Privacy Policy

1 Data We Collect

We collect several categories of information to provide and improve the 444Affiliates platform:

1.1 Account Information

When you register, we collect:

• Name — your full name or business name
• Email address — used for login, billing notifications, and support
• Password — stored as a one-way cryptographic hash (never stored in plain text)
• Billing information — processed by our payment processor; we store only the last 4 digits of your card and billing address for reference
• Account preferences — timezone, notification settings, default platform selections

1.2 Business Data

Information about your business that you enter into the platform:

• Business name, industry, and description
• Social media handles and page identifiers
• Ad account IDs and campaign configurations
• Brand assets, images, and creative content you upload
• Audience targeting parameters and campaign settings

1.3 Social Media Credentials (OAuth Tokens)

When you connect social media accounts (Meta, Google, TikTok), we store the OAuth access tokens granted by those platforms. These tokens allow our platform to act on your behalf (post content, manage ads, read analytics). All OAuth tokens are encrypted using AES-256-GCM encryption before being stored. We do not store your social media passwords.

1.4 Ad Account Data

Through connected ad platforms, we access and store:

• Ad campaign configurations, creative assets, and targeting settings
• Campaign performance data (impressions, clicks, spend, conversions)
• Audience segments and pixel data as permitted by the connected platform
• Billing and spend summaries from ad accounts

1.5 Contact Lists

If you use CRM or prospecting features, we may store:

• Names, email addresses, and phone numbers of your business contacts and prospects
• Company names, job titles, and LinkedIn or social handles associated with contacts
• Outreach history, notes, and engagement status
• Data sourced through the Apollo.io integration (see Section 5)

You are responsible for ensuring you have a lawful basis to store and process your contacts' personal data in our platform.

1.6 Analytics & Performance Data

• Social media post performance metrics (likes, shares, reach, engagement)
• Ad campaign analytics and ROI data
• Content scheduling history and publishing records

1.7 Usage Data

We automatically collect information about how you use the platform:

• Pages visited, features used, and actions taken within the application
• Time and frequency of platform use
• Error reports and crash data
• Feature adoption and workflow patterns (aggregated and anonymized for product improvement)

1.8 Device & Technical Data

• IP address
• Browser type and version
• Operating system
• Screen resolution and device type
• Referring URL
• Session identifiers

2 How We Collect Data

3 How We Use Your Data

We use the information we collect for the following purposes:

1. To provide and operate the platform. Your account data, business data, and OAuth credentials are used to authenticate you, connect to third-party platforms, run automations, schedule posts, and execute ad campaigns on your behalf.
2. To improve the platform. Usage data and aggregated analytics help us understand how users interact with the platform, identify bugs, and prioritize new features. We use anonymized, aggregated data — not personally identifiable information — for product analysis.
3. To send account-related communications. We use your email address to send:
   • Account registration and verification emails
   • Billing receipts, renewal reminders, and payment failure notices
   • Important policy updates or service changes
   • Security alerts (login from new device, password changes)
4. To provide customer support. Support communications and account information are used to diagnose and resolve issues you report.
5. For security monitoring. IP addresses, session data, and usage patterns help us detect and prevent fraud, unauthorized access, abuse, and security incidents.
6. To comply with legal obligations. We may process and retain data as required by applicable law, including tax records, legal holds, and regulatory requirements.
7. To enforce our Terms. We use account and usage data to investigate and enforce our Terms of Service and Acceptable Use Policy.

We do not use your data to serve you third-party advertising, nor do we sell your data for any purpose.

4 Data Storage & Security

Where your data is stored. All 444Affiliates data is hosted on US-based infrastructure, including Render (application hosting) and Neon (PostgreSQL database hosting). Both providers maintain SOC 2 Type II compliance and industry-standard security practices.

OAuth credentials. Social media access tokens and API keys are encrypted before being written to the database using AES-256-GCM authenticated encryption. The encryption key is stored separately from the data and is never logged.

Password hashing. Account passwords are hashed using a strong one-way hashing algorithm (bcrypt) with a unique salt per user. We cannot retrieve your plaintext password.

Access controls. Access to production data is restricted to authorized personnel on a need-to-know basis. We maintain access logs for audit purposes.

Security limitations. While we implement industry-standard security measures, no system is completely immune to security breaches. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

5 Data Sharing

We do not sell your personal data. We share your data only in the following circumstances:

5.1 Third-Party Integrations (To Provide Features)

We transmit data to the following platforms solely to provide the features you use:

• Meta (Facebook & Instagram) — We send your ad creatives, targeting parameters, and campaign configurations to Meta's APIs to create and manage ad campaigns. We receive performance data back. Meta's use of this data is governed by Meta's Privacy Policy.
• Google — We send campaign data to Google Ads API to create and manage campaigns. Google's use is governed by Google's Privacy Policy.
• TikTok — We send content and ad data to TikTok's APIs. TikTok's use is governed by TikTok's Privacy Policy.
• Apollo.io — When you use prospecting features, we query the Apollo API with search parameters to retrieve prospect data. Apollo's use is governed by Apollo's Privacy Policy.

5.2 Service Providers

We engage trusted service providers who process data on our behalf under contractual obligations that restrict their use of your data:

• Render — Application hosting and infrastructure
• Neon — Database hosting (PostgreSQL)
• Payment processor — Processes subscription payments (we do not store full card numbers)
• Email service provider — Delivers transactional emails

5.3 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect our rights, prevent fraud, or ensure user safety.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred to the acquiring entity. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

6 Data Retention

We retain your data for as long as necessary to provide the service and comply with legal obligations:

After the applicable retention period, data is permanently deleted or anonymized. You may request early deletion of your data as described in Sections 7 and 8 below, subject to our legal retention obligations.

7 Your Rights (California — CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

To exercise any of these rights, contact us at 444affiliates@gmail.com. We will respond within 45 days, with one possible 45-day extension for complex requests.

8 Your Rights (EEA/UK — GDPR/UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR grants you the following rights:

Legal basis for processing. We process your personal data on the following legal bases:

• Contract performance — processing your account data and business data to provide the service you subscribed to
• Legitimate interests — security monitoring, fraud prevention, platform improvement (using anonymized data)
• Legal obligation — retaining billing records for tax compliance
• Consent — where you have given explicit consent (e.g., optional marketing emails)

International transfers. Your data is stored on US-based servers. When we transfer data from the EEA/UK to the US, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms as required by applicable law.

Right to lodge a complaint. If you believe we have violated your data protection rights, you have the right to lodge a complaint with your national Data Protection Authority (DPA).

9 Exercising Your Rights

To exercise any of the rights described in Sections 7 and 8, please contact us:

To protect your privacy and security, we may require you to verify your identity before processing your request. We will not charge a fee for reasonable requests but may charge for excessive or unfounded requests.

Please note that some data cannot be deleted if it is subject to a legal obligation, needed to complete a transaction you requested, or necessary to detect or prevent security incidents.

10 Cookies & Tracking

We use cookies and similar tracking technologies to operate the platform. For full details, see our Cookie Policy. In summary:

• Authentication tokens — We store your JWT authentication token in browser localStorage to keep you logged in. This is required for the platform to function.
• Session cookies — Used to maintain your session state while using the platform.
• Analytics tracking — We may use analytics tools to understand how users navigate the platform (aggregated and anonymized).
• Preference storage — We store your platform preferences (timezone, default settings) in localStorage for a better user experience.
• Third-party pixels — If you connect a Meta ad account, the Meta Pixel may be present. You control this through your connected ad accounts.

You can control cookies through your browser settings, though disabling essential cookies will prevent you from logging in or using the platform.

11 Children's Privacy

444Affiliates is not intended for or directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at 444affiliates@gmail.com and we will promptly delete the information.

12 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

1. Send an email notification to your account email address at least 30 days before the changes take effect
2. Update the "Last Updated" date at the top of this page
3. Post a prominent notice within the platform for active users

Your continued use of the platform after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you disagree with the changes, you may close your account before the effective date.

13 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

You may also review related policies:

• Terms of Service — Your agreement with 444Affiliates
• Cookie Policy — Detailed information on cookies and local storage
• Acceptable Use Policy — Rules for using the platform