Privacy Policy

Media Buying Made Easy LLC, doing business as ToMarket (“ToMarket”, “we”, “us”), operates an AI-assisted advertising platform at tomarket.io. This policy explains what we collect, why, who we share it with, and your choices. Questions: privacy@tomarket.io, or by mail to Media Buying Made Easy LLC, 6231 PGA Blvd, Ste 104 3000, Palm Beach Gardens, FL 33418.

• Account data - name and email you provide when you sign in (via our authentication provider, Auth0), and the organizations and workspaces you belong to.
• Billing data - your plan, invoices, and payment status. Card details are collected and stored by our payment processor, Stripe; we do not store full card numbers.
• Connected advertising accounts - when you connect a platform such as Meta, Google, or ChatGPT (OpenAI) ads, we receive access tokens and read advertising data (ad accounts, campaigns, ad sets, ads, performance metrics, pixels, Pages, and audiences) needed to display and manage your campaigns.
• Google user data - if you connect Google Ads, we access your campaigns, ad groups, ads, keywords, budgets and performance metrics through the Google Ads API, and we create, pause, resume or change budgets on campaigns only when you approve the change or enable an automation rule for your own account. If you connect Google Analytics or Google Search Console, we read traffic, conversion and search query data for your own properties to display alongside your ad performance; we never write to them. We use Google user data only to provide these features to you. We do not use it to train AI models, do not sell it, and do not use it for our own advertising.
• Leads - if you connect a lead source or run lead-form campaigns, we receive the contact details your leads submit and the campaign they came from, so you can see results by campaign.
• Content you create - brands, products, offers, creative briefs, uploaded and generated images, video, copy, and the campaigns you build.
• Personal clones - if you create an AI avatar or voice of a person, we collect their photos, video, and voice recordings, and a record of their consent. Only create a clone of yourself or of someone who has agreed to it.
• Support and feedback - messages you send us and the reports you file from inside the app.
• Usage and diagnostic data - logs, error reports, and product analytics needed to run, secure, and improve the service. Our use of cookies is described in the Cookie Policy.

• To provide the service - read, display, and manage your ads.
• To generate creative, copy, research, and recommendations using AI providers on your behalf.
• To create, update, pause, or change budgets on campaigns on connected platforms onlyat your direction or under the automation you turn on for your account, including ToMarket’s built-in rules when you choose an automated mode.
• To bill you, send account and service emails, and answer support requests.
• To secure, maintain, and improve the service.

We do not sell your personal information or your advertising data, and we do not use your advertising data or content to train AI models.

ToMarket’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share data with service providers (subprocessors) only as needed to run the service. Each processes it under a contract with us and its own terms:

• Hosting and infrastructure - Amazon Web Services (databases, file storage, compute, video rendering; United States) and Vercel (web hosting).
• Sign-in - Auth0 (Okta).
• Payments - Stripe.
• AI providers - Anthropic and OpenAI (analysis, copy, and images), Google (image generation and analysis), Kling (video generation), Higgsfield (video generation), HeyGen (avatar video for personal clones), and ElevenLabs (voice and voiceover).
• Research - Apify, to collect public competitor ads for the research you run.
• Communication and support - Resend (service email), Customer.io (product email), and Zendesk (support).
• Operations - Sentry (error monitoring) and internal tools we use to track issues and receive operational alerts (Trello, Discord).
• Analytics and marketing - Google Analytics, Microsoft Clarity, Meta Pixel, and OpenAI Pixel, as described in the Cookie Policy.

Advertising and other platforms you connect (such as Meta, Google, ChatGPT ads, Shopify, or Slack) receive data at your direction and handle it under your own agreements with them. We may also disclose information if required by law, or as part of a merger or sale of our business.

We are based in the United States and store data with providers in the United States. If you use AI video generation, prompts and images are sent to Kling, which processes them in China. Using the service from outside the United States means your information is transferred to and processed in these countries.

We use technical access controls to protect Google user data and the credentials used to access connected accounts:

• Encryption in transit.Our public application and API use HTTPS to protect information transmitted between your browser and our service. Connections to Google's authorization and data APIs also use HTTPS.
• Encrypted connection credentials. We encrypt stored OAuth access tokens and refresh tokens for connected platforms, including Google, in our database. Our backend decrypts these credentials when needed to perform authorized operations; they are not supplied to other customers.
• Account and workspace access controls. Access to connected-account data is controlled through authenticated accounts, organization and workspace membership, and application permissions. Tenant-scoped database queries and row-level security policies help separate customer data.
• Protection of the connection process. We validate signed, time-limited OAuth state and single-use connection requests to help prevent tampering and replay during account linking.
• Permission limits. Google Ads access supports the advertising features you authorize. Google Analytics and Search Console connections are read-only. Creating or changing advertising campaigns is performed at your direction or under automation you enable.

No method of electronic storage or transmission provides an absolute guarantee of security.

We keep your information while your account is active. Deleting items or closing parts of your account in the app removes them from your view; we keep the underlying records so your history stays intact, until you ask us to delete them.

You can remove a connection on the Connections page. Disconnecting stops our access to that account right away: we delete its stored access tokens and stop syncing. Data already synced from it stays in your account, hidden, until you request deletion. Removing one ad account under a shared connection does not revoke access for the other accounts that remain connected.

When you disconnect the main Google connection, we also request revocation from Google. You can independently revoke ToMarket's access through your Google Account permissions at myaccount.google.com/permissions. Revoking access at Google prevents future access but is separate from requesting deletion of information we already store.

To have your data permanently deleted, email privacy@tomarket.io. We delete it within 30 days and confirm by email, keeping only records the law requires us to keep (such as billing and tax records). Details are on the Data Deletion page.

You can disconnect any advertising account, and you can ask us to access, correct, export, or delete your personal information, or to close your account, by emailing privacy@tomarket.io. Depending on where you live, you may have additional rights under local law; we honor them and will not treat you differently for using them. You can control optional cookies as described in the Cookie Policy.

If you are a lead or other person whose information one of our customers collected with ToMarket, please contact that business first; we will help them respond to your request.

ToMarket is a business service and is not intended for anyone under 18.

We may update this policy; material changes will be reflected by the “last updated” date above.

Terms of Service · Cookie Policy · Data Deletion