Privacy Policy

This Privacy Policy describes how ColchoAds("we"), through its internal platform ColchoAds Manager, collects, uses, stores, and protects the data accessed while managing the paid-advertising campaigns of the agency's clients.

1. Data we collect

With authorization, the platform accesses the following data from the advertising platforms (Meta Ads and Google Ads):

• identification of the ad accounts the authenticated user has access to;
• name, status, and settings of the campaigns in those accounts;
• performance metrics (spend, impressions, clicks, reach, conversions, results, and cost per result);
• authentication data (OAuth access tokens), stored securely solely to maintain the connection with the advertising platforms.

We do not collect personal data of the ads' end users (the people who see or click on the ads). We work only with aggregated performance data.

2. How we use the data

The data is used exclusively to display performance reports and dashboards to the agency's internal team, enabling the monitoring and optimization of the clients' campaigns. API access is read-only — the platform does not create, edit, or pause campaigns.

3. Storage and security

Data is stored in a secure database (Supabase/PostgreSQL), with row-level access control (Row Level Security): each user sees only the data of the clients assigned to them. Access tokens are kept restricted and used only for automatic synchronization with the advertising platforms. Access to the platform requires email-and-password authentication.

4. Data sharing

We do not sell or share the data with third parties for marketing purposes. Data is shared only with the infrastructure providers required for the platform to operate (for example, hosting and database) and with the advertising platforms that are the source of the data (Google, Meta).

5. Retention and deletion

Data is retained for as long as the management relationship between the agency and the client lasts. At any time, the client may revoke the agency's access to their ad accounts directly on the platforms (Google Ads, Meta), which stops the collection. Upon request, stored data may be deleted.

6. Compliance with the platforms

The use of the Google Ads and Meta APIs complies with the respective policies and terms of use of those platforms. Access is granted by the responsible user via OAuth and may be revoked at any time.