Data Deletion Instructions

Version: 0.1-draft Effective date: not yet in force (draft) Status: Draft pending review by a qualified Romanian lawyer before use. Menu paths of third-party services change often and must be re-checked before publication; Platform menu names marked [TBC] must match the live application.

This page explains how to ask ALTTAB PROFIT SRL (the "Company"), operator of 1ads (the "Platform", https://app.1ads.net), to delete data, and how to remove the Platform's access to your Google, Meta, TikTok, LinkedIn and other accounts. It is published at https://1ads.net/en/legal/data-deletion-instructions/ and is referred to in our Privacy Policy (privacy-policy.md) and in the settings of the apps we register with Third-Party Platforms.

1. Who this page is for

1.1. Customers and Authorized Users. Businesses that use the Platform, and the people they invite to use it.

1.2. People whose data our customers process. For example, someone who commented on a brand's Facebook page, sent a message to a brand on Instagram, or bought from a shop that uses the Platform. In these cases the brand or shop is the controller of your data, and the Company processes it on the brand's behalf. Section 6 explains what to do.

1.3. People who signed in to one of our apps on a Third-Party Platform, for example by connecting a Facebook account. Section 5 explains the automatic deletion process for Meta.

2. Summary of timelines

Some records must be kept for longer by law, for example invoices and contracts (Section 8).

3. If you are a customer or an Authorized User

3.1. Delete specific content. Authorized Users with the necessary permissions can delete conversations, files, creatives, drafts and other content directly in the Platform. Deleted content is removed from active systems and expires from backups no more than 14 days later.

3.2. Disconnect a connected account. In the Platform, go to Integrations, open the connection and choose Disconnect and delete data [TBC: exact menu names]. The Platform then:

• deletes the stored access token immediately and asks the provider to revoke it where the provider's API allows;
• stops synchronising data from that account; and
• deletes data synchronised from it within 30 days. Shorter platform-specific limits (for example for YouTube and LinkedIn) always apply.

3.3. Remove an Authorized User. A customer administrator can remove a user at any time. That user's account data is deleted within 30 days. Records of actions the user took are kept in pseudonymised form in the audit log, as described in the Data Retention Schedule (data-retention-schedule.md).

3.4. Close the account and delete all data. The customer's account owner can ask for the account to be closed by writing to support@1ads.net or privacy@1ads.net from the email address registered on the account. Customer Data can be exported for 30 days after the end date. It is then deleted from active systems within 30 days, and backup copies expire no more than 14 days after that. The full process is described in Section 16 of the Data Processing Agreement (data-processing-agreement.md).

3.5. Agency customers can delete an End Client's Workspace at any time. The same timelines then apply to that Workspace.

4. Remove the Platform's access from the provider's settings

You can always remove the Platform's access from the settings of the provider itself. Removing access stops the Platform from reading or changing anything in that account. It does not, by itself, delete data the Platform has already stored. We delete that data under the timelines in Section 2, and you can also ask us to delete it immediately (Section 7).

Menu names may differ slightly depending on your device, language and account type.

4.1. Google (Google Ads, Google Analytics, Search Console, YouTube)

• Go to your Google Account, Security, then Your connections to third-party apps & services (direct link: https://myaccount.google.com/permissions). Choose 1ads and select Delete all connections or Remove access.
• You can also use the Google security settings page: https://security.google.com/settings/security/permissions.
• For Google Workspace accounts, your administrator can also remove the app in the Google Admin console.

YouTube. The Platform uses the YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's processing of your data is described in the Google Privacy Policy (http://www.google.com/policies/privacy). You can revoke the Platform's access to your YouTube data at any time through the Google security settings page above.

Google user data. The Platform's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

4.2. Meta (Facebook, Instagram, Threads)

• Facebook: Menu, Settings & privacy, Settings, then Business integrations (for business tools) or Apps and websites. Choose 1ads, then select Remove. Facebook may also offer to delete posts, videos or events the app published on your behalf.
• Instagram: Settings and activity, Website permissions, Apps and websites. Choose 1ads and select Remove.
• Threads: remove the app in the app-permission settings of your Threads or linked Instagram account.
• Meta Business portfolio: if a business portfolio connected the Platform, an administrator can also remove the app in the portfolio's business settings, under integrations and connected apps.

Removing the app from Facebook also triggers the automatic deletion request described in Section 5.

4.3. TikTok

• TikTok app (mobile): Profile, Menu, Settings and privacy, Security and permissions, App permissions (sometimes called Apps and services permissions). Choose 1ads and select Remove access.
• TikTok for Business (Ads Manager or Business Center): an administrator can remove the Platform's authorization from the advertiser account's connected apps or partner settings.

4.4. LinkedIn

Me, Settings & Privacy, Data privacy, then under Other applications select Permitted services. Choose 1ads and select Remove. Revoking access for your personal account may also stop the Platform's access to the LinkedIn pages and ad accounts you manage through it.

4.5. Microsoft (Microsoft Advertising)

• Personal Microsoft account: go to https://account.live.com/consent/Manage, choose 1ads and select Remove these permissions.
• Work or school account: go to https://myapplications.microsoft.com and remove the app's permissions, or ask your Microsoft Entra ID administrator to remove the enterprise application.

4.6. Amazon Ads

In your Amazon account, open the page listing apps connected through Login with Amazon (for example https://www.amazon.com/ap/adam, or the same page on your Amazon marketplace). Choose 1ads and select Remove.

4.7. X

Settings and privacy, Security and account access, Apps and sessions, Connected apps. Choose 1ads and select Revoke app permissions.

4.8. Pinterest

Open your Pinterest settings, find the list of connected apps (under Security and logins or Apps, depending on your interface), choose 1ads and select Revoke access.

4.9. E-commerce and CRM systems

• Shopify: Shopify admin, Settings, Apps and sales channels, choose 1ads, then Uninstall. Shopify then sends us a shop deletion request, and we delete the shop's data within 30 days of receiving it.
• WooCommerce: WordPress admin, WooCommerce, Settings, Advanced, REST API. Revoke the key created for 1ads.
• HubSpot: Settings, Integrations, Connected apps. Choose 1ads and select Uninstall.
• Salesforce: users can revoke access under their personal settings, Connected Apps. Administrators can use Setup, Connected Apps OAuth Usage, then revoke.
• Pipedrive: Tools and apps, Marketplace apps (or Installed apps). Choose 1ads and select Uninstall.
• Adobe Analytics: your Adobe administrator can delete the credentials created for 1ads in the Adobe Admin Console or Adobe Developer Console.

4.10. Accounts connected through our partners

Some connections are made through our sub-processors Zernio (publishing to social networks), Windsor.ai or Unified.to (additional data connectors). Revoking access in the provider's settings, as described above, also stops these connections. When you disconnect in the Platform, we ask the partner to delete the related tokens and data.

5. Automatic deletion requests from Meta (data deletion callback)

5.1. When a person removes the 1ads app from their Facebook settings (Section 4.2), Meta automatically sends us a signed data deletion request for that person's app-scoped user ID. You do not need to contact us separately.

5.2. On receiving the request, we:

(a) verify the request using our app secret;

(b) delete the data we received from Meta about you as a user of our app, such as your app-scoped user ID, name, profile picture and the access tokens connected to your account;

(c) give Meta a confirmation code and a link to a status page. Meta shows these to you, so that you can check the progress of your request; and

(d) inform the customer whose workspace you used, if any. Assets that the customer connected through your account (for example a Facebook page or an ad account) are disconnected. The customer can reconnect them through another administrator.

5.3. Business data that we hold for a customer, such as page insights or campaign reports, belongs to the customer's workspace. We process it only on the customer's behalf and keep it separate from every other customer's data. If your request concerns such data, we forward it to the customer and delete the data as the customer instructs, or as Meta's terms require.

5.4. You can also ask for deletion by email (Section 7).

6. If you are not our customer

6.1. If a brand, shop or agency uses the Platform, your data (for example a comment on the brand's page, a message you sent to the brand, or an order you placed) is processed by the Company on behalf of that business. That business decides how your data is used. Please send your request to the business directly. Its contact details should be in its own privacy notice.

6.2. You can also write to us at privacy@1ads.net. Please tell us which business your request concerns and on which network or shop you interacted with it. We will forward your request to that business without undue delay, and in any case within five business days, and help the business to respond. We do not respond to the substance of the request ourselves without the business's authorization, unless the law or a Third-Party Platform's terms require us to delete the data directly.

6.3. Data that is deleted automatically, whatever the business does:

• Profile and activity data of LinkedIn members who interact with a business's LinkedIn page is kept for no more than 24 hours.
• Comments and direct messages are deleted after 30 days by default.
• Data received from YouTube is refreshed or deleted at least every 30 days.

7. How to send a deletion request

7.1. Email privacy@1ads.net with the subject "Deletion request". Please include:

• your name and the email address you use with the Platform or the Third-Party Platform;
• whether you are a customer, an Authorized User or another person (Section 1);
• the account, page, workspace or business concerned, and the network (for example "Instagram comments on the page of Brand X");
• what you want deleted, if not everything.

7.2. Verification. To protect your data, we may ask you to confirm your identity or your control of the account, for example by replying from the registered email address. We ask only for the information we need. Please do not send copies of identity documents unless we ask for them.

7.3. Response. We acknowledge your request within five business days and reply within one month. If the request is complex, we may extend this by up to two further months; if so, we will tell you why within the first month.

7.4. Requests are free of charge. For requests that are manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request, as allowed by Article 12(5) GDPR. We will explain our reasons.

8. What we delete and what we may keep

8.1. We delete the personal data concerned from active systems. Backup copies expire no more than 14 days later. Backups are used only for disaster recovery. If a backup has to be restored, deletions are applied again before the data is used.

8.2. We may keep some data where the law requires it or allows it, and only for as long as necessary:

• invoices, contracts and accounting records, for the periods required by Romanian accounting and tax law;
• audit and security logs, in pseudonymised form, to protect the Platform and to establish, exercise or defend legal claims;
• a record of your deletion request, to show that we handled it.

The exact periods are listed in the Data Retention Schedule (data-retention-schedule.md).

8.3. Data that has been irreversibly anonymised or aggregated (for example total campaign spend per day) is no longer personal data and may be kept.

8.4. Third-Party Platforms keep their own copies of your data under their own policies. To delete data held by Google, Meta, TikTok, LinkedIn or another provider, use that provider's own tools.

9. Contact and complaints

9.1. Privacy and deletion requests: privacy@1ads.net. Data protection contact: {{DPO_CONTACT}}. Customer support: support@1ads.net. Postal address: ALTTAB PROFIT SRL, Str. Doamna Oltea nr. 70, Sector 2, Bucharest, postal code 020231, Romania.

9.2. If you are not satisfied with how we handled your request, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or with the supervisory authority of the EU country where you live or work, or where the alleged infringement took place.