Privacy Policy for One

Effective Date: September 14, 2026

Last Updated: September 14, 2026

One (“we”, “our”, or “us”) operates the SaaS media planning and cross-platform ad trafficking software platform. This Privacy Policy outlines how we collect, use, process, and protect information when you connect your advertising accounts—including Meta Ads, Google Ads, TikTok Ads Manager, Display & Video 360 (DV360), and Campaign Manager 360 (CM360)—to our platform.

 

1. Information We Collect

To provide multi-channel campaign orchestration, audience forecasting, and ad trafficking services, we collect and process the following categories of data:

  • User Account Information: Name, corporate email address, password hash, and company details provided upon registration.
  • API Credentials and Access Tokens:
    • Meta Ads: System User Access Tokens, Page IDs, and Business Manager IDs.
    • Google Ads / DV360 / CM360: OAuth 2.0 Refresh Tokens, Developer Tokens, GCP Service Account Credentials, Customer IDs, and User Profile IDs.
    • TikTok Ads: Advertiser IDs, Access Tokens, and Business Center IDs.
  • Campaign & Ad Data: Campaign configurations, budget allocations, ad creatives (images/videos), targeting parameters, ad metrics, and conversion tracking event parameters.
  • Audience Data: Anonymized, aggregated audience taxonomies, custom audience segment metadata, and first-party customer lists uploaded strictly for hashing/matching purposes.

 

2. How We Use API Data & Third-Party Integrations

Data obtained through platform APIs is strictly used to deliver core platform functionalities:

  • Google Ads & DV360 API Data: We use Google API access strictly to create, read, update, and manage campaigns, ad groups, assets, and performance reporting as configured by the user. We do not use Google API data to train generalized AI/ML models.
  • Meta Graph API Data: Used solely to execute ad placements, fetch audience reach estimates, and synchronize creative assets with Meta Business Manager.
  • TikTok Ads API Data: Used strictly to manage ad groups, upload video creative assets, and configure campaign settings on TikTok Ads Manager.

 

3. Data Storage, Security, and Token Handling

  • Encryption at Rest and in Transit: All API tokens, secrets, and customer credentials are encrypted at rest using AES-256 encryption (via Google Cloud Secret Manager or equivalent enterprise-grade key management) and transmitted securely via TLS 1.3/HTTPS.
  • Token Lifetime: We store Refresh Tokens and System User Tokens only for the duration required to maintain active integrations authorized by you.
  • Data Isolation: Client data is logically segregated in a multi-tenant database architecture to prevent cross-account access or data leakage.

 

4. Data Sharing and Third-Party Disclosures

We do not sell, rent, or trade your corporate or API data to third parties. Data is only transmitted to third-party ad networks (Meta, Google, TikTok) at your explicit direction when executing a campaign push within the One platform.

 

5. Data Retention and Account Disconnection

Disconnecting Services: You can revoke One’s access to any connected ad account at any time via the Client Integrations tab or directly through the third-party provider’s security settings (e.g., Google Security Account Permissions, Meta Business Integration Settings).

Token Invalidation: Upon disconnecting an integration, we immediately delete the corresponding Access/Refresh Tokens from our active databases.

 

6. User Rights & Data Deletion Requests (GDPR / CCPA)

Under applicable privacy laws, you have the right to access, rectify, export, or request the deletion of your personal data.

Data Deletion Mechanism: You may submit a data deletion request by emailing privacy@beyondagency.ai or clicking “Delete Account & Wipe Integrations” within the account settings panel.

Automated Revocation: Following a valid deletion request, all stored OAuth tokens, user credentials, and active campaign drafts will be permanently purged within 30 days.

 

7. Contact Information

For questions regarding this Privacy Policy or our API data practices, please contact us at:

  • Data Controller: Beyond Agency AI Ltd.
  • Privacy Email: dataprivacy@beyondmediaagency.com
  • Security & Compliance: security@beyondagency.ai