Privacy Policy

Information We Collect

We collect information in the following ways:

Information you provide directly:

• Contact form submissions — name, email address, company name, and message content submitted via our website contact form (powered by Tally.so)
• Business information shared during onboarding — Meta Ads account access, brand assets, revenue data, and performance metrics necessary to deliver our services
• Communication records — emails, call notes, and messages exchanged in the course of our engagement

Information collected automatically:

• Website analytics — Microsoft Clarity collects behavioral data including session recordings, heatmaps, rage clicks, and general interaction patterns to help us improve the website experience. This data is anonymized and aggregated.
• Standard server logs — IP addresses, browser type, pages visited, and timestamps, retained for security and diagnostic purposes

How We Use Your Information

We use the information we collect exclusively to:

• Respond to inquiries submitted through our contact form
• Deliver Meta Ads management services, including campaign strategy, creative direction, audience targeting, and performance reporting
• Communicate about your engagement — reporting, approvals, strategy updates, and billing
• Fulfill contractual obligations under our Master Service Agreement
• Improve our website through behavioral analytics
• Comply with applicable legal obligations

Third-Party Services

In delivering our services, we work with the following third-party platforms. Each operates under its own privacy policy:

• Meta (Facebook/Instagram) — the advertising platform we manage on your behalf. Your ad account data is governed by Meta's Data Policy.
• Microsoft Clarity — behavioral analytics on vitalevo.co. Data is processed by Microsoft under their privacy terms.
• Tally.so — contact form submissions. Data is processed by Tally under their privacy terms.
• Google Workspace — email and communication. Data is processed by Google under their privacy terms.
• Klaviyo / Stay AI / Okendo / Yotpo — retention and email platforms that may be deployed as part of client engagements, subject to each platform's terms.

We do not grant third parties access to your business data beyond what is operationally required to deliver your contracted services.

Client Business Data

As part of delivering Meta Ads management services, we access and process client business data including ad account credentials, revenue figures, audience data, creative assets, and performance metrics. This data is:

• Used exclusively to fulfill the contracted scope of work
• Never shared with other clients or third parties outside of the platforms required to run your campaigns
• Treated as confidential under the terms of our Master Service Agreement
• Returned or deleted upon termination of the engagement, per the terms of your agreement

Data Retention

We retain personal and business information for as long as necessary to fulfill the purposes described in this policy, and as required by applicable law. Specifically:

• Contact form data is retained until the inquiry is resolved or for up to 12 months if no engagement is initiated
• Client business data is retained for the duration of the active engagement and for up to 90 days after termination, after which it is securely deleted or returned
• Website analytics data is retained per Microsoft Clarity's default retention settings (30 days rolling)
• Communication records may be retained for up to 3 years for legal and business record purposes

Your Rights

Depending on your location, you may have certain rights regarding your personal information:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Deletion — request deletion of your personal information, subject to legal retention requirements
• Opt-out — opt out of any non-essential data collection, including website analytics

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt-out of sale (we do not sell personal information). To exercise any of these rights, contact us at the address below.

Security

We take reasonable technical and organizational measures to protect your information from unauthorized access, disclosure, or destruction. This includes access controls, encrypted communications, and limiting data access to those who require it to deliver your services.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.

For material changes affecting active client engagements, we will notify affected clients directly via email.