1. Who we are

This Privacy Policy explains how «EVAtech Ukraine» Limited Liability Company, 04073, Ukraine, Kyiv, Stepana Bandery Avenue, 21 ("Impact Waves", "we", "us") collects, uses and protects personal information when you use the website impactwaves.agency and the Impact Waves advertising management tools (the "Services").

We are the data controller for the personal information described here. This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the California Online Privacy Protection Act (CalOPPA) and the California Consumer Privacy Act (CCPA).

2. Information we collect

Information you give us:

• Name and username
• Email address
• Password, if you create a login for our tools

Information from Facebook Login and the Meta Marketing API:

When you connect your Facebook account, and only with your permission, we receive:

• your Facebook user ID, name and profile picture;
• the list of ad accounts, business portfolios and Pages you have access to;
• campaign, ad set, ad and creative data, and advertising performance reports for those accounts;
• an access token that lets our tools act on the accounts you authorized.

We do not collect payment card details, mailing addresses, phone numbers, location, contacts, camera or photo gallery data.

3. How we use your information

We use your information only to:

• let you sign in and keep your account secure;
• create, launch, manage and optimize advertising campaigns on the ad accounts you authorized;
• show you performance reports for those campaigns;
• respond to your requests and provide support;
• comply with legal obligations.

Under GDPR, our legal bases are performance of a contract with you, your consent (given when you connect Facebook Login), our legitimate interest in operating and securing the Services, and compliance with law.

We do not use Meta data for any purpose other than providing the Services to you. We do not send newsletters or marketing emails.

4. Sharing, cookies and sessions

We do not sell, rent or trade your personal information. We share it only:

• with Meta Platforms, Inc., when our tools send your campaign instructions to the ad accounts you authorized;
• with hosting and infrastructure providers that store data on our behalf under confidentiality obligations;
• when required by law or to protect our rights.

Our website and tools do not show ads, do not use the Facebook pixel and do not use retargeting. We use cookies and sessions only to keep you signed in and to make the Services work. You can block cookies in your browser, but some features may then stop working.

We honor Do Not Track signals to the extent our Services track you at all, as required by CalOPPA.

5. Retention and security

We keep your information only while your account is active or as needed to provide the Services. Meta access tokens are deleted when you disconnect your Facebook account or when they expire. Advertising data is deleted within 30 days after you close your account or ask us to delete it, unless the law requires us to keep it longer.

We protect your information with encryption in transit, restricted access for authorized team members only, and secure storage of access tokens. No system is completely secure, but we take reasonable steps to prevent unauthorized access.

6. Your rights

GDPR (EU/EEA users):

You have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent at any time. You may also complain to your local data protection authority.

CCPA (California residents):

You have the right to know what personal information we collect and why, to request its deletion, and to not be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioral advertising.

CalOPPA:

You can review and request changes to your information by contacting us. We will tell you about changes to this policy by updating the effective date below.

To use any of these rights, email us at support@impactwaves.agency. We respond within 30 days.

7. Data deletion instructions

You can delete your data in either of these ways:

1. Remove our app from Facebook: go to Facebook Settings → Business Integrations (or Apps and Websites), find our app and click Remove. This stops our access to your Meta data immediately.
2. Ask us to delete everything: email support@impactwaves.agency with the subject "Data deletion request" from the email linked to your account. We will delete your account, access tokens and stored advertising data within 30 days and confirm by email.

8. Children, changes and contact

The Services are for businesses and are not offered to children under 13. We do not knowingly collect information from children.

We may update this policy. The effective date below shows the latest version; significant changes will be posted on this page.