To identify usage trends. To understand how the Services are used so we can improve them.
• To save or protect an individual’s vital interest. Where necessary to prevent harm.

In short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on. We may rely on the following:

• Consent. Where you have given us permission to use your personal information for a specific purpose. You may withdraw your consent at any time.
• Performance of a contract. Where necessary to fulfil our obligations to you, including providing our Services.
• Legitimate interests. To analyse how our Services are used so we can improve them, and to diagnose problems and prevent fraudulent activity.
• Legal obligations. Where necessary for compliance with law, or to exercise or defend our legal rights.
• Vital interests. Where necessary to protect your vital interests or those of a third party.

In short: We may share information in the specific situations described in this section, and with the categories of third parties listed here.

Vendors, consultants, and other third-party service providers. We may share your data with third parties who perform services for us or on our behalf and require access to do that work. We have contracts in place with them, designed to safeguard your personal information. They cannot do anything with your personal information unless we have instructed them to, and they may not share it with anyone apart from us.

The categories of third parties we may share personal information with are:

• Cloud computing services
• Data storage service providers
• Website hosting service providers
• User account registration and authentication services
• Social networks — specifically Meta, whose API provides your advertising data

Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

In short: We use a small number of cookies, and only the ones needed for the Services to work.

We use cookies to keep you signed in, to remember your interface preferences, and to maintain the security of your account. We do not use cookies for advertising, and we do not allow third parties to place advertising or tracking technologies on our Services.

Most browsers accept cookies by default. You can set your browser to remove or reject cookies, but if you do, parts of the Services will stop working — you will not be able to stay signed in.

In short: We offer optional features powered by artificial intelligence. They run only when you start them.

As part of our Services, we offer features powered by artificial intelligence (“AI Products”). The terms in this Privacy Notice govern your use of the AI Products within our Services.

Use of AI technologies

We provide the AI Products through third-party service providers (“AI Service Providers”), including Anthropic and OpenAI. Where you use an AI Product, your input and the resulting output are shared with and processed by these AI Service Providers. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products

Our AI Products are designed for the following functions:

• AI insights — analysing the performance of your creatives and suggesting what to scale or stop.
• AI automation — assembling and launching campaigns from a specification you have approved.

How to opt out

The AI Products are optional and run only when you explicitly start them. If you never use them, none of your information is sent to any AI Service Provider. You can also contact us at robertgoodell1994@sikatanc.com with any question about this.

In short: When you connect a Facebook advertising account, we receive a limited set of profile information from Meta.

Our Services let you connect your Facebook advertising account through Meta’s official login dialog. Where you choose to do this, we receive your name and your Facebook user ID, together with the advertising data covered by the permissions you approve — see information we receive from Meta above. We do not receive your friends list, your profile picture, your messages, or your feed.

We use the information we receive only for the purposes described in this Privacy Notice. Please note that we do not control, and are not responsible for, other uses of your personal information by Meta. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information.

In short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. Regardless of your location, your information may be transferred to, stored by, and processed by us and by the third parties with whom we share it (see when and with whom do we share your personal information), including facilities in the United States and other countries.

If you are a resident of the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, these countries may not have data protection laws as comprehensive as those in your own. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

European Commission’s Standard Contractual Clauses

We rely on the European Commission’s Standard Contractual Clauses for transfers of personal information between us and our third-party service providers. These clauses require all recipients to protect personal information originating from the EEA or UK in accordance with European data protection law. Details can be provided on request.

In short: We keep your information for as long as you have an account with us, unless a longer period is required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. No purpose in this notice will require us to keep your personal information for longer than the period in which you have an account with us.

Access tokens are an exception. When you disconnect an advertising account in Obelista, or revoke access from within your Facebook settings, the access token is deleted from our systems immediately — we do not wait for your account to be closed. From that moment we can no longer read anything from Meta on your behalf.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it, or, if this is not possible (for example, because it has been stored in backup archives), we will securely store it and isolate it from any further processing until deletion is possible.

In short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. You should only access the Services within a secure environment.

In short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at robertgoodell1994@sikatanc.com.

In short: In some regions, such as the EEA, the UK, and Switzerland, you have rights that allow you greater access to and control over your personal information.

These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information.

You can make such a request by contacting us at robertgoodell1994@sikatanc.com, or through our data request page. We will consider and act upon any request in accordance with applicable data protection laws.

Complaints

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you have the right to complain to your Member State data protection authority or the UK Information Commissioner’s Office. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

If you complain to us first: we will acknowledge your complaint within 30 days of receiving it, investigate without unjustifiable delay, and keep you informed of progress and of the outcome.

Withdrawing your consent

If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us at robertgoodell1994@sikatanc.com. Please note that this will not affect the lawfulness of the processing before its withdrawal, nor will it affect processing conducted in reliance on lawful grounds other than consent.

Account information

If you would at any time like to review or change the information in your account, or terminate your account, you can contact us using the contact information provided. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and/or comply with applicable legal requirements.

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently.

If you have questions or comments about this notice, you may email us at robertgoodell1994@sikatanc.com or contact us by post at:

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.

To review, update, or delete your personal information, follow the instructions on our data request page, or write to us at robertgoodell1994@sikatanc.com.