Privacy Policy
Last updated: April 27, 2026
Ads Octo (operated by Neural Link Co., Ltd.) is committed to protecting your privacy. This policy explains how we collect, use, and process personal data in compliance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
1. Data Controller
Neural Link Co., Ltd. acts as the Data Controller under PDPA for all personal data processed through the Ads Octo platform.
2. Data We Collect
We collect the following information to provide the Ads Octo service:
- Account data: name, email address, phone number, and encrypted password
- Business data: company name, business type, and approximate ad spend
- Meta ad account data: encrypted Access Token, Ad Account ID, Campaign IDs
- Ad performance data: ROAS, CPA, CTR, spend and impressions from the Meta API
- Usage data: login logs, automation rule configurations, and Audit Trail
- Payment data: processed via Payment Gateway — we never store raw card details
3. How We Use Your Data
We use your personal data for the following purposes:
- Provide the Ads Octo service including AI Stop-Loss, RAG Dashboard, and Automation Rules
- Send alerts when campaigns are auto-paused or ad spend anomalies are detected
- Analyze and improve platform performance
- Comply with applicable laws and regulations
- Send product updates and promotions (only with your consent)
4. Legal Basis for Processing (PDPA)
We process your personal data under the following legal bases:
Contractual Necessity
To provide the services you subscribed to, such as AI Stop-Loss and the Dashboard
Consent
For marketing emails. You may withdraw consent at any time
Legitimate Interests
To improve the service, prevent fraud, and maintain system security
Legal Obligation
When required by law to retain or disclose data, e.g., tax regulations
5. Disclosure to Third Parties
We share your data with third parties only in the following circumstances:
- Meta (Facebook): to retrieve campaign data via the Meta Ads API as authorized by you
- Infrastructure providers: cloud hosting, database, and email services covered by DPAs
- Payment processors: solely for processing subscription payments
- Government authorities: only when required by a valid legal order
6. Data Retention
We retain your personal data for as long as your account is active, and for 3 years after account closure for legal purposes. Financial data is retained for 7 years per Thai accounting law. Ad performance data from the Meta API is retained for 2 years from collection, then securely deleted.
7. Your Rights as a Data Subject (PDPA Sections 30–37)
As a data subject, you have the following rights under PDPA:
Right to be Informed
Know what data we hold, why, and how it is used
Right of Access
Request a copy of the personal data we hold about you
Right to Rectification
Request correction of inaccurate or incomplete data
Right to Erasure
Request deletion of your personal data from our systems
Right to Object
Object to processing in certain cases, such as direct marketing
Right to Restrict
Request a restriction on processing while other requests are pending
Right to Data Portability
Receive your data in a machine-readable format to transfer to another provider
To exercise any of these rights, please email us at the address below. We will respond within 30 days as required by PDPA. contact@adsocto.app
8. Data Security
We apply enterprise-grade security measures to protect your data:
- Access Tokens encrypted with AES-256 — never stored in plain text
- All communications over HTTPS / TLS 1.3
- Role-Based Access Control (RBAC) to limit data access
- Audit Log for every action affecting user data
9. Cookies
We use three categories of cookies: (1) necessary cookies that maintain your login session and security — always on and cannot be disabled; (2) analytics cookies (Google Analytics); and (3) marketing cookies (HubSpot and referral tracking). Categories (2) and (3) are only stored after you accept them via our cookie consent bar — nothing is stored before you consent. You can change or withdraw your consent at any time through the ‘Cookie settings’ link in the footer of every page.
10. Meta (Facebook) Integration
When you connect your Meta Ads account to Ads Octo, we access and process the following data via the Meta Marketing API:
- Ad account info: Ad Account ID, account name, and permissions
- Campaign data: names, statuses, budgets, and date ranges
- Performance metrics: Impressions, Clicks, Spend, ROAS, and CPA
- Access Token: AES-256 encrypted — never exposed or shared with third parties
If you want Ads Octo to delete all data received from your Facebook/Meta account, you can submit a deletion request at:
Request Facebook Data Deletion →11. Policy Updates
We may update this Privacy Policy periodically. For material changes, we will notify you via your registered email or a prominent notice on the platform. Continued use after the effective date constitutes acceptance of the updated policy.
12. Contact the Data Protection Officer (DPO)
For questions about this policy, to exercise your PDPA rights, or to file a complaint, please contact: