Privacy Policy
Effective October 13, 2026
This policy explains what information AdPilot ("AdPilot", "we", "us") collects when you use the AdPilot service at https://adpilotdash.com, how we use and store it, how long we keep it, and how you can have it deleted. AdPilot is a reporting tool: you sign up, connect advertising and social accounts you control, and we show you their performance in one place. We do not sell your data, we do not use it for advertising, and we do not post, publish, or change anything on your connected accounts.
1. Information you give us
- Account details: your name, email address, and a password (stored only as a salted scrypt hash).
- Workspace details: the workspace name you choose and, if you invite them, the email addresses of teammates.
- Support messages: anything you send us by email.
2. Information we receive from platforms you connect
When you click Connect for a platform, you are sent to that platform's own consent screen. We receive only the permissions you approve there, and only read data. The table below lists exactly what we request and store per platform.
| Platform | Permissions requested | Data we store |
|---|---|---|
| TikTok Ads (TikTok API for Business) | Ad Account Management (read ad account information), Ads Management (read campaigns), Reporting | Advertiser IDs, names, currency and timezone; campaign IDs, names, status and objective; daily campaign spend, impressions, clicks, conversions and conversion value. |
| TikTok account (Login Kit / Display API) | user.info.basic, user.info.profile, user.info.stats, video.list | Your TikTok open ID, display name, username, avatar URL, bio, follower/following/like/video counts; for your public videos: ID, caption, cover image URL, share URL, publish time, view, like, comment and share counts. |
| Meta Ads (Facebook Login / Marketing API) | ads_read, business_management | Your app-scoped Facebook user ID and name; ad account IDs, names, currency and timezone; campaign IDs, names, status and objective; daily campaign spend, impressions, clicks, purchases and purchase value. |
| Instagram & Facebook Pages (Facebook Login / Graph API) | pages_show_list, pages_read_engagement, pages_read_user_content, read_insights, instagram_basic, instagram_manage_insights, business_management | Page and Instagram professional account IDs, names, usernames, profile picture URLs, follower counts; for recent posts: ID, caption, media type, permalink, thumbnail URL, publish time, views, likes/reactions, comments, shares and reach. |
| Snapchat Ads (Snap Marketing API) | snapchat-marketing-api | Your Snap user ID and display name; organization and ad account IDs, names, currency and timezone; campaign IDs, names, status and objective; daily campaign spend, impressions, swipes, purchases and purchase value. |
We also store the OAuth access and refresh tokens each platform issues so we can refresh your reports. We never receive your platform passwords. We do not access direct messages, comments text, audience lists, payment methods, or any data about your followers or customers as individuals.
3. Information collected automatically
We set one strictly necessary, HTTP-only session cookie to keep you signed in. Our hosting provider records standard server logs (IP address, user agent, request path, timestamp) for security and debugging. We do not use analytics trackers, advertising pixels, or third-party cookies.
4. How we use information
- To show you your own campaign and content performance, and the totals and ratios (CTR, CPA, ROAS) derived from it.
- To keep your connected accounts in sync by periodically refreshing data with the stored tokens.
- To operate, secure and troubleshoot the service, and to contact you about your account.
Data from a connected account is visible only to members of the workspace it was connected to. We do not combine it with data from other customers, use it to train models, or share it with third parties except the service providers listed in section 6.
5. How we store and protect data
- OAuth access and refresh tokens are encrypted at rest with AES-256-GCM using a key held separately from the database.
- All traffic to AdPilot and from AdPilot to platform APIs uses TLS.
- Passwords are stored only as salted scrypt hashes. Session cookies are random, HTTP-only, and stored server-side only as a hash.
- Access to production systems is limited to personnel who need it to run the service.
6. Service providers
We use a cloud hosting provider and a managed database provider to run AdPilot. They process data only on our instructions. Data may be processed in the United States or other countries where those providers operate.
7. Retention
- Connected-account data and tokens are kept while the connection is active. When you disconnect an account we revoke the token at the platform where the platform supports it, and immediately delete the token and every campaign, metric, profile and post we synced through that connection.
- Reporting history is limited to the period you view and sync (by default the last 90 days, extended when you select an older range).
- Account data is kept until you delete your account. Deleting your account deletes all workspaces you solely own and everything in them.
- Server logs are kept for up to 30 days.
- Deletion records (a confirmation code, the date, and the number of connections removed — no personal content) are kept for 12 months so you can check the status of a request.
8. Your choices and rights
- Disconnect any platform at any time from Connections in the app, or revoke AdPilot's access from the platform's own settings (TikTok: Settings → Security → Manage app permissions; Facebook: Settings → Apps and Websites; Snapchat: Business Manager → Connected apps).
- Delete your data by following the steps on our Data Deletion page. If you remove AdPilot from Facebook, Meta notifies us automatically and we delete all Meta-sourced data linked to you.
- Access, correct or export your data by emailing privacy@adpilotdash.com. Depending on where you live (for example under the GDPR, UK GDPR or CCPA/CPRA) you may also have the right to object to or restrict processing, and to complain to your data protection authority. We respond within 30 days.
9. Children
AdPilot is for businesses and creators aged 18 or older. We do not knowingly collect data from children.
10. Changes
If we change this policy materially we will email account holders and update the effective date above before the change takes effect.
11. Contact
AdPilot
privacy@adpilotdash.com