This Policy explains what personal data the TAS Reports platform (the "Platform") processes, for what purposes, with whom it is shared, how long it is kept, and how you can exercise your rights, under the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD") and the Brazilian Internet Civil Rights Framework (Marco Civil da Internet, Law No. 12,965/2014).
1. Who we are
The Platform is operated by TAS LEADS MARKETING LTDA, a Brazilian company enrolled in the National Register of Legal Entities (CNPJ) under No. 47.041.960/0001-63, headquartered in Curitiba, State of Paraná (PR), Brazil ("TAS Leads," "we," or "us").
The Platform is an advertising reporting dashboard. It is used by the TAS Leads team and by the agency's clients to track the performance of their ad accounts on Meta Ads (Facebook and Instagram) and Google Ads. There is no public sign-up: user accounts are created by TAS Leads for its clients.
2. Roles in the processing (Controller and Processor)
- Platform registration and usage data (for example, users' names, email addresses, and access logs): TAS Leads is the Controller.
- Client ad account data (campaign structure, creatives, and metrics): this data is processed on behalf of the client and to perform the services agreement. For this data, TAS Leads acts as a Processor and the client is the Controller, to the extent that such data contains personal data.
- Meta Platforms and Google are independent Controllers of the data they process in their own services, in accordance with their own policies.
[REVISÃO JURÍDICA: confirmar a qualificação de controladora/operadora com o contrato de prestação de serviços.]
3. How the Platform accesses ad accounts
The Platform only reads data. It does not create, edit, pause, or pay for ads. Access happens in one of two ways:
- Sharing with TAS Leads (primary method).
- Meta: the client shares its ad account with TAS Leads' business portfolio (Business Manager) as a partner, with the minimum "View performance" permission. The Platform reads the data through a system user of TAS Leads' business portfolio, with only the
ads_readread permission. - Google: the client accepts the link between its Google Ads account and TAS Leads' manager account (MCC). The Platform reads the data through a TAS Leads service account that has read-only access to the MCC. - Direct connection by the client (optional, OAuth). If the client prefers not to share its account with TAS Leads, it can authorize the Platform directly, by signing in with Meta (Facebook) or Google, through a single-use link sent by TAS Leads. In this case, we store the access token issued by Meta or Google. On Meta, the permission requested is read-only (
ads_read). On Google, the Google Ads API offers only one scope (adwords), which, under Google's rules, would also allow changes to the account; Google requires this scope, but the Platform uses it only to read data and never to create, change, or delete anything.
Data received from Google APIs (if Google sign-in is enabled). TAS Reports' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. What data we process
| Category | Examples | Source |
|---|---|---|
| User registration | name, email address, role (Admin, Client, or Supervisor (Supervisão)), company the user is linked to | provided by TAS Leads or by the client (invitations) |
| Credentials | password (stored only as a hash), two-factor authentication secret (encrypted), recovery codes | user |
| Access and audit logs | IP address, browser (user agent), date and time, actions taken on the Platform (for example, sign-in, invitation, report export) | generated automatically |
| Ad account data | account name, ID, currency, time zone, and status; campaigns, ad sets, and ads; creative text, headlines, and images; metrics such as spend, impressions, reach, clicks, conversions, and conversion value | Meta APIs (Marketing API) and Google APIs (Google Ads API) |
| Optional connection (OAuth) | user identifier at Meta or Google, permissions granted, access and refresh tokens (encrypted) | Meta or Google, when the client authorizes it |
| Support | messages exchanged by email or WhatsApp | user |
The ad metrics read by the Platform are aggregated: they do not identify the people who saw or clicked on the ads.
5. How we use the data and on what legal basis
| Purpose | Legal basis (LGPD, Art. 7) |
|---|---|
| Creating and maintaining user accounts, authenticating users, and displaying reports to each client | performance of a contract (item V) |
| Reading and organizing the client's ad account data to build reports, goals, and alerts | performance of a contract (item V), on behalf of the client |
| Keeping access logs for the legally required period | compliance with a legal obligation (item II; Marco Civil da Internet, Art. 15) |
| Security, fraud prevention, auditing, and incident investigation | legitimate interest (item IX) |
| Defending TAS Leads in legal proceedings | regular exercise of rights (item VI) |
| Responding to support requests and data subject requests | performance of a contract (item V) and compliance with a legal obligation (item II) |
We do not use the data for advertising, we do not sell data, and we do not use one client's data to serve another. Data obtained from Meta and Google is used only at the request of the respective client, kept separate for each client, and displayed only to that client, to the people it has authorized, and to the TAS Leads team that provides the service (Section 6).
6. Who we share data with
- The client itself and the people it has authorized (for example, Supervisor users it has invited).
- The TAS Leads team (Admin role). To provide the contracted service, the TAS Leads team sees the data of the clients it serves, including reports, campaigns, creatives, and metrics. For that same purpose, it may also use the "sign in as client" feature ("entrar como cliente"): the team member confirms their own password, states a reason, and chooses a mode, either read-only or editing, to configure the account on the client's behalf. The session lasts no more than 30 minutes, displays a fixed on-screen notice with an "Exit client mode" ("Sair do modo cliente") button, and ends when the team member exits the mode, when the time runs out, or when they sign out. In read-only mode, the team member has only the read permissions of that client's Client role; in editing mode, they have the permissions of the Client role and may also correct the company name. Personal settings, the password, and two-factor authentication are locked. In this mode, the team never sees or changes anyone's password or two-factor authentication. Every view, action, and change is recorded in the audit log, with the team member as the author, acting on the client's behalf. This access is restricted to TAS Leads personnel who use two-factor authentication.
- Service providers acting as Processors, only to the extent necessary:
- hosting of the Platform and its database: Hostinger [CONFIRMAR: razão social e localização do servidor];
- sending of transactional emails (invitations and notices): [PROVEDOR DO E-MAIL nao-responda@tasleads.com.br];
- encrypted backups: TAS Leads' Google Drive (Google).
- Meta and Google, which receive our calls to their APIs in order to deliver the data the client has authorized.
- Public authorities, when required by law or court order.
7. International transfers
Some providers, such as Google (backups) and the Meta and Google APIs themselves, may process data on servers outside Brazil, especially in the United States. [CONFIRMAR: localização dos servidores da Hostinger usados pela Plataforma.] In these cases, the transfer complies with Article 33 of the LGPD, based on the contractual safeguards offered by these providers, such as the standard contractual clauses approved by the ANPD (Brazilian National Data Protection Authority), where applicable.
8. How long we keep data
| Data | Retention period |
|---|---|
| User registration | while there is an active contract with the client the user is linked to; after the contract ends, up to 90 days |
| Ad account data and metrics history | while there is an active contract; after it ends, up to 90 days, unless deletion is requested earlier |
| Optional connection (OAuth) tokens | deleted, and revoked at Meta or Google, when the client disconnects or when the client's account is deleted; if the client's account is blocked, kept encrypted for up to 30 days and then revoked and deleted |
| Access logs (IP address, browser/user agent, date, and time) | 6 months from each record (Marco Civil da Internet, Brazil's Internet Civil Rights Framework, Law No. 12,965/2014, Art. 15). After that, we erase the IP address and browser (user agent) from the access and audit logs; only the date, time, and action taken are kept. |
| Archived audit logs | up to 5 years, for security and to exercise our rights in legal proceedings. The IP address and browser (user agent) are removed after the first 6 months. |
| Encrypted backups (made by TAS Leads) | deleted through automatic rotation, within approximately 12 months |
| Automatic hosting backups (Hostinger) | Hostinger makes weekly backups of the files and the database and deletes them automatically, in accordance with its own policy [CONFIRMAR no hPanel o prazo de guarda; fontes de terceiros indicam cerca de 6 semanas] |
Backups may still contain data that has already been deleted or anonymized on the Platform, including IP addresses. They are encrypted, used only for disaster recovery, and if a backup is ever restored, our deletion and anonymization rules are automatically reapplied.
When a retention period ends, the data is deleted or anonymized, except where the law permits or requires us to keep it longer (LGPD, Art. 16).
Account deletion: the Platform has no option for users to delete their own account or data. Requests are made to TAS Leads through the channels in Section 11, and our team carries out the deletion manually. All other data is deleted within 90 days after the request is confirmed (see the Data Deletion page). The IP address and browser (user agent) in the access and audit logs are deleted or anonymized only once each record reaches 6 months, because the Marco Civil da Internet requires us to keep them for that period.
9. How the client can remove access to its ad accounts
The client can remove access at any time, without needing to contact us. After that, the Platform stops updating that account.
Meta (account shared with TAS Leads): 1. Go to business.facebook.com with a user who has full control of the business portfolio. 2. Go to Settings → Users → Partners. 3. Select TAS Leads and remove its access to the ad account (or remove the partner).
Google Ads (account linked to TAS Leads' MCC): 1. Go to ads.google.com with an administrator user of the account. 2. Go to Admin → Access and security → Managers. 3. Find TAS Leads and click Remove (unlink).
Optional sign-in connection (OAuth): - Meta: on Facebook, go to Settings & privacy → Settings → Business integrations, find the TAS Reports app, and remove it. If Facebook sign-in is enabled on the Platform, Meta notifies us of the removal and we delete the data associated with that connection; if not, request deletion using the contact details in Section 11 (see the Data Deletion page). - Google: go to myaccount.google.com/connections (third-party connections), select the TAS Reports app, and remove its access.
You can also ask TAS Leads to remove access for you, using the contact details in Section 11.
10. Your rights (LGPD, Art. 18)
You may request, at any time:
- confirmation that we process your data;
- access to the data;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of unnecessary or excessive data, or of data processed in violation of the LGPD;
- portability of the data to another provider, in accordance with ANPD regulations;
- deletion of data processed based on consent, where applicable;
- information about the entities with which we share the data;
- information about the possibility of withholding consent and the consequences of doing so, where applicable;
- withdrawal of consent, where applicable.
You may also object to processing carried out on another legal basis if it does not comply with the LGPD, and you may file a complaint with the Brazilian National Data Protection Authority (ANPD).
When a request concerns ad account data, for which TAS Leads is a Processor, we will forward the request to the responsible client and support it in responding. For your security, we may ask for information to confirm your identity. We respond to access requests within 15 days (LGPD, Art. 19).
11. Data protection communication channel
TAS Leads is a small processing agent (agente de tratamento de pequeno porte) and is therefore exempt from appointing a data protection officer (encarregado) (ANPD Board of Directors Resolution No. 2/2022, Art. 11). To discuss privacy and exercise your rights as a data subject, use the communication channel below:
- E-mail: tasleadsmarketing@gmail.com (subject line "Privacidade" (Privacy))
- WhatsApp: +55 41 99591-4919 (9 a.m. to 6 p.m., Brasília time)
12. Security
We adopt technical and administrative measures to protect data, including:
- connections that are always encrypted (HTTPS);
- Meta and Google access tokens stored encrypted (AES-256), never displayed in the browser or written to logs;
- passwords stored only as a hash; two-factor authentication mandatory for the TAS Leads team;
- read-only access to ad accounts, with the least privilege possible;
- data separated by client: each user sees only the data of the client they are linked to;
- an audit log of sensitive actions, protected against alteration;
- daily encrypted backups.
No system is completely immune to failures. If a security incident occurs that may create a relevant risk or harm, we will notify the affected individuals and the ANPD, as required by Article 48 of the LGPD.
13. Cookies and browser storage
The Platform uses only cookies that are strictly necessary for its operation and security. For this reason, they do not require consent.
| Name | Purpose | Duration |
|---|---|---|
__Host-tas_session |
securely identifies your session (sign-in and, on the access request pages, the link you opened). It is sent only over an encrypted connection, cannot be read by scripts, and is restricted to dash.tasleads.com.br | until you sign out or the session expires |
XSRF-TOKEN |
protects forms against cross-site request forgery (CSRF) attacks | same as the session |
Your theme preference (light or dark) is stored only in your browser (local storage) and is not sent to us.
We do not use tracking, advertising, social media, or analytics cookies, whether our own or third-party.
14. Children and adolescents
The Platform is intended for businesses and professionals. It is not directed to individuals under 18 years of age, and we do not knowingly process data of children or adolescents.
15. Changes to this Policy
We may update this Policy. The effective date is shown at the top of the page. If a change is material, we will notify users through the Platform or by email before it takes effect.
16. Governing law and venue
This Policy is governed by the laws of Brazil. The courts of the Judicial District (Comarca) of Curitiba, State of Paraná (PR), Brazil, are chosen as the venue, without prejudice to the data subject's right to bring proceedings in the courts of their place of domicile or to file a complaint with the ANPD.