Bowtie Beacon

1. Introduction

Bowtie Analytics ("we," "our," or "us") operates Bowtie Beacon, a marketing analytics and campaign management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

2.1 Information You Provide

• Account information (name, email address, password)
• Business information (company name, website, industry)
• Payment information (processed securely through third-party providers)
• Content you create (campaigns, analytics configurations, reports)
• Communications with us (support requests, feedback)

2.2 Information Collected Automatically

• Device information (browser type, operating system)
• Usage data (features used, time spent, interactions)
• Log data (IP address, access times, pages viewed)
• Cookies and similar tracking technologies

2.3 Information from Third Parties

• Social media platforms (when you connect accounts for analytics)
• Advertising platforms (Meta, TikTok, Google) for campaign data
• Email marketing services (Mailchimp) for subscriber analytics

3. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and customer service requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent or unauthorized activity
• Personalize and improve your experience
• Comply with legal obligations

4. Information Sharing

We do not sell your personal information. We may share information in the following circumstances:

• Service Providers: With vendors who assist in providing our services (hosting, analytics, payment processing)
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Legal Requirements: When required by law or to protect our rights
• With Your Consent: When you have given explicit permission

5. Data Security

We implement appropriate technical and organizational security measures to protect your information, including encryption, secure servers, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. We may retain certain information as required by law or for legitimate business purposes, such as resolving disputes and enforcing agreements.

7. Your Rights

Depending on your location, you may have the following rights:

• Access and receive a copy of your personal data
• Rectify inaccurate or incomplete information
• Request deletion of your personal data
• Object to or restrict processing of your data
• Data portability (receive your data in a structured format)
• Withdraw consent at any time

To exercise these rights, please contact us at privacy@bowtieanalytics.com.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in
• Remember your preferences
• Understand how you use our service
• Improve our service based on usage patterns

You can control cookies through your browser settings. Disabling cookies may limit your ability to use certain features of our service.

9. Third-Party Services

Our service integrates with third-party platforms including Meta (Facebook/Instagram), TikTok, Google, and Mailchimp. These integrations are governed by the respective platforms' privacy policies. We only access data you explicitly authorize through these integrations.

9a. Google API Services — Specific Disclosures

Bowtie Beacon's use of information received from Google APIs (including Google Ads API, Google Analytics 4 Measurement Protocol, Google Tag Manager API, and YouTube Data API) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Scope: Read campaign / ad-group / conversion performance and write offline conversions for the operator's own Google Ads account, plus read/send GA4 events for measurement.
• OAuth tokens: Refresh tokens are encrypted at rest using Fernet (AES-128 in CBC mode + HMAC-SHA256) before being written to our database. Tokens are scoped to the minimum needed and never shared across tenants.
• Storage: Campaign performance data is cached only for dashboarding (default 90 days). No raw user-level Google Ads data is sold, resold, or transferred to any third party.
• Automation limits: No automated bidding agents, no ad-creation automation, no automated budget changes — humans make every spend decision in their own Google Ads UI.
• Revocation: Operators can revoke Beacon's access at any time from myaccount.google.com/permissions, which immediately invalidates the refresh token on our side at next use.
• Deletion: Account deletion (see Section 4 and our Data Deletion procedure) purges all stored Google-derived data including tokens, cached metrics, and offline-conversion logs.

10. Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected such information, we will take steps to delete it.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. We ensure appropriate safeguards are in place to protect your information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: