1. Introduction
Zantraka, a subsidiary of Kotwaster LLC ("Zantraka," "we," "us," or "our"), operates the website at https://zantraka.com and the Zantraka AI marketing platform (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Information You Provide Directly
- Account Information: Name, email address, password (stored as a bcrypt hash), company name, job title, and phone number when you register.
- Business Information: Website URL, industry, business descriptions, marketing goals, and brand assets you submit for AI analysis.
- Payment Information: Billing details processed securely through Stripe. We do not store credit card numbers on our servers.
- Communications: Messages sent through our contact form, support requests, and any other communications with us.
- User Content: Marketing strategies, ad creatives, campaign configurations, and other content you create using the Service.
2.2 Information Collected Automatically
- Usage Data: Pages visited, features used, actions taken, timestamps, and session duration.
- Device Information: Browser type, operating system, device type, screen resolution, and language preferences.
- Log Data: IP addresses, access times, referring URLs, and error logs.
- Cookies & Tracking: See our Cookie Policy for detailed information.
2.3 Information from Third Parties
- Advertising Platforms: When you connect Google Ads, Meta (Facebook & Instagram), TikTok, or LinkedIn accounts, we receive campaign performance data, account metadata, and advertising metrics through their respective APIs. See Section 5 for a detailed, provider-by-provider breakdown of exactly what we access and how each platform's data requirements apply.
- OAuth Providers: When you authorize third-party integrations, we receive profile information and scoped access/refresh tokens strictly as permitted by the specific permissions (scopes) you grant during authorization. We never receive or store your username or password for any connected platform.
- Payment Processor: Stripe provides us with transaction status, subscription details, and billing history.
3. How We Use Your Information
We use the information we collect for the following purposes:
- Service Delivery: To provide, maintain, and improve the Zantraka platform, including AI-powered marketing analysis, strategy generation, creative production, and campaign management.
- Account Management: To create and manage your account, process payments, and provide customer support.
- AI Processing: To analyze your business information using AI models to generate marketing strategies, audience personas, ad copy, and campaign recommendations tailored to your industry.
- Communication: To send service-related notifications, security alerts, two-factor authentication codes, and respond to your inquiries.
- Analytics & Improvement: To understand how users interact with the Service, identify trends, and improve functionality and user experience.
- Security: To detect, prevent, and address fraud, unauthorized access, and other illegal activities.
- Legal Compliance: To comply with applicable laws, regulations, and legal processes.
4. How We Share Your Information
We do not sell your personal information. We may share your information in the following circumstances:
- Service Providers: With trusted third-party vendors who assist in operating the Service (hosting, payment processing, email delivery, AI processing). These providers are contractually obligated to protect your data.
- Advertising Platforms: When you authorize campaign management through Google Ads, Meta, TikTok, or LinkedIn, we transmit campaign data to these platforms as directed by you.
- AI Providers: Business information you submit may be processed by our AI service providers to generate marketing insights. We do not share personally identifiable information with AI providers.
- Legal Requirements: When required by law, court order, or governmental regulation, or to protect our rights, property, or safety.
- Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets.
- With Your Consent: When you explicitly authorize us to share your information.
5. Advertising Platform Integrations — Provider Data & Security Compliance
Zantraka connects to major advertising platforms exclusively through their official, sanctioned APIs and OAuth 2.0 authorization frameworks. For each platform below we state (a) the core data-handling and security obligations imposed by that platform's developer and API terms, and (b) the specific technical and organizational measures Zantraka has implemented to meet or exceed those obligations. The following baseline applies across every platform and already meets or exceeds each provider's minimum requirements:
- No credentials, ever: We authenticate strictly via OAuth 2.0. We never see, request, receive, or store your platform username or password.
- Encryption at rest: All OAuth refresh and access tokens are encrypted with AES-256-GCM before they are written to our database and are decrypted only in memory at the moment of an authorized API call. Tokens are never persisted in plaintext.
- Least-privilege scopes: We request only the minimum OAuth scopes required to operate the features you explicitly enable — nothing more.
- Use limited to your instruction: Platform data is used solely to deliver the Zantraka features you activate (reporting, insights, optimization, and campaign management). We do not sell it, do not use it to advertise to you, and do not transfer it to data brokers or any third party for their own purposes.
- User-controlled revocation: Disconnecting a platform in your dashboard immediately invalidates and deletes the associated tokens from our systems. You may also revoke access at any time directly from the platform's own security settings.
- CSRF-protected authorization: Every OAuth flow is protected by a cryptographically random, single-use
state parameter that is generated and validated server-side on callback. - Server-side isolation: Tokens and platform API calls execute exclusively server-side and are never exposed to the browser or any client-side code.
5.1 Google Ads — Google API Services User Data Policy (Limited Use)
Provider requirements: Applications accessing Google user data must comply with the Google API Services User Data Policy, including the Limited Use requirements; request only necessary scopes; provide transparent disclosure of data use; secure and restrict access to tokens; and honor user revocation and deletion.
Zantraka's measures to meet or exceed them:
- Zantraka's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We request only the single
https://www.googleapis.com/auth/adwords scope — the minimum required to read performance data and manage the campaigns you choose to manage through Zantraka. - Google Ads access tokens are never stored. They are fetched on demand from the encrypted refresh token, held in memory only for the duration of a single API call, and then discarded.
- The refresh token is encrypted at rest with AES-256-GCM and used exclusively server-side; it is never transmitted to the browser.
- Google data is used only to power user-facing features (campaign reporting, insights, and optimization) — it is never used to serve ads, never sold, and never shared with third parties for their own purposes.
- Disconnecting removes the refresh token from our database, and you may additionally revoke Zantraka's access at myaccount.google.com/permissions.
5.2 Meta — Facebook & Instagram Ads (Meta Platform Terms & Developer Policies)
Provider requirements: Developers must comply with the Meta Platform Terms and Developer Policies: use Platform Data only to provide the user's requested experience, keep it confidential and secure, request the minimum permissions, not sell or license Platform Data, delete data upon user request or disconnection, and maintain appropriate administrative, physical, and technical safeguards.
Zantraka's measures to meet or exceed them:
- We access Meta data only through the official Marketing API using OAuth-issued access tokens, and only to display advertising performance and manage the campaigns you authorize.
- Meta access tokens are encrypted at rest with AES-256-GCM and stored server-side only; token expiry is tracked so that stale tokens are refreshed or re-authorized rather than reused unsafely.
- We request the minimum ads-management and read permissions necessary for the features you enable and do not request unrelated profile or social-graph permissions.
- We do not sell, license, or transfer Meta Platform Data, and we do not use it for any purpose other than delivering your requested Zantraka features.
- On disconnection or a data-deletion request, associated Meta tokens and cached data are deleted. Users may also remove Zantraka from their Meta account's Business Integrations settings. See our Data Deletion page for the Meta-compliant deletion callback and request process.
5.3 TikTok Ads — TikTok Marketing / Business API & Developer Terms
Provider requirements: Applications using the TikTok Marketing/Business API must comply with the TikTok for Business / Developer Terms and Data Use policies: access data only via authorized OAuth scopes, use advertiser data solely to provide the requested service, protect data with reasonable security measures, honor deletion and revocation, and refrain from selling or misusing advertiser data.
Zantraka's measures to meet or exceed them:
- We connect only through TikTok's official Marketing/Business API using OAuth-authorized scopes limited to advertising reporting and management for the ad accounts you link.
- TikTok OAuth tokens are encrypted at rest with AES-256-GCM, used server-side only, and refreshed through the sanctioned token-refresh flow.
- Advertiser data is used exclusively to deliver Zantraka reporting and campaign features you activate; it is never sold, rented, or repurposed for advertising to you.
- Disconnecting a TikTok account immediately invalidates and deletes its stored tokens and cached data from Zantraka, and access can also be revoked from your TikTok account's connected-apps settings.
5.4 LinkedIn Ads — LinkedIn Marketing Developer Platform / API Terms
Provider requirements: Members of the LinkedIn Marketing Developer Platform must comply with the LinkedIn API Terms of Use: access only the data authorized by granted OAuth scopes, use it solely to provide the member's requested functionality, store tokens securely, not sell or transfer LinkedIn data, honor revocation, and delete data when access ends.
Zantraka's measures to meet or exceed them:
- We integrate only via the official LinkedIn Marketing Developer Platform using OAuth 2.0 with the minimum advertising-related scopes needed for reporting and campaign management on the ad accounts you connect.
- LinkedIn access and refresh tokens are encrypted at rest with AES-256-GCM and handled exclusively server-side.
- LinkedIn data is used only to provide the analytics and management features you enable; it is never sold or transferred to third parties for their own purposes.
- On disconnection or account deletion, LinkedIn tokens and cached data are removed, and you may also revoke Zantraka from your LinkedIn account's permitted-services settings.
5.5 Cross-Platform Token Security & Data Minimization
Regardless of platform, Zantraka applies defense-in-depth safeguards that meet or exceed each provider's security expectations:
- Encryption in transit and at rest: HTTPS/TLS for all data in transit; AES-256-GCM for all stored OAuth tokens and provider API keys.
- Data minimization: We cache only the aggregated performance metrics needed to render your dashboards; performance data is refreshed per session rather than permanently warehoused.
- Access control: Role-Based Access Control (RBAC) restricts connection and campaign actions to authorized organization members; every mutation endpoint enforces authorization server-side.
- No plaintext exposure: Tokens are never logged, never returned to the client, and never embedded in URLs.
- Prompt revocation & deletion: Disconnection and account-deletion flows purge the corresponding tokens and cached provider data from our systems.
6. Data Retention
We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:
- Account Data: Retained while your account is active and for 30 days after deletion request to allow for recovery.
- Marketing Content: Strategies, creatives, and campaign data are retained while your account is active.
- Payment Records: Transaction records are retained for 7 years for tax and legal compliance.
- Log Data: Server logs are retained for up to 90 days.
- Advertising Platform Data: Cached performance data is refreshed on each session and not permanently stored.
7. Your Rights & Data Deletion
Depending on your jurisdiction, you may have the following rights regarding your personal information:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data. See our Data Deletion Instructions for the complete process.
- Portability: Request a machine-readable copy of your data.
- Restriction: Request restriction of processing in certain circumstances.
- Objection: Object to processing based on legitimate interests.
- Withdrawal of Consent: Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please contact us at support@zantraka.com or visit our Data Deletion page. We will respond to your request within 30 days.
8. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to know what personal information is collected, used, shared, or sold.
- Right to delete personal information held by businesses.
- Right to opt-out of the sale of personal information. Note: We do not sell personal information.
- Right to non-discrimination for exercising your CCPA rights.
9. European Privacy Rights (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your data under the following legal bases:
- Contract Performance: Processing necessary to provide the Service you requested.
- Legitimate Interest: Processing for analytics, security, and service improvement.
- Consent: Processing based on your explicit consent (e.g., marketing communications).
- Legal Obligation: Processing required to comply with applicable law.
You may lodge a complaint with your local data protection authority if you believe your rights have been violated.
10. Data Security
We implement industry-standard security measures — several of which exceed the minimum requirements of the advertising platforms we integrate with — to protect your information:
- HTTPS/TLS encryption for all data in transit
- AES-256-GCM encryption at rest for all connected-platform OAuth tokens (Google Ads, Meta, TikTok, LinkedIn) and stored provider API keys
- On-demand access tokens: where supported (e.g., Google Ads), access tokens are never stored — they are derived from an encrypted refresh token, held only in memory for a single API call, and discarded
- Least-privilege OAuth scopes: we request only the minimum permissions each feature requires
- CSRF-protected OAuth flows using cryptographically random, single-use, server-validated
state parameters - Bcrypt password hashing with per-user salt
- JWT authentication with algorithm pinning (HS256)
- Role-Based Access Control (RBAC) enforced server-side on all mutation endpoints
- Email-based Two-Factor Authentication (2FA)
- Platform API keys stored as SHA-256 hashes or AES-256-GCM ciphertext
- Tokens are never logged, never returned to the client, and never placed in URLs
- Regular security audits and vulnerability assessments
While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
11. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete it promptly.
12. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses where required.
13. Third-Party Links
The Service may contain links to third-party websites. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Service. Your continued use after changes constitutes acceptance of the revised policy.
15. Contact Us
For privacy-related inquiries, data access requests, or to exercise your rights: