Privacy Policy

Effective: August 9, 2026

Who we are

AdLoomly (https://adloomly.com) is a TikTok Ads automation platform built and operated by the ALFAKHR e-commerce team. This policy explains what personal data we collect when you use AdLoomly, why we collect it, and the choices you have.

Contact: privacy@adloomly.com
Address: Bali, Indonesia

Information we collect

Account information you give us

When you create an AdLoomly account we collect your name, email address, and a password. We store only a cryptographic hash of your password — never the password itself.

TikTok advertising data via the official Marketing API

When you connect a TikTok ad account, we receive advertising data from TikTok through the official TikTok Marketing API. This is the core of our service and is described in full detail in the TikTok Marketing API Integration section below.

Usage and log data

Like most online services, we collect basic technical logs: IP address, browser type, pages visited within AdLoomly, and timestamps of actions (for example, when a rule you configured fired). We use this data for security, debugging and improving the product.

Payment data — not stored by us

We do not store your credit card or other payment details. Payments are handled entirely by our payment processor; we receive only confirmation of payment status and the last four digits of your card for your reference.

TikTok Marketing API Integration

AdLoomly is built on the official TikTok Marketing API. This section explains exactly how the connection works, what we request, what we store, and how you can revoke access at any time.

How authorization works (OAuth 2.0)

You connect your TikTok ad account using TikTok's standard OAuth 2.0 advertiser authorization flow. When you click "Connect TikTok" in AdLoomly, you are taken to TikTok's own authorization page (via TikTok Business Center), where you log in and approve the connection directly with TikTok. TikTok then redirects you back to AdLoomly with an authorization code, which we exchange for an access token.

We never receive, see, or store your TikTok password. Authentication happens entirely on TikTok's pages.

Scopes we request, and why

We request the minimum set of permissions needed to run the product:

• Ad Account Information (read) — to list the ad accounts you are authorized on so you can choose which ones to connect.
• Campaign / Ad Group / Ad (read + create/update) — to launch and manage the campaigns, ad groups and ads you configure in our Campaign Launcher.
• Reporting / Consolidated Report (read) — to pull your spend and performance metrics (via TikTok's /report/integrated/get/ endpoint) and show them in your Ad Spend Analytics dashboard.
• Automated Rules (read + create/update) — to create and run the IF/THEN kill and scale rules you set up in AdLoomly.

Exactly what TikTok data we store

• Ad account IDs and names.
• Campaign, ad group and ad metadata: IDs, names, status, budgets and objectives.
• Performance metrics: spend, impressions, clicks, conversions, CPA, CPM and ROAS.

What we do NOT collect from TikTok

• Your TikTok password — never received, never stored.
• Personal data about end users or viewers of your ads.
• The contents of your audience lists (Custom Audience member data).
• Payment details of your TikTok ad account.

How access tokens are stored

TikTok access tokens are encrypted at rest using AES-256 and transmitted only over TLS. Tokens are used exclusively to make Marketing API calls on your behalf, for the features you configure.

Revoking access

You can disconnect at any time, from either side:

• In AdLoomly — use the disconnect button in Settings.
• In TikTok Business Center — remove AdLoomly's authorization from your TikTok account.

Either path immediately stops all API calls. All TikTok-derived data is deleted from our systems within 30 days of disconnection.

Compliance with TikTok terms

Our use and transfer of information received from the TikTok Marketing API adheres to TikTok's Developer Policies and Platform Terms — including the TikTok Business Products (Data) Terms, the TikTok Marketing API Terms and TikTok's Advertising Policies — and to any applicable Limited Use requirements. We request only the permissions necessary to provide the service, and we use TikTok data solely to provide and improve the features you use.

How we use your information

• To provide the service: launching campaigns, evaluating automation rules, and displaying your spend analytics.
• To execute the rules and launches you configure — we act only on your instructions.
• To provide customer support.
• To keep the platform secure and prevent abuse.

We do not sell your data. We do not use your advertising data for any other customer. We do not use your advertising data for our own advertising.

Data sharing

We share data only with:

• TikTok — via the Marketing API, at your instruction (for example, when you launch a campaign or a rule you configured pauses an ad group).
• Our hosting infrastructure provider — which stores our databases and runs our servers.
• Our payment processor — to handle subscription billing.
• Our email provider — to send you transactional emails and alerts you opted into.
• Legal authorities — only if required by law, court order, or other legal compulsion.

The current list of sub-processors is maintained at Sub-processors.

Data retention

• Account data is kept while your account is active.
• TikTok performance metrics are kept on a rolling 24-month window for trend analysis.
• Data is deleted within 30 days of account deletion or TikTok disconnection.
• Backups are purged within 90 days.

Security

Data is encrypted in transit (TLS) and at rest (AES-256), access is restricted on a least-privilege basis, and access tokens are never exposed in logs or to the browser. Read more on our Security page.

Your rights

You can access, correct, delete, or export your personal data at any time. Contact privacy@adloomly.com and we will honor your request.

For users in the EEA / UK (GDPR)

We process your data on the following lawful bases: performance of our contract with you (providing the service), legitimate interest (security, product improvement), and consent (where applicable, e.g. optional communications). You additionally have the rights to restrict or object to processing, the right to data portability, and the right to lodge a complaint with your local supervisory authority.

For California users (CCPA)

California residents have the right to know what personal information we collect, to request deletion, and to not be discriminated against for exercising those rights. We do not sell personal information.

Data deletion

There are three ways to delete your data: in-app from Settings, by emailing privacy@adloomly.com, or by removing AdLoomly's authorization in TikTok Business Center. Full details, including timelines, are on our Data Deletion page.

International transfers

Your data is processed in the EU and/or the US by our hosting sub-processors, with appropriate safeguards in place (such as standard contractual clauses where required).

Children

AdLoomly is a business tool for advertisers and is not directed at anyone under 18. We do not knowingly collect data from minors.

Changes to this policy

If we make material changes to this policy, we will update the effective date above and notify you by email or in-app notice before the changes take effect.

Contact

Questions about privacy? Email privacy@adloomly.com.