Privacy Policy

1. Who We Are

DataHooks (“we,” “us,” or “our”) is a product of Pachamama Harmony, S.A.P.I. de C.V., a company incorporated under the laws of Mexico (RFC: PHA250218LB4). Our website is located at https://datahooks.ai.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our platform, or engage with our services — including our integrations with the Meta (Facebook) Ads API, Instagram Graph API, Google Ads API, Google Analytics Data API, Shopify Admin API, and other third-party platforms.

2. Information We Collect

2.1 Information You Provide

• Account & Contact Information: Name, email address, company name, website URL, and any other details you submit through our forms or during onboarding.
• Communication Data: Messages, emails, or other communications you send to us.
• Billing Information: Payment details processed through Stripe. We do not store full credit card numbers on our servers.
• OAuth Credentials: Access tokens and refresh tokens obtained through OAuth authorization flows with third-party platforms. These are stored encrypted and used solely to access data you have authorized.

2.2 Information We Collect Automatically

• Usage Data: Pages visited, features used, timestamps, referring URLs, and interactions with our platform.
• Device Data: IP address, browser type, operating system, and device identifiers.
• Cookies & Tracking Technologies: We use cookies, pixels, and similar technologies to improve your experience, analyze traffic, and personalize content. See Section 8 for more detail.

2.3 Information from Third-Party Integrations

When you connect your accounts through our platform via OAuth authorization, we access data from third-party services, including but not limited to:

• Meta (Facebook) Ads API: We access your Meta Ads account data in read-only mode. This includes campaign performance metrics (impressions, clicks, spend, conversions, CPC, CPM, CTR, ROAS), ad creative metadata, audience insights, and account-level reporting data. The ads_management scope is required to access certain reporting endpoints and detailed metric breakdowns not available through read-only scopes alone. We do not create, modify, pause, or delete any campaigns, ads, or audiences in your Meta account.
• Instagram Graph API: We access your Instagram Business or Creator account data in read-only mode, including media posts, stories, engagement metrics (likes, comments, shares, saves), follower counts, reach, impressions, and audience demographics. We do not publish, delete, or modify any Instagram content.
• Google Ads API: Campaign performance data, ad group metrics, keyword performance, spend, impressions, clicks, conversions, and account-level reporting. Accessed in read-only mode.
• Google Analytics Data API: Website traffic data including sessions, users, pageviews, traffic sources, conversion events, and e-commerce metrics. Accessed in read-only mode.
• Shopify Admin API: Store analytics, order data, product catalogs, customer information, and transaction data (as authorized by you). Accessed in read-only mode.

3. How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: To provide, operate, and maintain our platform and services, including analytics dashboards, AI-driven insights, and performance reporting.
• Analytics & Optimization: To analyze advertising performance, model unit economics, and generate actionable recommendations for your business.
• AI-Powered Analysis: To process your data through artificial intelligence systems for creative analysis, performance scoring, and insight generation. See Section 6 for details on AI processing.
• Communication: To respond to inquiries, send service updates, and provide customer support.
• Improvement: To improve our platform, develop new features, and enhance user experience.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Security: To detect, prevent, and address fraud, abuse, and technical issues.

3.1 Legal Bases for Processing (EEA Users)

If you are located in the European Economic Area, we process your personal data on the following legal bases:

• Contract: Processing necessary to provide the Services you have requested.
• Consent: Where you have given explicit consent (e.g., connecting third-party platforms via OAuth).
• Legitimate Interest: For product improvement, security, and fraud prevention, where these interests are not overridden by your rights.
• Legal Obligation: Where processing is required by applicable law.

4. How We Share Your Information

We do not sell your personal information. We may share your data only in the following circumstances:

• Service Providers: With the third-party service providers listed below, each bound by contractual obligations to protect your data and use it only for the services they provide to us.
• With Your Consent: When you explicitly authorize us to share information with a third party.
• Legal Requirements: When required by law, regulation, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.
• Aggregated or Anonymized Data: We may share aggregated or de-identified data that cannot reasonably identify you for research, benchmarking, or industry reporting.

4.1 Service Providers and Sub-Processors

We share data with the following service providers:

5. Meta (Facebook) and Instagram Platform Data

Our use of data received from the Meta (Facebook) Ads API and Instagram Graph API complies with the Meta Platform Terms and the Meta Developer Policies. Specifically:

• We access Meta Ads and Instagram data exclusively in read-only mode for analytics and reporting purposes.
• We do not sell, license, or sublicense Meta or Instagram Platform Data to any third parties.
• We do not use Meta or Instagram Platform Data to build or augment user profiles for advertising or targeting purposes outside of our services.
• We do not transfer Meta or Instagram Platform Data to any ad network, data broker, or other advertising-related service.
• We do not use Meta or Instagram Platform Data for discriminatory purposes, surveillance, eligibility determinations for housing, employment, insurance, credit, or government benefits, or any purpose not described in this Privacy Policy.
• We store Meta and Instagram Platform Data securely and delete it when no longer necessary for the purposes for which it was collected, or upon your request.
• We will promptly delete Meta and Instagram Platform Data upon request by Meta, in accordance with the Meta Platform Terms.
• You may revoke our access to your Meta Ads or Instagram data at any time through your Meta Business Settings or by contacting us directly.

5.1 Meta and Instagram Permissions

Our application requests the following permissions, each used solely for the purposes described:

• ads_read — Read advertising campaign performance metrics and reporting data.
• ads_management — Required to access certain reporting endpoints and detailed metric breakdowns not available through read-only scopes alone. We do not use this permission to create, modify, or delete ads.
• read_insights — Read performance insights and analytics for ad accounts.
• business_management — Read business account structure and asset information.
• instagram_basic — Read basic Instagram profile information and media.
• instagram_manage_insights — Read Instagram engagement metrics, reach, and audience data.
• pages_show_list — List Facebook Pages associated with your account to find linked Instagram Business accounts.
• pages_read_engagement — Read engagement data from Facebook Pages linked to Instagram accounts.

6. AI Processing of Your Data

DataHooks uses artificial intelligence to analyze your advertising and business data and generate insights. When processing your data through AI systems:

• We use third-party AI providers, specifically Google Gemini and OpenAI, solely for real-time analysis and inference.
• Data sent to AI providers may include: advertising performance metrics, creative content (video transcriptions, ad copy text), campaign structure data, and aggregated account-level context.
• We do not use your data to train, fine-tune, or improve any AI or machine learning model. Data is processed solely to generate insights and recommendations for your use.
• AI-generated insights, scores, and analysis are stored in our systems to provide you with historical reporting and trend analysis.
• All AI providers are bound by data processing agreements with equivalent security and confidentiality obligations.
• You may request deletion of all AI-processed data and derived insights by contacting us at [email protected].

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Data: Retained for the duration of your active account and for up to 12 months after account closure.
• Platform Integration Data (Meta Ads, Instagram, Google Ads, Shopify, etc.): Retained for the duration of your active connection and deleted within 90 days of disconnection or account termination, unless otherwise required by law. Meta and Instagram Platform Data is deleted within 14 days of a deletion request.
• AI-Generated Insights: Retained for the duration of your active account. Deleted upon account closure or upon request.
• Billing Data: Retained for up to 7 years as required by tax and financial regulations.
• Usage & Analytics Data: Retained in aggregate or anonymized form for up to 24 months for service improvement.
• OAuth Tokens: Retained for the duration of the active connection. Deleted immediately upon disconnection.

8. Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies:

• Essential Cookies: Required for the platform to function (session management, authentication).
• Analytics Cookies: Help us understand how visitors interact with our website. We use PostHog for product analytics and Google Analytics for website traffic analysis.
• Marketing Cookies: Used to deliver relevant advertisements and track campaign effectiveness.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our platform.

Our Services do not currently respond to “Do Not Track” (DNT) browser signals. We will update this policy if we adopt DNT support in the future.

9. Data Security

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS/SSL), encryption at rest, access controls, regular security assessments, and secure cloud infrastructure. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

In the event of a security incident involving unauthorized access to, or disclosure of, personal data or Platform Data, we will: (a) investigate and take immediate steps to mitigate the impact; (b) notify affected users without undue delay and in accordance with applicable law; and (c) report the incident to Meta via their designated incident reporting form and to other relevant platform providers and authorities as required.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal obligations. See our Data Deletion page for details.
• Portability: Request your data in a structured, commonly used, and machine-readable format.
• Objection: Object to processing of your data for certain purposes.
• Withdrawal of Consent: Where processing is based on consent, withdraw that consent at any time.
• Revocation of Third-Party Access: Disconnect any integrated platform (Meta, Instagram, Google, Shopify, etc.) at any time through our platform or by contacting us.

To exercise any of these rights, contact us at [email protected]. We will acknowledge your request within 2 business days and respond within 30 days.

10.1 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: Request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. No opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

11. Google API Services

Our use of information received from Google APIs (Google Ads API, Google Analytics Data API) adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access Google data in read-only mode for analytics and reporting purposes only.

12. International Data Transfers

Your data may be processed and stored in servers located in the United States and Mexico. By using our services, you consent to the transfer of your information to these jurisdictions, which may have data protection laws that differ from those in your country of residence. We take appropriate measures to ensure your data is treated securely and in accordance with this policy.

13. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a minor, please contact us and we will promptly delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: