Introduction

Salfars Innovations, registered in Allahabad, Uttar Pradesh, India ("we", "us", "our" or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered advertising management platform ("the Service"). By using the Service you agree to the collection and use of information described here.

1. Information We Collect

We collect the following categories of information:

• Account Data: Name, email address, password (stored as a bcrypt hash), and company name provided during registration.
• Platform OAuth Tokens: Encrypted access tokens for Meta (Facebook/Instagram), TikTok, Google Ads, Amazon, and Shopify — obtained with your explicit consent via each platform's authorisation flow and stored with AES-256-GCM encryption.
• Ad & Campaign Data: Campaign settings, ad creative, audience definitions, keywords, bids, and performance insights retrieved from connected advertising platforms on your behalf.
• Conversion & Event Data: Purchase, lead, and other conversion events you choose to send to us for forwarding to third-party advertising APIs (such as Meta CAPI or TikTok Events API). This data may include hashed email addresses, hashed phone numbers, IP addresses, and browser identifiers. All personal identifiers are hashed using SHA-256 prior to transmission.
• Usage Data: Pages visited, features used, session timestamps, IP address, browser type, and device identifiers collected automatically.
• Brand Profile Data: Target audience descriptions, brand tone, and other marketing context you enter to personalise AI-generated content.

2. How We Use Your Information

• To provide, operate, and improve the Service — including AI-generated ad copy, campaign automation, bid optimization, and cross-platform performance reporting.
• To authenticate you and maintain secure sessions.
• To transmit conversion events to third-party advertising platforms (see Sections 3 through 6) at your direction.
• To send transactional emails (account verification, password reset, billing receipts, security alerts).
• To monitor platform usage, detect abuse, and ensure service reliability.
• To comply with legal obligations and enforce our Terms of Service.

3. Data Sharing with Meta (Facebook & Instagram)

We share certain data with Meta Platforms, Inc. as a Business Tool provider. Specifically:

• Conversions API (CAPI): When you use our conversion tracking feature, we forward server-side conversion events to Meta on your behalf via the Meta Conversions API. All personal identifiers are hashed with SHA-256 before transmission in accordance with Meta's requirements.
• Ad Management: We access and manage your Meta ad accounts, campaigns, ad sets, ads, audiences, and product catalogs via the Meta Marketing API using the OAuth access token you granted.
• Instagram Content Publishing: We publish media to your Instagram account on your behalf when you initiate a publish action.

4. Data Sharing with TikTok

We share certain data with TikTok as a Business Tool provider. Specifically:

• Events API: When you use our conversion tracking feature, we forward server-side conversion events to TikTok on your behalf via the TikTok Events API. All personal identifiers are hashed with SHA-256 before transmission.
• Ad Management: We access and manage your TikTok ad accounts, campaigns, ad groups, ads, and audiences via the TikTok Business API using the OAuth access token you granted.

5. Data Sharing with Google (Google Ads, GA4 & YouTube)

We access and process data from Google services via official Google APIs with your explicit authorization. Specifically:

• Google Ads: We access and manage your Google Ads accounts, campaigns, ad groups, responsive search ads, responsive display ads, keywords, bidding strategies, budgets, asset extensions, and performance reports via the Google Ads API (v24) using the OAuth access token you granted.
• Google Analytics 4 (GA4): When you connect your GA4 property, we read aggregated traffic, session, conversion, and funnel metrics via the Google Analytics Data API (v1beta/v1alpha) to generate cross-channel reporting and analytics dashboards.
• YouTube Data: If authorized, we retrieve video and channel metadata via the YouTube Data API solely to assist you in selecting and configuring video creatives for Google Demand Gen and video campaigns.
• Google User Data & Limited Use Disclosure: Salfars's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Ads, Google Analytics, and YouTube data accessed through your authorization is used solely to provide the campaign management, automation, and reporting features you request inside Salfars. We do not use Google user data to serve advertisements, do not sell or transfer it to third parties, and do not allow humans to read it except with your explicit consent, for security purposes, or where required by applicable law.

You can disconnect your Google account at any time from Account Settings, which immediately deletes stored OAuth tokens and ceases all Google API requests on your behalf.

6. Data Sharing with Amazon

Amazon Advertising and Amazon Selling Partner API (Seller Central) are two separate authorisations — each with its own consent screen, access token, and scope. Connecting one does not connect the other.

• Amazon Ads: We access and manage your Sponsored Products campaigns, ad groups, keywords, targeting, and performance reports via the Amazon Advertising API.
• Amazon Seller Central (SP-API): We read FBA inventory levels, pricing, fee estimates, aggregate order metrics (no buyer PII), and product catalog data via the Selling Partner API.

7. Billing and Payment Information

When you purchase a paid subscription or usage credits, payment transactions are processed directly by our third-party payment gateway providers (Razorpay or PayU). We do not collect, process, or store credit/debit card numbers, CVVs, UPI PINs, or bank account credentials on our servers.

8. Third-Party Sub-processors

We engage Anthropic, DigitalOcean, Cloudflare, Resend, Razorpay/PayU, and Arize Phoenix as sub-processors under data protection agreements. We do not sell, rent, or trade your personal data.

9. Data Retention & Purge Schedules

• OAuth Tokens: Deleted immediately upon user disconnection.
• Platform Performance Snapshots & Caches: Retained for up to 90 days and automatically purged.
• Account Erasure: Permanently deleted within 30 days upon request (contact [email protected]).