Privacy Policy

1. Who we are

Ayklo is operated by Ayklo Limited (“Ayklo”, “we”, “us”, “our”). Ayklo is a reporting assistant for advertisers: a business connects its Google Ads, Google Analytics and Meta Ads accounts, and its team asks questions about advertising performance in a chat interface. Ayklo reads data from those accounts to answer the questions. It never creates, edits, pauses or deletes campaigns, ads, budgets or any other setting in a connected account.

Ayklo Limited is the data controller for the personal data described in this policy. Where we process advertising and analytics data that belongs to a customer organisation in order to answer that organisation's questions, we act on the organisation's instructions as its data processor.

2. What this policy covers

This policy applies to:

• this website, ayklo.com;
• the Ayklo web application and the accounts our customers use to access it;
• the connections you authorise between Ayklo and your Google and Meta accounts.

Ayklo has no self-service sign-up. Accounts are created by Ayklo for a customer organisation under a service agreement, and the organisation decides which of its people may use them and which advertising accounts they may connect.

3. Information we collect

3.1 Account information

When your organisation is onboarded we store a username, a display name, the name of the organisation and the status of its subscription. Passwords are stored only as a salted hash (Argon2id); we cannot read them.

3.2 Platform connection data

When you connect a Google or Meta account you authorise Ayklo through the platform's own OAuth consent screen. We then receive and store:

• an OAuth access token and refresh token issued by the platform;
• the ID and display name of the advertising or analytics account(s) you chose to connect;
• the date and time of the connection.

Tokens are used exclusively to call the platform's API on your behalf and are never shown to anyone, written to logs, or shared with third parties.

3.3 Advertising and analytics data

When you ask a question, Ayklo retrieves the data needed to answer it from the relevant platform API: the Google Ads API, the Google Analytics Data API and the Meta Marketing API. This includes account, campaign, ad group, ad, keyword, audience and conversion structure, and performance metrics such as impressions, clicks, cost, conversions, revenue, return on ad spend, sessions and users. Data is retrieved on demand for the question being asked. To keep answers fast, Ayklo also keeps a short, automatically generated summary of each connected account (for example, the account's currency, its active campaigns and recent totals) in a temporary cache that expires and is rebuilt automatically.

3.4 Chat data

We store the questions you type, the answers Ayklo generates, and conversation titles, so that you can return to earlier conversations.

3.5 Usage and security data

We keep daily usage counts per account, a record of security-relevant events (for example failed logins, rate-limit hits and blocked requests), and technical logs that contain timestamps, request identifiers and durations. Your IP address is processed for login protection and rate limiting. Our logs are designed not to contain tokens, passwords, the text of your questions or the content of your advertising data.

3.6 Website visitors

This website does not use analytics, advertising or tracking cookies, and does not set any cookies of its own. Fonts are loaded from Google Fonts, which means Google receives your browser's request (including your IP address) when the page loads. If you contact us by email we keep the correspondence for as long as needed to respond.

4. How we use information

We use the information described above to:

• authenticate you and keep your account secure;
• retrieve data from your connected accounts and answer the questions you ask;
• generate and refresh the temporary account summary that speeds up answers;
• show you your conversation history;
• apply usage limits that are part of your organisation's subscription;
• detect, investigate and prevent abuse, fraud and security incidents;
• provide support and communicate about the service;
• comply with legal obligations.

5. Google user data

Ayklo uses Google OAuth to access the Google Ads API and the Google Analytics Data API. We request only the read scopes needed to report on the accounts you connect and we do not request write access.

Ayklo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data obtained through Google APIs:

• we only use it to provide and improve the user-facing features of Ayklo that are visible to you — answering your questions and building the account summary that supports those answers;
• we do not transfer it to others except as necessary to provide those features (see section 8), to comply with applicable law, or as part of a merger or acquisition with prior notice to you;
• we do not use or transfer it to serve advertisements, including retargeting, personalised or interest-based advertising;
• we do not allow humans to read it, except with your explicit consent for a specific piece of data, where necessary for security purposes such as investigating abuse, to comply with applicable law, or for internal operations on data that has been aggregated and anonymised;
• we do not use it to develop, improve or train generalised AI or machine-learning models.

You can review or revoke Ayklo's access at any time from your Google Account permissions page. Revoking access there invalidates the tokens we hold.

6. Meta platform data

Ayklo uses Facebook Login for Business and the Meta Marketing API to read reporting data from the ad accounts you connect. We request only the read-only ads_read permission and never request permissions that allow managing ads, pages or business assets.

We handle data received from Meta in accordance with the Meta Platform Terms and Developer Policies. We use it solely to answer your questions about your own advertising performance, we do not sell it, license it or share it with third parties other than the service providers listed in section 8, and we do not use it for purposes unrelated to the Ayklo service.

You can remove Ayklo from your Meta account at any time under Settings & privacy → Settings → Business integrations (for a personal profile) or from the Integrations section of Meta Business Settings. Removing the integration invalidates our access token. To have the data we hold deleted as well, follow the steps in section 11.

7. AI processing

Ayklo generates its answers with large language models. When you ask a question, the question, the relevant part of your conversation, and the data retrieved from your connected accounts to answer it are sent to the model provider through OpenRouter, an API gateway that routes requests to model providers. We send only what is needed to answer the specific question, and our OAuth tokens are never included in what is sent to a model.

Model providers process this data solely to generate the response, under their data processing terms. We do not permit our data to be used to train their models, and we select providers and settings accordingly. We do not use your data to train any model of our own.

8. Sharing and sub-processors

We share information only with the parties below and only to the extent needed:

We do not share data between customers. Every record in Ayklo belongs to a single customer organisation, and every query is restricted to that organisation.

9. Security

We apply technical and organisational measures appropriate to the sensitivity of the data:

• all traffic between your browser, Ayklo and the platform APIs is encrypted with TLS;
• platform refresh tokens are encrypted at rest with AES-256-GCM using keys that are kept separately from the database;
• passwords are hashed with Argon2id and are never stored or logged in plain text;
• access to a connected account uses short-lived, per-request credentials that are not persisted outside the request that uses them;
• user sessions rely on short-lived, rotating tokens that can be revoked instantly;
• tenant isolation is enforced at the data layer: every query is scoped to the organisation that owns the data;
• login attempts and API usage are rate-limited, and security events are recorded and monitored;
• we request the minimum OAuth scopes required, and none that allow writing to your accounts;
• administrative access is limited to authorised Ayklo staff with separate credentials.

No system is perfectly secure. If we become aware of a breach affecting your data we will notify you and, where required, the relevant authorities without undue delay.

10. Data retention

11. Disconnecting and deleting your data

You are always in control of what Ayklo can access:

• Disconnect a platform in Ayklo. Open the Platform connections screen in Ayklo and choose Disconnect. We delete the stored tokens and the cached account summary immediately.
• Revoke access at the platform. Use your Google Account permissions or Meta's Business integrations settings. This invalidates our tokens even if you cannot sign in to Ayklo.
• Delete conversations. Any conversation can be deleted from within Ayklo.
• Request full deletion. Email privacy@ayklo.com from the address associated with your organisation and ask us to delete your data. We will delete all data associated with the account — including tokens, cached summaries, conversations and account information — within 30 days and confirm in writing. Only data we are legally required to keep, such as accounting records, is retained.

12. Your rights

Depending on where you are, you may have rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, the Turkish Personal Data Protection Law (KVKK) or other applicable law. These typically include the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal;
• lodge a complaint with your data protection authority.

To exercise any of these rights, contact us using the details in section 16. If your organisation is the controller of the data in question, we may refer your request to it and assist it in responding.

Our legal bases for processing are the performance of our agreement with your organisation, our legitimate interests in securing and operating the service, your consent where you authorise a platform connection, and compliance with legal obligations.

13. International transfers

Your data may be processed in countries other than your own, including by the service providers named in section 8. Where data is transferred out of the EEA, the United Kingdom or Turkey, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision, and we require our providers to protect the data to the standard described in this policy.

14. Children

Ayklo is a business service and is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. The effective date at the top of the page shows when it was last changed. If a change materially affects how we handle data from your connected accounts, we will notify your organisation before it takes effect. Continued use of Ayklo after that date means the updated policy applies.

16. Contact

Questions, requests and complaints about this policy or your data can be sent to:

Ayklo Limited
Email: privacy@ayklo.com

We aim to respond to every request within 30 days.