PerflyMax Privacy Policy

2. Legal Basis for Processing Data

We process your personal data under the following legal bases:

• Performance of a Contract: To provide the advertising analytics services you sign up for.
• Legal Obligation: To comply with tax, security, and statutory requirements.
• Legitimate Interests: To monitor performance, protect our infrastructure against fraud, and improve application functionality.
• Consent: Where you explicitly authorize us to connect your third-party advertising accounts (Google Ads, Meta Ads, TikTok Ads).

3. Data We Collect

We collect, or process on behalf of our customers, the following categories of personal data when you use or interact with our products and services:

• Account and Profile Data: Name, email address, username, company name, phone number, and password hashes.
• Workspace and Integration Data: OAuth tokens, access credentials, authentication statuses, account identifiers, and selected customer profile configurations.
• Advertising and Reporting Data: Campaign names, ad group IDs, historical spend, conversion data, revenue, clicks, impressions, ROAS, and related performance metrics fetched via Google Ads API, Meta Graph API, and TikTok Marketing API.
• Technical and Usage Data: IP addresses, browser types, device information, operating systems, request headers, error logs, and system audit events.
• Billing Information: Payment and subscription details (processed securely via encrypted third-party payment processors).

4. Purpose of Data Processing

We use the collected information for the following specific business purposes:

• To authenticate your identity and provide secure access to your PerflyMax workspace.
• To connect and synchronize your marketing accounts from Google Ads, Meta Ads, and TikTok Ads.
• To consolidate, analyze, and visualize your advertising campaign metrics into centralized reporting dashboards.
• To deliver automated alerts, performance notifications, password resets, and customer support communications.
• To maintain service security, monitor network integrity, prevent abusive activity, and comply with legal or regulatory requests.

5. Specific Disclosures for Google User Data (Google API Limited Use)

PerflyMax's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Limited Use: We strictly limit the use of Google user data to providing or improving user-facing features of PerflyMax.
• Prohibited Activities: We will not sell your Google user data to third parties under any circumstances. We do not use Google user data for:
  • Targeted advertising, personalized ads, or retargeted/interest-based advertisements.
  • Selling to data brokers or transferring to information resellers.
  • Credit-worthiness evaluation or lending purposes.
  • Creating standalone external databases or training AI/machine learning models.

6. Cookies and Tracking Technologies

PerflyMax uses essential cookies for session management, user authentication, and workspace context preservation.

On our marketing website (homepage), we may utilize analytical tools, Meta Pixels, and TikTok Pixels to track website interaction and optimize our marketing efforts. You can manage your tracking preferences and disable non-essential cookies via your browser settings at any time.

7. Data Sharing, Transfers, and Third-Party Disclosures

We do not transfer or disclose your personal information or Google/Meta/TikTok user data to third parties for purposes other than the ones provided in this policy.

We only share data with trusted third-party service providers (such as cloud hosting, security monitoring, and transactional email infrastructure) acting strictly on our behalf under data processing agreements. These providers are bound by strict confidentiality obligations and are prohibited from using your data for any other purpose. We may disclose data if required by law, regulation, or a valid legal warrant.

International Transfers: When data is transferred outside the EEA, Switzerland, or Turkey, we ensure appropriate safeguards (such as Standard Contractual Clauses) are implemented to maintain data integrity.

8. Security and Data Protection Mechanisms

Security procedures are in place to protect the confidentiality, integrity, and availability of your data. We use encryption to protect your information, both in transit (via HTTPS/TLS) and at rest. Sensitive connection credentials, including OAuth tokens for Google, Meta, and TikTok, are encrypted using industry-standard cryptographic algorithms. We restrict data access using strict role-based access control (RBAC), regular vulnerability monitoring, and comprehensive audit logs.

9. Data Retention Policy

We store your personal information and integrated platform data for a period of time that is consistent with our business purposes. We will retain your personal information for the length of time needed to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law. When the data retention period expires for a given type of data, we will delete, destroy, or permanently anonymize it.

10. Your Privacy Rights

Depending on your location (under GDPR, KVKK, or CCPA), you hold specific statutory rights regarding your personal data. You have the right to:

• Access, review, and request a copy of the data we hold about you.
• Rectify or update inaccurate or incomplete information.
• Erasure ("Right to be Forgotten") of your personal profile and account histories.
• Restrict or object to the processing of your data under specific conditions.
• Withdraw your consent at any time for third-party integrations without affecting previous legality.

To exercise any of these rights, contact us at info@perflymax.com.

11. Data Deletion Instructions & Platform Callback Procedures

You can request full deletion of your PerflyMax account, workspace data, and all connected advertising integrations at any time.

How to request data deletion:

1. Send an email to info@perflymax.com from the email address registered to your PerflyMax profile.
2. Use the subject line: "Data Deletion Request".
3. Specify your account details and the connected workspaces you wish to purge.

Upon verification, PerflyMax will permanently delete or anonymize the following data within 30 days:

• Your profile, workspace memberships, and configuration preferences.
• Connected OAuth tokens, ad account access structures, and synchronization pipelines.
• All cached reporting, campaign, and performance metrics from Google Ads, Meta Ads, and TikTok Ads.

Meta (Facebook) Application Deletion Callback:

If you have connected PerflyMax via Meta/Facebook, you can remove our application's data access permissions via your Facebook "Settings & Privacy > Apps and Websites" menu. Once removed, PerflyMax will instantly halt future data collection. If you wish to trigger a formal deletion of your historical analytics data processed prior to disconnection, please follow the standard email deletion process mentioned above.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to accommodate new platform requirements, features, or legal updates. When a change occurs, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically to stay informed about how we protect your data.