Privacy Policy

Who is responsible

Account data (your name, email, organization, billing details and how you use the service): we are the controller.

Customer data (the marketing, analytics and sales data your organization connects, and the conversations, dashboards and files you create): your organization is the controller and we act as its processor, only on its instructions, under our Data Processing Agreement.

What we collect

• Account data: name and email address from Google Sign-In; your organization, role and workspace access.
• Billing data: plan, payment history and invoices, and a card token, last four digits and expiry month from our payment provider. We never receive or store full card numbers.
• Connected data: data from the services your admins connect, such as ad performance (spend, impressions, clicks, conversions), web analytics and search performance, social page insights, and e-commerce sales totals. These are mostly aggregated business metrics, not data about individuals.
• Content you create: chat messages and files you upload, dashboards, scheduled tasks, skills, generated images and campaign drafts.
• Usage and security data: AI usage per organization (to measure credits), an activity log of sensitive actions, and standard server logs (IP address, browser, timestamps) kept for security.

How we use it, and our legal bases

• To provide the service (contract): sign-in, workspaces, answering questions, building dashboards, running scheduled tasks, generating content.
• Billing (contract and legal obligation): charging subscriptions, issuing invoices, keeping records required by tax law.
• Security and abuse prevention (legitimate interests): protecting accounts, investigating misuse, keeping the service reliable.
• Service emails (contract): sign-in codes and security alerts, payment receipts and failed payments, support replies, notifications you set up and important changes.
• Product updates (legitimate interests, or your consent where the law requires it): occasional news about Bamboo Insights to account holders. Every such email has an unsubscribe link, and unsubscribing doesn't affect service emails. Your name and email address are kept for this with our email provider (Resend) and removed when you delete your account.

What we never do

• We don't sell personal data or share it for advertising.
• We don't use your data to train AI models, and our AI providers don't either.
• We don't combine one customer's data with another's.
• We don't make automated decisions with legal or similar effects about individuals.

AI processing

When you ask the assistant something, the request and the data needed to answer it are sent to our AI providers through their business APIs, which don't use it for training. Image generation and web research requests go to an AI provider without your connected customer data. You're responsible for reviewing AI output before relying on it.

Google API Services: Limited Use

Bamboo Insights' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features you request, is not used to develop, improve or train generalized AI or machine-learning models, is not transferred to third parties except as needed to provide those features or as required by law, and is not read by humans except with your consent, for security purposes, or to comply with law.

Meta (Facebook and Instagram) data

When an admin connects Meta Ads or Facebook & Instagram, Bamboo Insights receives the permissions shown on Meta's sign-in screen and reads only the ad accounts, Pages and Instagram professional accounts the admin chooses: ad performance (spend, impressions, clicks, results), Page and Instagram posts with their reach and engagement, and follower counts. Posts are published to a Page or Instagram account only after a person approves a draft in the app. Meta data is used only to show your reports and answer your questions, is never sold or used for advertising, and is not used to train AI models. Disconnecting removes the access token immediately; you can also remove Bamboo Insights in your Facebook settings under Business Integrations.

TikTok data

When an admin connects TikTok Ads, Bamboo Insights reads the advertiser accounts they choose and their campaign performance (spend, impressions, clicks, conversions); campaigns are created or changed only after a person approves them. When a TikTok business account is connected, its owner approves the permissions on TikTok's own screen; we read the account's profile and video statistics (followers, views, likes, comments, shares), publish posts only after a person on the team approves them, and read and answer comments when asked. TikTok data is used only to provide these features to that organization, is never sold or used for advertising, and is not used to train AI models. Disconnecting revokes the access token and deletes it; the account owner can also remove Bamboo Insights from their TikTok app settings at any time.

Google Drive

Google Drive is connected with the drive.file permission: Bamboo Insights can open only the files a person chooses in Google's file picker for a workspace, and the files it creates (saved reports, in a “Bamboo Insights” folder). It can't see or list anything else in Drive. Chosen files are read only to answer that workspace's requests.

WordPress sites

An admin can connect a client's WordPress site with an Application Password created in WordPress. It is stored encrypted and used only to read the site's posts, pages and WooCommerce reports, and to create or change content after a person approves it in the app. Revoking the Application Password in WordPress, or disconnecting the site, ends access immediately.

Deleting your data

To delete the data Bamboo Insights holds about you or your organization:

• Your account: sign in, open Account & privacy and choose Delete account. Your chats and personal data are deleted right away.
• Your organization: an admin can choose Delete organization under Account & privacy; every workspace, connection, report and file is deleted.
• A Meta or Google connection: open Integrations and choose Disconnect; the access token is removed and syncing stops. Synced data is deleted with the workspace or organization.
• Without signing in: email [email protected] from the address on the account; we confirm and complete the deletion within 30 days.

Shopify merchants

Merchants who install the Bamboo Insights Shopify app share orders, products, inventory, discounts, marketing events and store analytics, read-only. From orders we keep only store-level totals: sales, orders and units per day, revenue per product per month, and revenue per traffic source per month. We don't store customers' names, email addresses, phone numbers, addresses or individual order records. Access to customer records is optional and requested only if the merchant enables it. When the app is uninstalled, its access token and all data stored for the store are deleted immediately; Shopify's data-erasure requests (shop/redact, customers/redact) are honored automatically. Installations never linked to a workspace are deleted after 30 days.

Who we share it with

Only the providers that run the service for us (subprocessors), each under a data-processing agreement, plus authorities where the law requires it:

Shared dashboard links are created by your team; anyone with such a link can view that dashboard until it's revoked.

International transfers

Some providers process data outside the EU/EEA and Israel, mainly in the United States. These transfers rely on adequacy decisions (such as the EU-U.S. Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses.

Security

Data is encrypted in transit (TLS), credentials and tokens are encrypted at rest (AES-256-GCM), organizations are strictly isolated and access is role-based. Read the full Security overview.

How long we keep it

• Chat conversations, Library files and images: until a member of the workspace deletes them, or the workspace, organization or account is deleted.
• Other account and customer data: while your account is active. Deleting a workspace, organization or account removes its data from active systems right away.
• Security logs: up to 12 months.
• Payment records and invoices: as long as tax law requires (in Israel, generally 7 years).

Your rights

Depending on where you live (including under the GDPR, UK GDPR and Israel's Protection of Privacy Law), you can access, correct, delete or export your data, restrict or object to processing, and withdraw consent.

• Self-service: in the app, open your account menu → Account & privacy to download all your data or delete your account. Admins can delete their organization there too.
• Anything else: email [email protected]. We answer within 30 days.
• If your data is in a workspace managed by your employer or agency, we may refer your request to them, as they control that data.
• You can complain to your data-protection authority, for example the Israeli Privacy Protection Authority or your EU supervisory authority.

Cookies

We use only strictly necessary cookies: a sign-in session cookie and a cookie remembering which organization you opened. Your light/dark and sidebar preferences are kept in your browser's local storage. We don't use advertising or third-party tracking cookies, so there's no cookie banner to dismiss.

Children

The service is for businesses and isn't directed at children under 16. We don't knowingly collect their data.

Changes to this policy

We'll post updates here and change the date above. For significant changes we'll notify account admins by email or in the app before they take effect.

Contact

Bamboo Marketing Agency LTD, Israel. Privacy questions and requests: [email protected].