Privacy Policy

Controller and contact

Hit My Key Solutions S.L., Spain.
Contact for any privacy question or request: admin@hitmykey.com.

Who this policy is for

The Tool is used by advertisers and agencies. You create an account with your email address, and belong to an organization whose members share its connected ad platforms, tasks and creative library. The Tool does not collect data about the audiences your ads reach, and never sees your customers' data.

What we collect

• Your account. Your email address and a hash of your password (argon2 - the password itself is never stored and cannot be recovered from the hash), whether the address is confirmed, the name of your organization and your role in it, and a record of failed sign-in attempts so an account can be locked after repeated wrong passwords.
• Sign-in security data. Emailed one-time codes, kept as a hash until they are used or expire; a hashed token for each browser you chose to have remembered for 30 days; and invitation links, also stored only as a hash.
• The platform connections your organization makes. For Meta: the access token, the Facebook account or business portfolio it belongs to, and which ad accounts it can reach. For AppLovin: the account ID and API keys. Tokens and keys are encrypted at rest (AES-256-GCM) and are never shown back to anyone, including us, through the app.
• The advertising objects you work with. Ad account, campaign, ad set, ad and creative set identifiers and names on Meta and AppLovin, plus the targeting and creative text you choose to copy or edit.
• Files from the Google Drive folders you provide. Only folders you have explicitly shared with our service account are read, and only with read-only permission.
• A history of what the Tool has done. For each task: which organization ran it, which ad account or campaign it worked on, how many ads or creative sets it created, which ones, when, and any error it reported. For AppLovin, a list of the creatives in your library, so they can be launched later.

We do not use analytics, advertising pixels, or third-party trackers, and the Tool sets no cookies beyond the two described below.

Cookies

• Session cookie. Encrypted, holds your user ID and which organization you are working in. Necessary to stay signed in; cleared when you sign out.
• Remembered-browser cookie. Set only after you sign in with an emailed code, so this browser is not asked for a new code for 30 days. It holds a random value whose hash we store; signing out deliberately leaves it in place, and clearing cookies removes it.

Why we process it, and on what legal basis

We process your account data and the connections you make to provide the service you signed up for: reading your existing ad structure, uploading your creatives, and creating the ad sets, ads and creative sets you configured. Under Article 6(1)(b) GDPR this is processing necessary to perform our agreement with you.

We process sign-in security data - emailed codes, lockout counters, remembered browsers - to keep accounts and the connected ad accounts they can spend from safe from unauthorised access, and we keep the task history so there is a reliable record of what was launched, where and when, which matters when a task fails part-way. Both are our legitimate interest under Article 6(1)(f) GDPR. We do not process your data for profiling or marketing, and we do not sell it.

Where it is stored, and for how long

• Accounts, organizations, connections, task history and creative library are stored in a PostgreSQL database run by our hosting provider, and kept while your account exists. Delete your account and they go with it; ask us and we delete them sooner.
• Emailed codes and invitations expire on their own - codes after ten minutes, password resets after an hour, invitations after seven days - and remembered browsers after 30 days.
• Creative files are transient. Each file is downloaded to temporary disk, uploaded to Meta or AppLovin, and deleted as soon as it has been processed. The whole temporary directory is removed when the task finishes.

Who we share it with

The Tool sends data to these services, in each case only to do what you asked it to do:

• Meta (Graph API) - your creatives, ad copy and targeting choices, sent under your organization's connection to create the ads you requested.
• AppLovin - your creatives, and the creative sets you configure, sent to the AppLovin account your organization connected.
• Google Drive API - read requests for the folders you shared with our service account.
• Google (Gmail SMTP) - the emails the Tool sends you: address confirmation, sign-in codes, password resets and invitations.
• Railway Corp. - our hosting provider, acting as a data processor. The application server and the database run on its infrastructure.
• Stripe - if your organization subscribes. You enter your card on Stripe's own pages, and we never see or store card details: Stripe holds them, takes the payment and issues the invoices, acting as a controller for that. What comes back to us is your organization's customer and subscription identifiers, whether the subscription is paid up, and when the period ends - which is what decides whether the Tool will run a launch. The billing name, address and email you give Stripe stay with Stripe.

Our pages also load the Montserrat webfont from Google Fonts, which means Google receives your IP address when a page loads. We sell no data, and share none for advertising.

International transfers

Our hosting provider, Railway Corp., is established in the United States, and its personnel can access the infrastructure remotely from there; the same applies to Google, Meta and Stripe as recipients of the data described above. Where this results in a transfer of personal data outside the European Economic Area, that transfer is governed by our agreements with those providers and the safeguards they contain, including the European Commission's Standard Contractual Clauses.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format.

Some of this you can do yourself at any time: sign out to clear the session, disconnect any Meta or AppLovin connection in Settings → Integrations (which deletes the stored token or keys), remove members in Settings → People, revoke the Tool's access from Facebook's Business Integrations settings, and un-share any Google Drive folder from our service account. See our Data Deletion page for step-by-step instructions.

To have your account and its data deleted, or to exercise any other right in writing, email admin@hitmykey.com. We respond within 30 days. If you believe we have handled your data improperly, you have the right to lodge a complaint with a supervisory authority - in Spain, the Agencia Española de Protección de Datos (AEPD, aepd.es).

Changes to this policy

If we change how the Tool handles data we will update this page and the date at the top of it.