Privacy Policy

1. Introduction

AlcaAds provides software that helps authorized advertisers and their teams manage TikTok advertising operations, including campaign organization, advertising reporting, performance analytics, pixels, events, ad groups, and ads. We collect and process only the information reasonably necessary to provide, secure, support, and improve those services.

AlcaAds does not receive access to a TikTok account merely because a person visits our website. Access to TikTok data occurs only after an authorized user affirmatively initiates a connection, reviews the TikTok authorization screen, and grants the permissions requested for the applicable functionality. The user may disconnect the integration or revoke TikTok authorization at any time.

This Policy applies to the website at alcaads.com, the application at app.alcaads.com, and related support communications. It does not replace or modify TikTok's own privacy notices or the policies of any other third party.

2. Definitions

In this Policy, “AlcaAds,” “we,” “us,” and “our” mean the AlcaAds service operator. “User” means an individual who uses the Services. “Customer” means the organization or person holding an AlcaAds account. “Services” means the AlcaAds website and SaaS platform. “TikTok Data” means data made available to AlcaAds through TikTok Login Kit, TikTok for Business/Marketing API, or other authorized TikTok interfaces. “Personal Data” means information that identifies, relates to, describes, or can reasonably be linked to an individual. “Controller” and “Processor” have the meanings given by applicable privacy law.

3. Information We Collect

Account and service information

We collect information you provide when you create or administer an AlcaAds account, such as name, business name, email address, account role, support correspondence, subscription and billing administration records, and authentication-related information. Payment card details are processed by the applicable payment provider and are not stored by AlcaAds except for limited transaction, invoice, and payment-status records.

Usage, device, and log information

We automatically collect information needed to operate a secure online service: IP address, browser and device characteristics, pages or features used, timestamps, referring URL, authentication events, error logs, and security signals. We use this data for fraud prevention, account protection, debugging, capacity planning, and aggregate service analytics.

Information you provide to support

When you contact us, we process the content of your request and any information you choose to provide so that we can respond, investigate an issue, preserve an audit trail, and improve support quality.

4. Information Collected Through TikTok

We access TikTok Data only under the permissions, scopes, advertiser access, and endpoint responses authorized by TikTok and the connected user. The exact fields available vary by TikTok product, account configuration, permissions, region, and API version. AlcaAds does not infer or obtain data that TikTok does not make available to the authorized integration.

Login information

When a User connects through TikTok Login Kit, TikTok may provide an account identifier or open identifier, display name, profile image URL, and authorization token information where permitted. We use this information to establish and maintain the requested connection, associate it with the correct AlcaAds workspace, enforce access controls, and show the User which TikTok identity is connected. We do not receive or store the User's TikTok password.

Advertising data

For authorized advertising accounts, TikTok's Marketing API may make available advertiser or business account identifiers, account settings and status, account currency and time zone, account-level permissions, campaign structures, budgets, bids, objectives, schedules, delivery status, targeting settings, creative and ad metadata, ad group settings, and reporting dimensions and metrics. Reporting data may include impressions, reach, clicks, video views, spend, cost metrics, conversions, conversion values, attribution metrics, and other performance results returned by TikTok.

Campaign, ad group, and ad data

AlcaAds processes campaign, ad group, and ad names, identifiers, configuration fields, delivery status, schedule, budget, bid strategy, placement, targeting selections, creative references, and performance records to display, analyze, and, where enabled and authorized, manage advertising activity. Users remain responsible for ensuring that their campaign content and targeting choices comply with TikTok rules and applicable law.

Pixel data

Where the authorized API response provides it, AlcaAds may process pixel identifiers, names, status, configuration metadata, association with an advertiser account, and aggregated measurement information. Pixel-related data is used to help the Customer identify the correct measurement asset and evaluate advertising performance. AlcaAds does not use pixel data to build unrelated consumer profiles or sell personal information.

Event data

We may process event names, event configuration, timestamps or reporting periods, attribution and aggregation fields, conversion counts, and other analytics outputs returned by TikTok for the authorized account. Event-level availability is controlled by TikTok and the Customer's implementation. AlcaAds uses this information solely to provide reporting, analytics, and campaign-management functions; it does not independently deploy a Customer's TikTok Pixel or send events unless the Customer configures and authorizes that activity.

5. Cookies and Analytics

We use essential technologies to operate the website and application, including session, authentication, security, and preference technologies. Where we deploy non-essential analytics or advertising technologies, we obtain consent where required by law and honor the applicable preferences. Our detailed practices are described in the Cookie Policy.

Service analytics are used to understand feature reliability and adoption in aggregate, investigate errors, and improve the Services. We do not use TikTok advertising data for cross-context behavioral advertising.

6. How We Use Information

• Provide, authenticate, personalize, and support the Services and connected TikTok functionality;
• Retrieve, display, organize, analyze, and, where enabled, submit authorized campaign-management actions;
• Maintain records of authorization, consent, account access, and service activity;
• Prevent fraud, abuse, unauthorized access, and security incidents;
• Process subscriptions, invoices, and service communications;
• Diagnose defects, develop features, and measure service performance using aggregated or de-identified information where feasible;
• Comply with legal obligations, enforce our agreements, and protect rights, safety, and property.

We do not sell Personal Data, use TikTok Data for unrelated advertising, or use TikTok Data to train public or general-purpose models.

7. Legal Basis for Processing

Where the GDPR or analogous law applies, AlcaAds relies on one or more of the following bases: performance of a contract with the Customer or steps taken at the User's request; legitimate interests in operating a secure, reliable SaaS service and preventing abuse, balanced against the individual's rights; consent for optional processing such as non-essential cookies or the TikTok authorization flow; and compliance with legal obligations. We use TikTok Data only for the purposes covered by the User's authorization and the applicable TikTok terms.

8. GDPR, LGPD, and CCPA/CPRA Compliance

European Economic Area and United Kingdom

For personal data processed in connection with the Services, AlcaAds may act as a controller for website, account, support, security, and service-administration data. For data a Customer imports or makes available through its advertising operations, AlcaAds generally processes the data on the Customer's documented instructions, subject to our agreements and law. EEA/UK individuals may exercise the rights described below, including complaint rights with their local supervisory authority.

Brazil (LGPD)

We process personal data in accordance with the LGPD, including the principles of purpose, adequacy, necessity, transparency, security, prevention, non-discrimination, and accountability. Data subjects may request confirmation of processing, access, correction, anonymization, blocking, deletion where applicable, portability, information about sharing, and information concerning consent through support@alcaads.com.

California (CCPA/CPRA)

California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction subject to legal exceptions, and receive information about disclosures. AlcaAds does not sell or share Personal Information as those terms are defined by the CCPA/CPRA for cross-context behavioral advertising. We do not knowingly sell or share the personal information of individuals under 16.

9. Data Sharing and Third-Party Services

We disclose information only as necessary for the purposes in this Policy: to the Customer and authorized workspace users; to service providers that host, secure, support, analyze, communicate about, or process payments for the Services; to TikTok where necessary to execute an authorized API request or action; to professional advisers and auditors under confidentiality; and to public authorities or other parties when required by law or necessary to protect rights, safety, and security.

Service providers may process information solely on our instructions and subject to appropriate contractual, confidentiality, and security obligations. We do not rent, sell, or trade TikTok Data or Personal Data.

TikTok Services

When you choose to connect TikTok, your use is also governed by TikTok's terms and privacy practices. TikTok independently controls the availability, scope, quality, and retention of data in its products. AlcaAds is not responsible for TikTok's independent practices, service availability, or decisions to modify an API.

10. Security Measures and Data Retention

We use administrative, technical, and organizational measures designed to protect information, including encryption in transit, access controls, authentication protections, least-privilege practices, logging, monitoring, vulnerability management, and backups. Further detail appears in our Security Policy. No internet service can guarantee absolute security; Users must keep their account credentials confidential and promptly report suspected misuse.

We retain Personal Data and TikTok Data only for as long as reasonably necessary to provide the Services, meet the documented purpose, resolve disputes, enforce agreements, maintain security records, and comply with legal obligations. Upon a valid deletion request or account closure, we delete or de-identify data within 30 days unless a longer period is required for legal, tax, accounting, anti-fraud, dispute, or backup-system purposes. Data in encrypted backups is isolated from active use and removed through normal backup rotation, generally within 90 days.

11. International Transfers

Information may be processed in countries other than the country where it was collected. Where required, AlcaAds uses appropriate safeguards for international transfers, such as contractual commitments, transfer assessments, and supplementary technical and organizational measures. You may contact us to request information about the safeguards applicable to your transfer.

12. Children's Privacy

The Services are designed for business and professional advertising use and are not directed to children. We do not knowingly collect Personal Data from individuals under 18, or the minimum age required by applicable law. If you believe a child has provided Personal Data to AlcaAds, contact us so that we can investigate and delete it where appropriate.

13. Your Rights, Disconnection, and Deletion

Subject to applicable law, you may request access to, correction of, restriction of, objection to, portability of, or deletion of Personal Data. You may withdraw consent at any time; withdrawal does not affect processing completed before it is effective.

Right to delete data

Use the in-app account controls, disconnect the relevant TikTok account, or email support@alcaads.com with the subject “Data Deletion Request.” Please include the account email and, if applicable, the connected TikTok advertiser or account identifier. We may request verification before acting on a request.

Right to access and correct data

You may request a copy of eligible Personal Data or ask us to correct inaccurate account information by emailing support. Some advertising records originate from TikTok; corrections to those records may need to be made within TikTok, after which AlcaAds will reflect a subsequent authorized synchronization.

How to disconnect TikTok

1. Sign in to app.alcaads.com.
2. Open the workspace's Integrations or Connected Accounts settings.
3. Select the applicable TikTok connection and choose “Disconnect.”
4. Confirm the action. Future API access will stop once the credential is invalidated.

You may also revoke the authorization from TikTok's account or connected-app settings. Our complete process is available in the TikTok API Data Deletion Instructions and Data Deletion Policy.

14. Changes to This Policy

We may update this Policy to reflect changes to the Services, law, or our practices. We will post the revised version with a new effective date. For material changes, we will provide additional notice when legally required. Continued use after the effective date is subject to the updated Policy.