Data Policy
Last updated: October 19, 2026
This Data Policy explains how Paid & Sold handles the data our clients give us access to when we run their paid media: advertising accounts, tracking tools, stores, CRMs and the customer information inside them. For information collected through our website, see our Privacy Policy.
1. Your accounts stay yours
Your Meta, Google and other advertising accounts stay in your name and under your ownership. We work in them through access you grant, such as partner or user access in Meta Business Manager and Google Ads, and you can remove that access at any time. Your ad spend is paid by you directly to the platforms.
2. What data we access
Depending on the engagement, we may access:
- Advertising account data: campaigns, ads, budgets, audiences and performance reports.
- Measurement data: pixels, Conversions API, Google Tag Manager, Google Analytics and similar tools.
- Business data: orders, revenue, product margins and lead status from your store or CRM (for example Shopify, Tiendanube, HubSpot).
- Customer feedback you share with us, such as reviews, support tickets, surveys and messages, used to build ads from real customer evidence.
3. How we use it
We use client data only to provide the services you hired: research, strategy, creative production, campaign management, tracking and reporting. We do not use one client's data to benefit another client, and we do not sell or rent client data to anyone.
When we build audiences or send conversion data to advertising platforms (for example through the Meta Conversions API, customer lists or Google offline conversions), we do it on your behalf and following the platforms' rules. Where the platforms require it, personal identifiers such as emails and phone numbers are hashed before they are uploaded. You are responsible for having the notices and consents your customers need for that use.
4. Customer feedback and testimonials
We remove names and personal details from customer feedback before using it in research. We only publish a real customer's words, name or image in an ad with your approval, and you are responsible for having permission from that customer.
5. Access and security
- Access is limited to the people working on your account, and only to the tools needed for the work.
- We use individual logins with two-factor authentication where the platform supports it, and we do not share passwords.
- Data exported for analysis is stored in secured work tools and is not kept on personal devices longer than needed.
- Our service providers are bound by confidentiality and data protection obligations.
6. Confidentiality
We treat your business information, results and customer data as confidential. We only share results publicly, for example as a case study, with your prior approval.
7. When we stop working together
When an engagement ends, we hand over any assets created for you that you are entitled to, and you remove our access to your accounts. Within 90 days we delete or return the client data we hold, except what we must keep for legal, tax or accounting reasons or what you ask us in writing to keep.
8. Data deletion requests
You can ask us at any time to delete personal or client data we hold. Send the request through the contact form with the company name and, if relevant, the account or person the data relates to. We confirm the request and complete it within 30 days, unless the law requires us to keep the information.
9. Security incidents
If we become aware of a security incident that affects your data, we will notify you without undue delay, tell you what happened and what we are doing about it, and help you meet any notification obligations you have.
10. Changes to this policy
We may update this Data Policy from time to time. The date at the top shows when it was last changed.
11. Contact
For questions about this Data Policy, contact us through the contact form or by email at [email protected] on our website.