Privacy Policy

Easy Ad, available at easyadapp.com (“Easy Ad”, “the Service”, “we”), is the data controller for the information described in this document.

For any question about your data, including access and deletion requests, contact us at coopmail@adeasy.cc.

This policy covers the easyadapp.com website, the user dashboard, and the @easyadofficialbot Telegram bot.

2.1. Account data — provided by you at sign-up:

• email address and username;
• your name, if you choose to provide one;
• your password — stored only as an irreversible cryptographic hash; we cannot read the password itself;
• email confirmation and password reset codes (temporary, with a limited lifetime);
• your plan, subscription end date, role in the workspace (owner, team lead, buyer) and team membership;
• your Telegram chat ID — only if you link the bot yourself.

2.2. Ad account data — received from the platforms you connect:

• advertising account identifier, name and status (advertiser_id on TikTok, act_id on Meta);
• access and refresh tokens with their expiry, issued by the platform after your explicit authorization;
• campaign data: name, platform, offer, daily budget, status, target metric (CPA/CPL);
• performance metrics: spend, leads and conversions, revenue, and derived metrics (CPL, CTR, ROAS);
• aggregated daily statistics for your account.

2.3. Data you create inside the Service:

• automation rules (condition, action, what they apply to);
• your saved setups: creative, audience, geo and offer descriptions, and notes;
• prompts sent to the AI assistant and the ad copy it generates;
• the autopilot activity feed and notifications.

2.4. Payment data:

• plan, amount, currency, invoice identifier and payment status;
• payments are processed by NOWPayments. We never receive or store card numbers, private keys or wallet credentials.

2.5. Technical data:

• cookies required for sign-in and security (see section 4);
• standard web server logs (IP address, browser type, request time) kept by our hosting provider for abuse protection and troubleshooting.

We do not use third-party advertising trackers, retargeting pixels or behavioural analytics on the dashboard.

• Providing the Service — displaying statistics, running the autopilot and automation rules, generating ad copy, sending notifications. Basis: performance of our contract with you (Terms of Service).
• Authentication and security — sign-in, two-factor confirmation, trusted devices, brute-force protection. Basis: performance of the contract and our legitimate interest in security.
• Billing — recording plans and payments, meeting accounting obligations. Basis: performance of the contract and legal obligation.
• Service messages — confirmation codes, alerts about triggered rules, paused and relaunched campaigns. Basis: performance of the contract.
• Support and improvement — diagnosing errors, answering your requests. Basis: legitimate interest.

We do not use your data for advertising profiling, and we do not sell or rent it to third parties.

Easy Ad uses strictly necessary cookies only. All of them are cryptographically signed and none contains your password:

• easyad_session — your sign-in session, up to 30 days;
• easyad_pre — the intermediate step between entering your password and the confirmation code, 15 minutes;
• easyad_trust — “trusted browser”, so a code is not required at every sign-in, up to 30 days.

We set no advertising or analytics cookies, so no consent banner is required. You can clear cookies in your browser settings — this will sign you out.

This section describes how Easy Ad handles data obtained through the TikTok Marketing API and equivalent Meta interfaces.

5.1. You grant the access

Easy Ad gains access to an advertising account only after you complete the platform's own authorization flow and explicitly approve the requested permissions. We work exclusively with the advertising accounts you connect yourself.

5.2. What we read

• advertising account details: identifier, name, currency, status;
• advertising structure: campaigns, ad groups, ads;
• performance metrics: spend, impressions, clicks, conversions, cost per result.

5.3. What we change

Acting on your command, or according to an automation rule that you configured yourself, the Service may pause or resume a campaign, change a daily budget, or duplicate a campaign. No change is ever made on our own initiative.

5.4. What we never do

• we do not sell advertising platform data or share it with third parties;
• we do not use it for our own advertising, targeting or audience building;
• we do not combine it with external data sources to identify individuals;
• we do not show one user's data to another: within a team, only the workspace owner and the team leads they appoint can see aggregated statistics;
• we do not collect personal data about the people who see your ads — we work with aggregated campaign metrics.

5.5. Storage and revoking access

Access tokens are held in a secured database with restricted access, used solely to operate the Service. You can disconnect an advertising account in the “Accounts” section — the tokens and the data tied to that account are deleted. You may also revoke the permission in the platform's own settings, which cuts off our access immediately.

The “AI assistant” and “AI team analyst” features send your prompt and aggregated campaign metrics (spend, leads, CPL and similar) to the Anthropic (Claude) API to produce a response.

• we never send your passwords, advertising account tokens or payment data to the model;
• under Anthropic's terms, data submitted through the API is not used to train models;
• AI output is advisory — the final decision is always yours.

We use service providers that process data on our behalf and are bound by confidentiality obligations:

• Vercel Inc. — application hosting;
• Neon Inc. — database (servers in the European Union, Frankfurt region);
• Anthropic PBC — processing of AI feature requests;
• Resend Inc. — delivery of service emails;
• NOWPayments — cryptocurrency payment processing;
• Telegram Messenger — notification delivery, if you link the bot;
• TikTok and Meta — the advertising platforms you connect; data is exchanged strictly within the permissions you granted.

We also disclose data where required by law, or to protect the rights and safety of the Service and its users. If the business is sold or reorganised, data may transfer to the successor — we will notify you in advance.

Some providers are located outside the European Economic Area. Transfers rely on the standard contractual clauses offered by those providers.

• account and campaign data — for as long as your account exists;
• after account deletion, data is removed from the live database immediately and disappears from backups within 30 days;
• advertising account tokens — until the account is disconnected or your Easy Ad account is deleted;
• temporary confirmation and reset codes — minutes, then deleted automatically;
• payment records — up to 3 years, for accounting and dispute resolution;
• unfinished sign-ups (email never confirmed) — deleted once the code expires.

You have the right to:

• obtain a copy of your data and information about how it is processed;
• correct inaccurate data;
• delete your account and all associated data;
• receive your data in a machine-readable format (portability);
• restrict or object to processing;
• withdraw consent where processing is based on consent;
• lodge a complaint with the data protection authority in your country.

The fastest route is to do it yourself in the dashboard: disconnect an advertising account under “Accounts”, unlink the bot under “Telegram”, or delete your account entirely under “Settings”. Alternatively, write to coopmail@adeasy.cc — we respond within 30 days. There is no charge for this.

• data in transit is protected with TLS encryption;
• passwords are stored as irreversible hashes;
• sign-in is protected by an email confirmation code (two-factor authentication) with a trusted-device mechanism;
• session cookies are cryptographically signed and carry the HttpOnly and Secure flags;
• database access is restricted and granted only for operating the Service.

No service can guarantee absolute security. In the event of a breach that poses a risk to your rights, we will notify you and the supervisory authority within the statutory deadlines.

The Service is intended for professional use by people aged 18 and over. We do not knowingly collect data from minors. If you become aware that a minor has registered, please tell us and we will delete the account.

We may update this policy. The date of the latest update is shown at the top of this page. We will announce material changes by email or through a notice in the dashboard at least 14 days before they take effect.

See also our Terms of Service.