Privacy Policy

1. Information We Collect

Personal Information You Provide

• Account Registration: Email address, password, name, and organization name when you create an account
• Billing Information: Payment details, billing address, and VAT number (if applicable). Payment processing is handled by Stripe; we do not store full credit card numbers
• Communications: Information you provide when contacting support, providing feedback, or communicating with us
• Profile Information: Optional profile details you choose to add, such as phone number or company information

Advertising Account Data

• Account Credentials: Usernames, passwords, access tokens, API keys, and other credentials for advertising platforms you manage
• Campaign Metrics: Performance data including impressions, clicks, spend, revenue, ROAS, CTR, CPM, and other metrics
• Account Metadata: Account statuses, notes, tags, workflow states, policy violation history, and action reminders
• Import/Export Files: CSV, JSON, or other files you upload or export through our platform

Automatically Collected Information

• Usage Data: Features used, pages viewed, time spent, actions taken, import/export frequency, and interaction patterns
• Device Information: IP address, browser type and version, operating system, device identifiers, and screen resolution
• Log Data: Access times, error logs, and API request logs for security and troubleshooting purposes
• Cookies and Tracking: Information collected through cookies, web beacons, and similar technologies (see Section 5)

Information from Third Parties

• Authentication Providers: If you sign in using Google or other OAuth providers, we receive basic profile information
• Advertising Platforms: When you connect your advertising accounts, we may receive data from those platforms via their APIs

2. How We Use Your Information

Service Delivery

• Provide, operate, and maintain the AffiDock platform
• Process and display your advertising account data
• Enable import and export functionality for your accounts
• Sync campaign metrics and display analytics
• Facilitate team collaboration and role-based access

Communication

• Send service-related notifications and updates
• Respond to your inquiries and provide customer support
• Send security alerts and critical account notifications
• Send marketing communications about new features or updates (you can opt out at any time)

Improvement and Analytics

• Analyze usage patterns to improve features and user experience
• Develop new features based on aggregated, anonymized usage data
• Conduct A/B testing and product experiments
• Monitor and analyze trends, usage, and activities

Security and Compliance

• Detect and prevent fraud, abuse, and security incidents
• Monitor for suspicious activity and unauthorized access
• Comply with legal obligations and enforce our Terms of Service
• Protect the rights, property, and safety of Shock Experts, our users, and the public

Business Operations

• Process payments and maintain billing records
• Generate invoices and manage subscriptions
• Conduct internal research and development
• In connection with business transfers (mergers, acquisitions, asset sales) subject to confidentiality obligations

3. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds under GDPR and UK Data Protection Act 2018:

• Contract Performance: Processing necessary to provide our services as agreed in our Terms of Service
• Legitimate Interests: To improve our services, ensure security, and conduct business operations (balanced against your rights)
• Consent: For marketing communications and optional features (you can withdraw consent at any time)
• Legal Obligation: To comply with tax, accounting, and other legal requirements

4. How We Share Your Information

We never sell your personal information or advertising account data. We never share your account credentials with third parties for their own purposes.

Service Providers

We share data with trusted service providers who assist in operating our platform:

• Cloud Hosting: AWS or Google Cloud Platform for infrastructure and data storage
• Payment Processing: Stripe for payment processing (PCI DSS compliant)
• Email Services: Transactional email providers for service notifications
• Analytics: Privacy-focused analytics tools to understand usage patterns
• Support Tools: Customer support platforms to manage inquiries

All service providers are bound by data processing agreements and security requirements.

Team Members

If you invite team members to your organization, they will have access to account data based on the permissions you assign.

Legal Requirements

We may disclose information when required by law or to:

• Comply with legal processes, court orders, or government requests
• Enforce our Terms of Service and investigate violations
• Protect against fraud, security threats, or illegal activity
• Protect the rights, property, and safety of Shock Experts, our users, or the public

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and/or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

5. Cookies and Tracking Technologies

Types of Cookies We Use

• Essential Cookies: Required for the platform to function (authentication, security, session management)
• Functional Cookies: Remember your preferences and settings (theme, language, dashboard layout)
• Analytics Cookies: Help us understand how users interact with the platform (anonymized data)
• Marketing Cookies: Track visits across websites to show relevant ads (only with your consent)

Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may prevent you from using certain features. For detailed cookie management, visit our Cookie Policy.

Do Not Track

Some browsers include a "Do Not Track" feature. Our platform does not currently respond to Do Not Track signals, but we provide granular privacy controls in your account settings.

6. Data Retention

• Active Accounts: Your data is retained for as long as your account remains active
• Account Deletion: When you delete your account, personal data and account credentials are permanently deleted within 30 days
• Backup Systems: Backup copies are retained for up to 90 days for disaster recovery purposes
• Billing Records: Financial records may be retained for up to 7 years to comply with tax and accounting regulations
• Legal Hold: Data may be retained longer if required by legal proceedings or investigations
• Anonymized Data: Aggregated, anonymized usage data may be retained indefinitely for analytics and product development

7. Your Privacy Rights

GDPR Rights (UK and EU Users)

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Data Portability: Receive your data in a machine-readable format (CSV, JSON)
• Right to Restriction: Request temporary restriction of data processing
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent for optional data uses at any time
• Right to Lodge a Complaint: File a complaint with the UK Information Commissioner's Office (ICO)

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

• Right to know what personal information we collect, use, and disclose
• Right to request deletion of personal information
• Right to opt-out of the sale of personal information (we don't sell data)
• Right to non-discrimination for exercising your privacy rights

How to Exercise Your Rights

To exercise any of these rights, contact us at legal@shock-experts.com. We will respond to verified requests within 30 days. You may also manage many settings directly in your account dashboard.

8. Data Security

We implement industry-standard security measures to protect your information. For detailed information about our security practices, encryption methods, and infrastructure security, please see our Data Protection page.

Key security measures include:

• AES-256 encryption for data at rest
• TLS 1.3 for data in transit
• Isolated credential vault with separate access controls
• Multi-factor authentication (MFA)
• Regular security audits and penetration testing
• 24/7 monitoring for suspicious activity

9. International Data Transfers

AffiDock is operated by Shock Experts LLP, a company registered in England and Wales. Your data is primarily stored in UK/EU data centers. If we transfer data outside the UK/EU, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Ensuring service providers have adequate data protection measures
• Encryption in transit and at rest regardless of location

10. Third-Party Links

Our platform may contain links to third-party websites or services (such as advertising platforms you manage). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

11. Children's Privacy

AffiDock is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately at legal@shock-experts.com, and we will take steps to delete such information.

12. Marketing Communications

With your consent, we may send you marketing emails about new features, product updates, and special offers. You can opt out at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Adjusting your email preferences in your account settings
• Contacting us at legal@shock-experts.com

Note: You cannot opt out of essential service communications (security alerts, billing notifications, important service updates).

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Email notification to your registered email address
• Prominent notice in the application
• Updating the "Last updated" date at the top of this policy

Your continued use of AffiDock after the effective date of changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: legal@shock-experts.com
• Postal Address: Shock Experts LLP, London, United Kingdom, OC457555

For UK/EU users: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk