BCBAA

Privacy Policy

Last updated: 4 October 2026

This policy describes what data we handle when we manage advertising accounts on behalf of our clients, and what we do with it. It is written to be read, not to be skimmed past.

1. Who we are

BCBAA is a small performance marketing team that plans and manages TikTok Ads campaigns for e-commerce sellers. You can reach us at [email protected] about anything on this page.

2. What this website collects

Nothing. This site is a set of static pages. There are no accounts, no forms, no cookies set by us, no analytics scripts, and no third-party trackers. Our web server keeps ordinary access logs (IP address, timestamp, requested path, user agent) for operational and security purposes; these are rotated and deleted on a rolling basis.

3. Advertising data we process for clients

We process the following information when it is available through authorised access or supplied by the client. Data needed for planned management features will be accessed only after the relevant API approval, implementation and client authorisation are in place.

• Aggregate campaign performance — spend, impressions, clicks, conversions, orders, revenue, ROI and other derived metrics, including available GMV Max breakdowns.
• Account and asset information — advertising account, Business Center and shop identifiers, available billing information, and asset relationships.
• Campaign and audience configuration — names, delivery status, budgets, ROI targets, audience settings and aggregate audience statistics.
• Creative and creator information — asset identifiers, video metadata, creator profile details, performance statistics and ad authorisation status, where publicly available or covered by the relevant authorisation.
• Management records — planned tools will record configured rules, requested actions, execution results and timestamps to support review and troubleshooting.
• Product and inventory figures that the client shares with us, so that advertising is not scaled into a stock-out.

This workflow uses business advertising data and relevant creator information. We do not collect shopper contact details, customer contact lists or order-level personal information for this reporting and management workflow.

4. How we access it

Access happens in two ways: through the advertising platform's own interface, and through official APIs using access tokens granted by an authorised account or asset administrator.

• Current and planned API use. Current API use is for reporting. We are applying to add campaign, budget, ROI, delivery, creative and audience management, and automated rules. Direct creator-account insights and authorisation integrations are planned separately for a later stage. These features will be enabled only after the required API approval, implementation and client authorisation.
• Client-directed management. When enabled, management actions will be limited to authorised assets and the scope agreed with the client. Automated actions will follow client-approved rules, with operation logs available for review.
• Access tokens held by adpilot are encrypted at rest in its database, and are never written to logs, never displayed in our interface, and never shared.
• Authorisation is revocable. A client can remove our access at any time from their own Business Center, without asking us first. Our access ends immediately when they do.

5. Where it is stored and who can see it

Data is stored on a server that we operate ourselves, hosted with a commercial cloud provider in Japan. It is not sent to any third-party analytics platform, data broker or advertising network. Access is limited to the people on our team who work on that client's account.

We keep the original API responses as an append-only record. That is deliberate: it is how we can answer "what did the platform actually report that day" months later, when a platform has since restated its own numbers.

6. Who we share it with

We do not sell client data, and we do not share it for anyone else's marketing. The only parties involved are:

• The client, whose data it is — they receive it back as reports.
• The advertising platform it came from, under that platform's own terms.
• Our infrastructure provider, which hosts the server. They do not process the data for their own purposes.

We may also disclose data where we are legally required to.

7. How long we keep it

We keep a client's advertising data for as long as we work together, plus a limited period afterwards for accounting and dispute-resolution purposes. On written request from the account owner we will delete their data sooner, other than records we are required to keep. Access tokens are deleted as soon as an engagement ends or authorisation is withdrawn.

8. Your rights

If you are a client, you can ask us at any time for a copy of the data we hold about your accounts, ask us to correct it, or ask us to delete it. Email [email protected] and we will respond within 30 days. You never need our permission to revoke our access to your advertising account — that control stays with you.

9. Security

Traffic to our services is encrypted in transit. Credentials are encrypted at rest. Administrative access requires a password and expires automatically. We do not claim to hold any formal security certification, and we would rather say that plainly than imply otherwise.

10. Changes

If this policy changes, we will update the date at the top. Material changes affecting existing clients will be sent to them by email.