Privacy Policy

Last Updated: August 3, 2026 · Effective Date: August 3, 2026

Welcome to IndieSaas ("we," "us," or "the Platform"). The Platform is an advertising automation SaaS tool that helps you manage, optimize, and automate your ad campaigns across Facebook Ads, Google Ads, and other advertising platforms via their APIs.

We take your data privacy seriously — especially when you entrust us with your ad platform API keys and authentication credentials. This Privacy Policy explains in plain language: what data we collect, why we collect it, how we use it, and what control you have over it.

Our Core Commitment: Your ad platform API keys and authentication credentials belong to you. We use them solely to call the relevant APIs on your behalf to perform ad management actions you explicitly initiate. We never access your ad accounts without authorization, and we never sell or share your credentials with any third party.

1. Scope of This Policy

This Privacy Policy applies to the collection, use, and protection of your personal information when you use the IndieSaas website, web application, and related services (collectively, the "Services").

This policy does not apply to:

Third-party advertising platforms you interact with through the Platform (e.g., Facebook, Google Ads) — each platform has its own privacy policy, which you should read and accept separately.
Information about your customers or audiences contained in the ad data you access via the Platform — compliance for such data is your responsibility as the advertiser.

2. Information We Collect

2.1 Information You Provide

Data Type	Details	Purpose
Account Information	Name, email address, password (encrypted), company name	Creating and managing your account
API Credentials	Facebook Ads API Token, Google Ads OAuth credentials, API keys or access tokens for other ad platforms	Calling ad platform APIs on your behalf to perform ad management operations
Payment Information	Billing address, last four digits of credit card (processed by a third-party payment provider; we do not store full card numbers)	Processing subscription payments
Preferences	Notification preferences, interface language, automation rule configurations	Providing a personalized service experience

2.2 Information We Collect Automatically

Data Type	Details	Purpose
Usage Data	Login times, feature usage records, action logs, API call frequency	Providing the service, improving features, troubleshooting
Technical Information	IP address, browser type, operating system, device identifiers	Security, diagnostics, compliance auditing
Ad Data	Campaign names, performance metrics, budget information, audience data retrieved via API (all from your ad accounts)	Displaying and managing your ads within the Platform

3. Special Handling of API Keys & Credentials

Because the core functionality of the Platform depends on your authorized ad platform API credentials, we apply a higher standard of protection to this information:

Encrypted Storage: Your API keys and OAuth tokens are encrypted at rest using AES-256 encryption. Even at the database level, plaintext credentials are not readable.

Least Privilege: We request only the API permission scopes necessary to perform ad management functions. We do not request permissions beyond what the features require.
Scoped Use: Your API credentials are used solely for operations you actively initiate on the Platform (e.g., creating campaigns, adjusting budgets, viewing reports). We do not make automated API calls without your instruction.
No Sale, No Sharing: Your API credentials are never sold, rented, or shared with any third party.
Instant Revocation: You can disconnect any ad platform authorization at any time in your account settings. Upon disconnection, we immediately stop using the credentials and remove them from active storage within 24 hours.
Audit Trail: Every API call made with your credentials is logged — including timestamp, operation type, and result status. You can review these in the action log.

About OAuth Authorization: For ad platforms that support OAuth (e.g., Facebook Ads), we use the standard OAuth 2.0 flow. You authenticate directly on the ad platform's official page — we never see your platform username or password. Access tokens are refreshed automatically, and you can revoke the Platform's authorization at any time from the ad platform's settings.

4. How We Use Your Information

We use your information only for the following purposes:

4.1 Providing Core Services

Using your API credentials to call ad platform APIs and perform the ad management actions you instruct
Displaying your campaigns, performance data, and metrics within the Platform interface
Executing automation rules you have configured (e.g., scheduled budget adjustments, auto-pausing underperforming ads)

4.2 Account Management

Creating, maintaining, and managing your user account
Processing subscription payments and issuing invoices
Sending service notifications (e.g., API authorization expiry reminders, automation rule execution alerts)

4.3 Service Improvement

Analyzing usage patterns to optimize product features and user experience
Diagnosing technical issues and providing customer support
Developing new ad platform integrations

4.4 Security & Compliance

Detecting and preventing fraud, abuse, and unauthorized access
Fulfilling legal obligations
Responding to valid legal requests (see Section 5)

What We Don't Do: We do not sell your ad performance data to third parties. We do not use your API credentials for any purpose you have not authorized. We do not perform actions on ad platforms that you have not explicitly configured.

Except in the following circumstances, we do not share your personal information with any third party:

5.1 Sharing Necessary to Provide the Service

Ad Platforms: We send your API requests to the ad platforms you have authorized (e.g., Facebook, Google Ads) to perform the operations you instruct. This sharing is inherent to the use of the Service.
Payment Providers: Subscription payments are processed by third-party payment providers (e.g., Stripe). We only receive payment result notifications.
Cloud Infrastructure Providers: Our services are hosted on cloud infrastructure. Your data is stored on their infrastructure, subject to their privacy policies and data processing agreements.

5.2 Legally Required Disclosures

In response to legally binding government requests, court orders, or regulatory requirements
To protect the rights, property, or safety of the Platform, our users, or the public
To investigate and prevent fraud, security breaches, or illegal activities

5.3 Business Transfers

In the event of a merger, acquisition, or asset sale, your information may be transferred as part of the transaction. We will notify you via email or in-app notification before such a change takes effect, and you have the right to choose whether to continue using the Service.

6. Third-Party Ad Platforms & Integrations

The Platform integrates with the following types of third-party services via API. Each service has its own privacy policy, which we recommend you review:

Third-Party Service	Information Shared	Purpose	Privacy Policy
Facebook Ads (Meta)	API requests, ad management operation instructions	Performing Facebook ad management operations	meta.com/privacy/policy
Google Ads	API requests, ad management operation instructions	Performing Google ad management operations	policies.google.com/privacy
TikTok Ads	API requests, ad management operation instructions	Performing TikTok ad management operations	tiktok.com/legal/privacy-policy
Other Ad Platforms	API requests, ad management operation instructions	Performing ad management operations on the respective platform	Please refer to each platform's official policy

Important: When you connect an ad platform through the Platform, you are also subject to that ad platform's privacy policy. The Platform cannot control how ad platforms process your data. Please evaluate each platform's privacy practices independently.

7. Data Security Measures

We implement industry-standard security measures to protect your information, particularly your API credentials and ad data:

7.1 Technical Security Measures

Encryption in Transit: All data transmission is encrypted via TLS 1.2+ (HTTPS).
Encryption at Rest: API keys and sensitive credentials are encrypted using AES-256; database-level encryption at rest is enabled.
Access Control: Role-based access control (RBAC) restricts production environment access to authorized engineering personnel, under audit logging.
Key Management: Encryption keys are managed by a professional Key Management Service (KMS) with support for key rotation.
Security Audits: Regular security scanning and penetration testing are conducted.

7.2 Operational Security Measures

Employees sign confidentiality agreements and receive data privacy training
Least-privilege principle enforced — employees access only data within their scope of responsibility
All production environment actions are logged and audited
Established security incident response procedures

7.3 Breach Response

In the event of a data security incident, we will notify affected users via email within 72 hours of confirmation, including the nature of the incident, potential impact, and recommended protective measures.

Security Tip: Despite the measures above, no system can guarantee 100% security. We recommend that you periodically review the authorized apps list on your ad platforms, revoke unused authorizations, and enable two-factor authentication (2FA) for your Platform account.

8. Data Retention

We retain your data only for as long as necessary to fulfill the purposes described in this policy:

Data Type	Retention Period	Notes
Account Information	Duration of account + 30 days after deletion	30-day buffer for refunds and compliance audits
API Credentials	Until you revoke authorization or delete your account	Removed from active storage within 24 hours of revocation
Ad Management Data	Duration of account	Cached data from ad platforms; deleted when account is deleted
Action Logs	12 months	For security auditing and troubleshooting
Payment Records	As required by law (typically 5–7 years)	Tax and financial compliance requirements

Upon expiration of the retention period, we will securely delete or anonymize your personal data. Where longer retention is required by law, we retain only the minimum data necessary for legal compliance.

9. Cookies & Similar Technologies

The Platform uses cookies and similar technologies to provide and improve your service experience:

Cookie Type	Purpose	Can Be Disabled?
Essential Cookies	Maintaining login state, ensuring security	No (required for service operation)
Preference Cookies	Remembering your interface language and display preferences	Yes
Analytics Cookies	Understanding feature usage to improve the product	Yes

You can manage or delete cookies in your browser settings. Please note that disabling essential cookies may cause some features to not function properly.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights:

10.1 Right of Access

You have the right to know what personal information we hold about you. You can view your connected ad platforms and authorized API permission scopes in your account settings.

10.2 Right to Rectification

You can update your personal information at any time in your account settings. If you believe we hold inaccurate information about you, please contact us to have it corrected.

10.3 Right to Erasure

You have the right to request the deletion of your personal information. You can initiate this through the "Delete Account" function in your account settings. After account deletion, your API credentials will be invalidated within 24 hours, and associated data will be handled according to the retention periods in Section 8.

10.4 Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format. Please initiate a request via the contact information in Section 13. We will respond within 30 days.

10.5 Right to Withdraw Consent

You can at any time:

Revoke connected ad platform API authorization in your account settings
Revoke the Platform's authorization directly from the ad platform's settings
Unsubscribe from marketing emails (an unsubscribe link is provided at the bottom of every email)
Disable non-essential cookies in your browser

10.6 Right to Object

You have the right to object to the processing of your personal information for direct marketing purposes. If you exercise this right, we will stop processing your data for that purpose.

10.7 Right to Complain

If you believe our processing of your personal information violates applicable law, you have the right to file a complaint with the data protection authority in your jurisdiction.

How to Exercise Your Rights: Most actions can be completed self-service in your account settings. For assistance, please contact us using the details in Section 13. We will respond to your request within 30 days.

11. Children's Privacy

The Platform is designed for businesses and professionals with advertising needs and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will promptly delete the relevant data.

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practices.

Material Changes: Changes affecting the scope of data collection, usage methods, or your rights will be communicated via email at least 30 days in advance.
Minor Changes: Changes such as wording adjustments or formatting improvements that do not affect substantive rights will be updated directly on this page.
Effective Date: The updated policy takes effect on the "Effective Date" indicated at the top of this page. Continued use of the Service constitutes acceptance of the updated policy.

We recommend that you review this page periodically to stay informed of the latest version.

13. Contact Us

If you have any questions, suggestions, or need to exercise your privacy rights regarding this Privacy Policy, please contact us:

IndieSaas Privacy & Data Protection

Email: [email protected]

Support Ticket: Log in → Settings → Contact Support

We will respond to your request within 5 business days of receipt.