Privacy Policy
Last updated November 3, 2026. Version 3.0.
ZieAds is operated by PT. Bantu Indonesia Technology, Indonesia. This policy explains what we collect, why, how long we keep it, and how you remove it. We follow Indonesia's Personal Data Protection Law (UU PDP No. 27 of 2022) and the developer policies of every platform we connect to.
1. What we collect
- Account: your name, email, password hash or Google sign in, brand profile, settings and team invitations.
- Connected platforms: only the data each platform shares under the permissions you approve, listed per platform in section 3.
- Content you create: posts, drafts, replies, uploaded media and messages to the AI agent.
- Usage and security logs: sign ins, pages used, errors, IP address and browser, and an activity log of actions in your account.
- Billing: plan and invoices. Card details are handled by our payment provider and never reach our servers.
2. How we use it
- To run the product: schedule and publish posts, show analytics, collect comments into the inbox, track competitors and compile your briefing.
- To let the AI agent analyse your data and prepare drafts. Nothing is published, replied to or spent without your approval.
- To keep the service reliable and secure, and to support you when you ask for help.
- We do not sell personal data, do not use platform data for advertising, and do not use it to train AI models.
3. Platform by platform
We only use official platform APIs. Access tokens are encrypted (AES-256) and never shown in the app, exported or shared.
Facebook Pages (Meta)
What we read: Pages you manage (pages_show_list, business_management), Page posts and their engagement (pages_read_engagement), Page and post insights (read_insights), comments on your Page posts (pages_read_user_content), and permission to publish and reply on the Page you choose (pages_manage_posts, pages_manage_engagement, pages_manage_metadata).
What we store: Page name, id and picture, an encrypted Page access token, your posts, their metrics, comments and the replies you send.
How long: While the Page is connected. Deleted when you disconnect, when you remove ZieAds in Facebook settings (data deletion callback), or when you delete your account.
How to revoke: Facebook Settings, Apps and websites, remove ZieAds. Or Connections in ZieAds, Disconnect.
Instagram (Meta)
What we read: Your professional account profile (instagram_business_basic), insights (instagram_business_manage_insights), comments and replies (instagram_business_manage_comments) and publishing (instagram_business_content_publish). For competitor tracking, public profiles of Business and Creator accounts through Business Discovery.
What we store: Profile, an encrypted access token, posts, metrics, comments and replies, and public posts of competitors you track.
How long: While connected. Deleted on disconnect, on a Meta data deletion request, or when you delete your account.
How to revoke: Instagram Settings, Apps and websites, remove ZieAds. Or Connections in ZieAds, Disconnect.
TikTok
What we read: Basic profile and stats (user.info.basic, user.info.profile, user.info.stats), your public videos (video.list), and, when granted, upload to your TikTok inbox or direct posting (video.upload, video.publish).
What we store: Display name, avatar, follower counts, video list and metrics, an encrypted access and refresh token.
How long: While connected. Deleted on disconnect or when you delete your account.
How to revoke: TikTok Settings, Security, Manage app permissions. Or Connections in ZieAds, Disconnect.
What we read: Sign in and basic profile (openid, profile, email) and posting to your own profile (w_member_social). Company Page management (w_organization_social, r_organization_social, rw_organization_admin) only after LinkedIn approves it and you connect a Page.
What we store: Name, profile id, an encrypted access token, and the posts you publish from ZieAds.
How long: While connected. LinkedIn access lasts 60 days and is renewed when you reconnect. Deleted on disconnect or account deletion.
How to revoke: LinkedIn Settings, Data privacy, Permitted services. Or Connections in ZieAds, Disconnect.
Google and YouTube
What we read: When available: YouTube channel data and uploads (youtube.readonly, youtube.upload, youtube.force-ssl, yt-analytics.readonly) and Google Ads reports (read only).
What we store: Channel or account id and name, encrypted tokens, video and report metrics.
How long: While connected. Deleted on disconnect or account deletion.
How to revoke: myaccount.google.com/permissions, remove ZieAds. Or Connections in ZieAds, Disconnect.
X (when available)
What we read: Your profile, your posts and their metrics, and publishing on your behalf.
What we store: Profile, encrypted tokens, your posts and metrics.
How long: While connected. Deleted on disconnect or account deletion.
How to revoke: X Settings, Security and account access, Connected apps. Or Connections in ZieAds, Disconnect.
Meta, Google and TikTok Ads
What we read: Read-only reporting (ads_read on Meta, reporting on Google Ads and TikTok) or a CSV you import: campaign, ad set and ad names, dates, spend, impressions, clicks, conversions and revenue.
What we store: Those report rows. Never payment methods, never the people who saw your ads. ZieAds cannot change campaigns or spend budget.
How long: While connected or until you delete the import.
How to revoke: Remove ZieAds in each Ads Manager, or delete the import in ZieAds.
4. YouTube API Services
ZieAds uses YouTube API Services. By connecting YouTube to ZieAds you agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy. You can revoke ZieAds' access at any time at Google security settings. ZieAds' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. AI processing
Briefings, analysis modes and drafts are produced by AI models from Anthropic (Claude) and Google (Gemini), reached directly or through our AI gateway provider Sumopod. We send only the data needed for the request. These providers process it to return a result and do not use it to train their models under our agreements. AI output is a suggestion: you review it before anything goes live, and AI written replies are disclosed where a platform requires it.
6. Who processes data for us
| Provider | Purpose |
|---|---|
| Supabase | Database and sign in |
| Vercel | Hosting and media storage |
| Anthropic, Google, Sumopod | AI processing |
| Dodo Payments | Billing |
| Mailgun | Email delivery |
Data can be processed outside Indonesia by these providers under contracts that protect it as this policy describes.
7. Retention and deletion
- Platform data is kept while the platform is connected and deleted when you disconnect it.
- Deleting your account in Settings removes all of your data and your login right away. Encrypted backups roll over within 30 days.
- Invoices are kept for 10 years as Indonesian tax law requires.
- Step by step instructions, and the status check for Facebook and Instagram deletion requests, are on the Data Deletion page.
8. Your rights
You can access and export your data (Settings, Data and privacy), correct it, delete it, withdraw consent by disconnecting a platform, and object to processing. Email privacy@zieads.com for anything else; we reply within 7 days. You can also complain to the Indonesian data protection authority.
9. Security
Tokens are encrypted at rest, every account is isolated with row level security, connections use TLS, and an append only activity log records who did what. If a breach affects you, we tell you and the authority within 72 hours.
10. Children
ZieAds is for businesses and is not meant for anyone under 18.
11. Cookies
We use only the cookies and local storage needed to keep you signed in and remember your settings. No advertising cookies.
12. Changes and contact
We announce material changes by email and in the app at least 14 days before they apply. Contact: PT. Bantu Indonesia Technology, privacy@zieads.com. See also the Terms of Service.