Privacy Policy

1. Who we are

DashOps is a software-as-a-service platform operated by Octatude LLC, a limited liability company organised under the laws of the State of Georgia, United States. Our business address is:

Octatude LLC
Clearview Ave
Atlanta, GA 30340
United States

For privacy-related questions, contact us at privacy@dashops.io.

In this policy, "we", "us", and "our" refer to Octatude LLC.

2. Information we collect

We collect the following categories of information:

• Account information: name, email address, phone number, password (stored only as a bcrypt hash), company name, role, and any optional profile details you add: profile photo, username, short bio, job title and department.
• Authentication data: a sign-in token saved in your browser, your two-factor (2FA) secret if you turn 2FA on (stored encrypted), your 2FA recovery codes (stored only as hashes), and a list of the devices and browsers you have signed in from, with their IP address, which we use to alert you to a new sign-in.
• Meta integration data: when you connect a Meta account, we receive an access token (encrypted at rest using AES-256-GCM), the id and name of the Facebook account that connected, and the list of ad accounts, pages, pixels and audiences that account has permission to access.
• Advertising data: campaign, ad set and ad details, creative assets, performance insights (impressions, clicks, conversions, spend), audience definitions, and lead form submissions. Most of this is retrieved from the Meta Marketing API on your behalf. Images and videos you upload for ads pass through our server to Meta, and we keep a record of each file (its name, who uploaded it and Meta's reference to it, and for an image its dimensions and a link to it). Customer lists you upload to build an audience also pass through our server: each value, such as an email address or phone number, is hashed with SHA-256 before it is sent to Meta, and we do not keep the list. Lead form submissions are read from Meta when you view or export them and are not stored in our database.
• Billing information: processed by Stripe, our payment processor. We store the Stripe customer ID and subscription status; we never store full payment card details. When a card is added, Stripe tells us whether it is a credit, debit or prepaid card. We use this only to decide whether the free trial applies and to stop a prepaid card being made the card that is charged during a free trial, and we record when a subscription was started with a prepaid card. For the reports described in section 10, we also keep a record of the company's first payment we reported (its Stripe subscription and invoice ids, the amount, the plan and the date), of the subscriptions our own staff started, and of when the company asked us to stop those reports.
• Usage information: the IP address and browser details of the devices you sign in from; sign-in attempts (email address, IP address and browser), kept for one hour to block password guessing; a record of actions taken in your account, with the IP address and browser they came from (our audit log); and, in the dashboard, a record of when you acknowledged our cookie notice, with your IP address and browser. When something goes wrong in the dashboard or on our servers, an error report is sent to our error-tracking provider, Sentry, tagged with your account id, company id, role and the page or address involved. The pages you view and the site you came from are recorded by the analytics tools described in section 10.
• Ad measurement identifiers: when the main admin of a company created on or after 22 October 2026 starts a free trial or a subscription, or restarts one, on the dashboard's card page, the Meta and Google Analytics identifiers that browser holds (the Meta browser cookie ids and the Google Analytics visitor id) and, for a payment made straight away, the Google Analytics session id, the browser user agent and the address of the card page. We keep them to report the company's free trial and first payment to Meta and Google (section 10), and never keep an IP address with them.
• Communications and forms: emails you send to us, including your replies to the emails we send you (for example your feedback during a free trial); what you enter in our contact form (name, email address, subject and message) and our sales enquiry form (name, email address, company, the number of ad accounts you need, your monthly ad spend and your message); and, if you subscribe to our product updates, your email address, your name if you give one, where on our site you subscribed, whether we have sent you our community invite and whether you have unsubscribed. If you joined our waitlist before sign-up opened, we keep the same details from that sign-up and a record of the emails we sent you about our launch and our community. If an agency admin schedules client reports, we also keep the recipient email addresses they enter.
• Sign-up and free trial emails: whether we have sent you the reminder to finish signing up, which of our free trial emails we have sent to your company and when, and whether you have asked us to stop them.
• Live chat: if you write to us in the chat on this site (dashops.io), what you type and any name or email address you choose to give. Our live chat provider, tawk.to, also records details about your visit (section 10).

3. How we use your information

• To provide, maintain, and improve the DashOps service.
• To authenticate you and protect your account.
• To reach you about your account. We ask for a phone number when you sign up so that we have a second way to contact you, for example when our emails do not reach you. When a company starts its free trial, or, if it started with a prepaid card, when its first payment goes through, our team gets an internal email with the details given at sign-up, including that phone number.
• To send emails about your account (email verification, team invitations, password resets and account activation) and the email digests you have switched on. If you sign up but do not finish (confirm your email address and add a card to start your free trial), we send you one reminder about a day after you sign up, with a link to finish, the date we delete an unfinished sign-up, and a link to stop these emails. During a free trial we may also email your company's main admin: a setup reminder, from two days after the trial starts, if the company has not yet connected Meta and chosen an ad account; a feedback request on the sixth day of the trial, if the company has finished setting up; and, if the trial is set to end without becoming a paid subscription, a message asking why and whether we can help. Each of these trial emails has a link to stop them, and stopping them does not stop the emails your account needs, such as password resets. We do not send billing receipts ourselves; any payment receipts come from Stripe, our payment processor. When you use our contact or sales enquiry form, we email you a confirmation. If you subscribe to our product updates, we send you a confirmation, then occasional emails about new features, product news and Meta Ads tips, and we may also send you an email inviting you to join our community on Discord, each with a link to unsubscribe. If you joined our waitlist before sign-up opened, have not unsubscribed and were never sent that invite, we may send it to you too, with the same link to unsubscribe. If an agency admin schedules client reports, we email those reports to the addresses the admin enters.
• To enforce our Terms of Service and detect abuse.
• To comply with legal obligations.
• To respond to your support requests.
• To ask customers and trial users for feedback, and to learn why a trial is not continuing, so we can improve DashOps.
• To measure which of our advertising brings people to DashOps, and to show our ads to people who have visited our sites, as section 10 describes.

Our legal reasons. Where the data protection law of the European Economic Area or the United Kingdom applies, we rely on these legal bases:

• Our contract with you or your company: creating and running your account, signing you in, syncing and showing your advertising data, contacting you about your account, the account emails, digests, setup reminder and sign-up reminder described above, billing through Stripe, and answering your sales and support messages.
• Our legitimate interests: keeping the service and your account secure (sign-in protection, the audit log and error reports), asking for feedback and why a trial is not continuing so we can improve DashOps, understanding how our sites are used and which of our ads bring people to DashOps, and showing our ads to people who have visited our sites (section 10). You can object to these at any time (section 6).
• Your consent: the product update emails you subscribe to. You can withdraw it at any time by unsubscribing; this does not affect what we did before.
• Legal obligations: keeping the records the law requires and answering lawful requests.

What you must give us. To create an account we need your name, email address and a password, and for a company account the company name. If you sign up a company yourself, we also need your phone number. To start a free trial or a subscription, the company's main admin enters a payment card in Stripe's own card fields. Without these we cannot provide the service. Everything else, such as your website and your profile details, is optional. Our forms need your email address so that we can reply.

Automated decisions. Some account actions happen automatically under our Terms, without a person deciding each time: for example, a company account is suspended if a payment is still unpaid 48 hours after it first fails, a new company that starts with a prepaid card pays straight away instead of getting the free trial, and repeated failed sign-ins cause a temporary lockout. Contact us if you want a person to look at one.

We do not sell your personal information for money. The advertising tools described in section 10 do let Meta and Google receive information about visits to our sites and about sign-ups, which some US state privacy laws treat as "sharing" or a "sale" for advertising. Our server also reports the free trials and first payments of companies created on or after 22 October 2026 to Meta and Google Analytics, as section 10 describes. We do not use your data or your clients' advertising data to train general AI models. DashOps does not include any AI features today. Future AI features (see our roadmap) will be opt-in and will use anonymised, aggregated patterns only.

4. How we share your information

We share information with our sub-processors, who help us run the service. The full list is at /sub-processors. Our service providers process personal data for us under their own data-processing terms where they offer them; the sub-processors page links to those terms. Google, Meta and Microsoft also use some of the data their analytics and advertising tools collect for their own purposes, under their own privacy policies (see section 10).

We also send information where you or your agency direct us to: to Meta when you create or change ads and audiences, to a Slack or Discord channel you connect for alerts, to the people an agency admin chooses to receive client reports, and to anyone who opens a share link you create.

We may also disclose information if required by law (court order, subpoena), to enforce our Terms of Service, or to protect the rights, property, or safety of Octatude LLC, our users, or others.

5. Data retention

We keep account information and operational data for as long as your subscription is active. When you cancel, your subscription runs until the end of your current billing period or free trial. Once it ends (or is ended because a payment could not be collected):

• 30-day soft-delete window: your data remains in our systems but is inaccessible to your account. You can restart during this window by adding a card on the Billing page (the first payment is taken straight away) and resume where you left off.
• After 30 days: your company account is permanently deleted from our live database, including your team members' accounts, your Meta and Google Ads connections and their access tokens, our copies of your synced campaigns, ad sets, ads and creatives, our records of the images and videos you uploaded, daily performance data, age, gender and placement breakdowns, our copies of your saved and custom audience definitions, campaign notes, chart notes, scheduled client reports and their recipient email addresses, share links, and notifications and notification settings. Nothing in your Meta or Google Ads accounts is changed or deleted: the campaigns, ads, audiences and files there stay. We never store the details people submit through your lead forms (they are read from Meta when you view or export them), so there are none to delete. Our own nightly backups are deleted automatically after 30 days, so copies in them are gone about 30 days later; our database provider's automatic daily snapshots are removed on the provider's own schedule.
• Audit log entries are kept when the automatic deletion described here runs, so the record of what happened stays intact. We remove the account id, email address, role, IP address and browser recorded for the person who took each action. Each entry keeps the action, its date, the name of what it changed (which can be a campaign or audience name or a person's email address, including your own) and the details recorded about the change. We do not currently delete audit entries after a set period.
• Messages sent through our contact and sales enquiry forms, product update sign-ups (including waitlist sign-ups from before launch), and emails you send us are kept separately from your account and are not removed by the automatic deletion. We do not currently delete them after a set period. If you unsubscribe from product updates, we keep your email address marked as unsubscribed so that we do not email you again. Email us to ask for any of them to be removed.
• Live chat conversations are kept in our live chat provider's system, separately from your account, and are not removed by the automatic deletion. We do not currently delete them after a set period. Email us to ask for a conversation to be removed.

You can request deletion of your account from your Privacy Settings. The deletion is carried out 30 days after your request, and you can cancel it during that time. If you are the company's main admin, the request deletes the whole company account, and it cannot be made while a payment is overdue or while the company's paid subscription or free trial has not ended. Deleting your account does not cancel a subscription, so the main admin cancels it on the Billing page first and makes the request once it has ended. If you are the main admin and the company's subscription has not ended when the 30 days are up, the deletion waits until it has ended. If you ask us by email instead, our team carries out the deletion by hand, and what it removes can differ from the list above.

Unfinished sign-ups. If you sign up but your free trial has not started within 7 days of signing up (because your email address was not confirmed or no card was added), we delete the account, the company and the details you gave when you signed up after those 7 days, in the same way as the permanent deletion described above. If our payment processor has a subscription for it, we wait until it has ended. If you opened the page where you add a card, our payment processor, Stripe, keeps its own record of your company name and email address, and of any card you entered; this deletion does not remove that record from Stripe, so email us if you want it removed. About a day after you sign up, we send you one reminder that gives the date. Unfinished sign-ups made before we started deleting them automatically are kept until you ask us to delete them.

6. Your rights

Depending on where you live, you may have the right to:

• Access: request a copy of the personal information we hold about you.
• Rectify: correct inaccurate information. You can change your name and other profile details yourself on your profile page. Your email address cannot be changed there, so contact us to change it.
• Delete: request deletion of your account and personal data.
• Port: receive your data in a machine-readable format (JSON export available in-app).
• Object: object to our use of your information where we rely on our legitimate interests (section 3), and stop product update and free trial emails at any time.
• Restrict: ask us to limit how we use your information while a request or complaint about it is being dealt with.
• Withdraw consent: revoke any consent you have given.

To exercise any of these rights, email us at privacy@dashops.io. We respond within 30 days.

You can object at any time to emails that promote DashOps, including product updates and our free trial emails. Use the link in the email, or write to privacy@dashops.io, and we will stop.

California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, to ask us to delete or correct it, and to opt out of any sale or sharing of it for targeted advertising. To stop the advertising tools described in section 10 in your browser, use the controls in that section; for anything else, email us.

EU / UK residents have rights under the GDPR / UK GDPR. If you are unhappy with how we handle your information, please contact us first. You also have the right to complain to a data protection supervisory authority, in particular where you normally live or work or where you think the law was broken. In the United Kingdom this is the Information Commissioner's Office (ICO).

If an agency uses DashOps to handle your information (for example you receive its client reports, you are in a customer list it sent to Meta through DashOps, or you filled in one of its lead forms), the agency decides how that information is used. Please contact the agency first; we will help it answer your request.

7. Security

We protect your data with industry-standard measures:

• HTTPS (TLS 1.2 or 1.3) encryption in transit; AES-256-GCM encryption at rest for Meta access tokens and 2FA secrets.
• Passwords must be at least 8 characters long and are stored only as bcrypt hashes. When you create a company account, activate an account, or change or reset your password, the password must also include an uppercase letter, a lowercase letter, a number and a symbol, and must not be on our list of very common passwords.
• Sign-in sessions last up to 7 days. Changing your password signs out your other sessions. Resetting your password signs out every session, and turning off 2FA does too, including the one you are using. A deactivated account is signed out everywhere.
• Brute-force lockout, optional 2FA with recovery codes.
• An audit log of account, team, billing, connection and campaign changes, recording who made each one.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at support@dashops.io.

8. International data transfers

Octatude LLC is a United States company. We and the companies that run our service store and process data in more than one country, so your information is processed in the United States and in other countries where our service providers operate. Where the data protection law of the European Economic Area, the United Kingdom or Switzerland requires a safeguard for sending your information to another country, we rely on the safeguards in the data-processing terms our service providers offer, such as the European Commission's Standard Contractual Clauses. You can ask us about them at privacy@dashops.io.

9. Children's privacy

DashOps is a B2B service intended for adult users. We do not knowingly collect information from anyone under 16. If we learn we have collected such information, we delete it.

10. Cookies, analytics and advertising

We do use analytics and advertising tools, and they set cookies in your browser. This section says which ones, what they record, and what leaves this site.

Sign-in and settings storage. We do not set cookies of our own. To keep you signed in, the dashboard saves a sign-in token in your browser's local storage, and both sites use local storage to remember choices such as dismissing this notice. The dashboard cannot work without it. The dashboard also loads the payment script of Stripe, our payment processor, on every page, and Stripe can set its own cookies through it.

Analytics and advertising. This site (dashops.io) and the dashboard (app.dashops.io, and an agency's own web address for the dashboard) both load Google Tag Manager. On both, it loads Google Analytics 4, which also records the click id Google adds to the address when you arrive from one of our Google ads. On this site and on app.dashops.io, but not on an agency's own web address for the dashboard, it also loads the Google Ads tag. On this site, it also loads the Meta (Facebook) pixel. On this site only, it also loads Microsoft Clarity, which records how visitors move, click and scroll on our pages (session recordings and heatmaps). Google, Meta and Microsoft set their own cookies and record the pages you visit, roughly where you are based on your IP address, and what device and browser you use. These load when the page loads. In the dashboard, the Meta pixel loads only at the moment you start a free trial, to report that event to Meta, and the same event is sent to Google Analytics, which passes it on to Google Ads, so we can see which of our ads bring in new trials. With that event the dashboard passes on at most the plan and billing period you chose, the number of ad accounts on the plan, what the plan will cost when the trial ends and a random id for the event, and never your name or email address. As on this site, Meta and Google also receive your IP address, your browser details, the page address and their own browser cookie ids. Our server's own report of the same trial to Meta, described under "Free trials and first payments" below, also carries the email address of the company's main admin, hashed. Once loaded, the pixel stays in that browser tab until you close the tab or reload the page. The dashboard's font is served from the same web address as the dashboard, not from Google Fonts. Images uploaded to our blog load from Cloudflare, which receives your IP address and browser details.

Google Ads and remarketing. We advertise DashOps online with Google Ads. The Google Ads tag on this site and on app.dashops.io sets a Google Ads cookie (_gcl_au) in your browser and reports your visit to Google, which also uses its own advertising cookies. We use this to measure which of our ads bring people to DashOps and to build remarketing lists of people who have visited this site or app.dashops.io. Third-party vendors, including Google, show our ads on sites across the internet, and use cookies to show you our ads based on your past visits to this site or app.dashops.io.

Google Analytics advertising features. Our Google Analytics account is linked to our Google Ads account, with personalized advertising turned on, so lists of visitors that Google Analytics builds can be shared with our Google Ads account and used to show our ads to people who have visited. Google calls this remarketing with Google Analytics, one of its Google Analytics advertising features. Google Analytics runs on every address described above, including an agency's own web address for the dashboard, so these lists can include people who used the dashboard there. We and third-party vendors, including Google, use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as Google advertising cookies) together to build these lists, to measure our ads and to show you our ads based on your past visits. To opt out of these Google Analytics advertising features, use Google's Ads Settings, or install the Google Analytics opt-out browser add-on.

Live chat. This site (dashops.io), and not the dashboard, loads the tawk.to live chat widget once the page has finished loading. tawk.to sets its own cookies (a random visitor id so it can recognise a returning visitor, and cookies that keep the chat in step across your open tabs) and receives your IP address, your browser details, roughly where you are, the page you are on and the site you came from. If you write to us in the chat, tawk.to also receives what you type and any name or email address you choose to give, and our team reads it there to answer you. tawk.to handles this for us; its privacy policy and data processing addendum are linked on the sub-processors page.

What we send from our own server. When you subscribe to our product updates, or submit the contact form or the sales enquiry form on this site, we also send that event directly from our server to Meta and to Google Analytics. Meta receives your email address hashed with SHA-256, your IP address, your browser user agent, the page address, and Meta's own browser identifiers if your browser has them. Google Analytics receives only its own visitor id from your browser, the name of the event, the page address and which form it was; if your browser has no Google Analytics cookie, nothing is sent to Google. When you submit the sales enquiry form on the dashboard's sign-up page, our server sends that event to Meta only, with the same details except Meta's browser identifiers. Hashing means we do not hand over your address as readable text, but it is not anonymous: it is designed so Meta can match it against an account it already holds. We do this to understand which marketing brings people to DashOps.

Free trials and first payments. For companies created on or after 22 October 2026, our server also reports the company's free trial and its first payment. When such a company starts a free trial on the dashboard's card page, our server reports it to Meta, with what the plan will cost when the trial ends and its currency, and with the same random id as the dashboard's own event, so that Meta counts it once. When the company makes its first payment for a subscription (when its free trial ends and the first payment goes through, when a prepaid card pays straight away, or when a subscription is restarted), our server reports that payment to Meta and to Google Analytics, which can pass it on to Google Ads, with the amount paid and its currency. Meta receives with these reports the email address of the company's main admin hashed with SHA-256, the company's account id with us hashed with SHA-256, and Meta's own browser cookie ids from the browser used on the card page, if it had them. With a free trial report Meta also receives your IP address, your browser user agent and the address of the card page, and with a first payment made on that page, your browser user agent and the address of the page. Google Analytics receives only its own visitor id from that browser, the amount, the currency, the plan and an id made from our payment record, and for a payment made on the card page also its session id and the address of the page; it never receives a name or an email address, and if that browser had no Google Analytics cookie, nothing is sent to Google. We send these reports to measure which of our ads bring in trials and paying customers, and Meta and Google may also use them to decide who is shown our ads. To send them, when the main admin starts a free trial or a subscription, or restarts one, on the card page, we keep the identifiers described in section 2 with the company's record. We delete them once the company's first payment has been reported, when the company asks us to stop these reports, when they are 60 days old, or with the company account, whichever comes first. We do not send these reports for free trials or payments started by our own staff, for companies whose plan our team manages, for a company that asked us to stop them, or for a payment of nothing, for example when a discount code covers it.

Who receives this. Google, Meta and Microsoft, as described above, Stripe through the payment script in the dashboard, Cloudflare for images uploaded to our blog, and tawk.to for the live chat on this site. Our full list of the companies that process data for us, and what each one is used for, is on the sub-processors page.

How to stop it. Your browser's cookie and tracking settings, or a content blocker, will stop these tools from loading in your browser, straight away. They do not stop the event our server sends when you submit one of the forms above: Meta still receives it, and Google receives it only from the forms on this site and only if your browser has a Google Analytics cookie. They also do not stop the reports our server sends when a company starts a free trial or makes its first payment. To stop those reports for your company, email us at privacy@dashops.io and we will switch them off. We also switch them off for a company when the browser used to add its card sends a Global Privacy Control signal. Google publishes a browser add-on that opts you out of Google Analytics, and Meta lets you limit ad tracking inside your Facebook and Instagram settings. To opt out of Google's use of cookies to show you ads, visit Google's Ads Settings. You can also ask us to delete the data we hold about you at any time using the contact details on this page.

11. Changes to this policy

We may update this policy from time to time. When we make a material change, we will email the main admin of each company account before the change takes effect, wherever we reasonably can. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact us

For privacy questions, data subject requests, or any other concerns:

• Email: privacy@dashops.io
• Postal: Octatude LLC, Clearview Ave, Atlanta, GA 30340, United States