Legal

Privacy policy

Effective October 17, 2026

This policy explains how ViableTeck (“ViableTeck”, “we”, “us”) collects, uses, shares and protects information when you use GridSocial, our website at gridsocial.app and related services (together, the “Service”). GridSocial lets marketing agencies manage Google Ads, Meta and Microsoft Advertising accounts for their clients in one place.

1. Who we are

GridSocial is a product of ViableTeck. Our address is ViableTeck, 5441 S Macadam Ave, Ste N, Portland, OR 97239, USA. You can reach us about privacy at support@viableteck.ai.

We are the controller of account, website and early-access information. For ad-platform data and creatives that an agency brings into GridSocial on behalf of its clients, the agency is the controller and we act as its processor, handling that data only to provide the Service and on the agency's instructions.

2. Information we collect

Information you give us

  • Account information: your name, email address, the agency you belong to and your role.
  • Client information: names and websites of the client companies your agency manages, and email addresses of people you invite to connect an ad account.
  • Creatives: images, videos and other files you upload for use in ads.
  • Early-access sign-ups: your email address, company name and the type of business you select.
  • Messages: anything you send us by email or support channels.

Information from connected ad platforms

When you connect an ad account, you sign in with the platform and grant GridSocial access. We then receive and store:

  • OAuth access and refresh tokens, encrypted at rest (see Security below);
  • the scopes you granted and which user granted them;
  • ad account details such as account ID, name, currency and time zone;
  • campaigns, ad groups / ad sets, ads, budgets, bids, targeting settings and their status;
  • daily performance metrics such as impressions, clicks, spend and conversions.

The access we request from each platform is:

  • Google Ads: https://www.googleapis.com/auth/adwords, to read campaign data and reporting and to apply changes you approve.
  • Meta (Facebook and Instagram): ads_read, ads_management and business_management, to read ad accounts and insights, manage campaigns you approve and find the ad accounts your business has access to.
  • Microsoft Advertising: msads.manage and offline_access, to read and manage campaigns and keep the connection active without asking you to sign in every time.

We do not request access to your contacts, personal messages, friends lists or personal profile content.

Information collected automatically

  • Technical data: IP address, browser type and request logs, used to run and secure the Service. We use IP addresses to rate-limit sign-up forms against abuse.
  • Activity records: an audit log of changes drafted, approved and published in GridSocial, and who made them.
  • Cookies: only the cookies needed to keep you signed in and the Service working. We do not use advertising or third-party analytics cookies.

3. How we use information

  • to provide the Service: show performance across platforms, prepare changes and publish the ones you approve;
  • to authenticate you, keep your account secure and prevent fraud and abuse;
  • to provide support and send you service messages, such as sign-in emails and security notices;
  • to tell early-access sign-ups when GridSocial is available to them;
  • to maintain and improve the Service, including fixing errors;
  • to comply with law and with the terms of the ad platforms we connect to.

We never sell your information or ad-platform data, use it to advertise to you or anyone else, use it to build advertising profiles, or use it to train general-purpose AI or machine-learning models. We do not publish any change to an ad account without approval from a user of your agency.

4. Google API Services: Limited Use

GridSocial's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data received through Google APIs we:

  • use it only to provide and improve the user-facing features of GridSocial described in this policy;
  • transfer it only when needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you;
  • do not use or transfer it for serving ads, including retargeting, personalised or interest-based advertising;
  • do not allow people to read it unless you have given us permission for specific data, it is necessary for security purposes such as investigating abuse, it is needed to comply with law, or it has been aggregated and anonymised for internal operations.

We handle Meta and Microsoft data under the same rules and in line with the Meta Platform Terms and the Microsoft Advertising API terms.

5. How we share information

We share information only with:

  • The ad platforms you connect (Google, Meta and Microsoft), to read data and publish changes you approve. Their own privacy policies apply to data they hold.
  • Members of your agency, according to the roles your agency assigns.
  • Service providers that host and run GridSocial for us, under contracts that limit their use of the data to providing their services:
    • Vercel Inc. (application hosting and scheduled jobs, USA);
    • Supabase Inc. (database, sign-in and sign-in emails, file storage and key storage, USA);
    • Google LLC (Google Workspace email for our team; web fonts).
  • Authorities or others when required by law, or when needed to protect the rights, safety or property of our users, the public or ViableTeck.
  • A buyer or successor if ViableTeck is involved in a merger, acquisition or sale of assets, with notice to you and with this policy continuing to apply.

6. Legal bases (EEA and UK users)

We process personal data on these bases under the GDPR and UK GDPR:

  • Contract: to provide the Service you or your agency signed up for;
  • Legitimate interests: to secure, maintain and improve the Service and prevent abuse;
  • Consent: for early-access updates, which you can withdraw at any time;
  • Legal obligation: where the law requires us to keep or disclose information.

7. How long we keep information

  • Account, client and ad-platform data is kept while your agency's account is active. When an ad account is disconnected, we delete its tokens straight away and its synced data within 30 days.
  • When an agency account is closed, we delete its data within 30 days. Backups roll over within a further 30 days.
  • Audit and security logs are kept for up to 12 months.
  • Early-access sign-ups are kept until you ask us to remove them or GridSocial launches for you.
  • We keep information longer only where the law requires it.

See our data deletion instructions for how to remove access and request deletion.

8. Security

We encrypt data in transit with TLS and at rest. Ad-platform tokens are additionally encrypted with a key held in a separate key vault. Access to production systems is limited to staff who need it and is logged. No system is completely secure, but if a breach affects your personal data we will notify you and the relevant authorities as the law requires.

9. International transfers

We are based in the United States and store data in the United States. When we transfer personal data from the EEA, UK or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

10. Your rights

Depending on where you live, including the EEA, UK, California (CCPA/CPRA), Oregon (Oregon Consumer Privacy Act) and other US states, you may have the right to:

  • know about and access the personal data we hold about you;
  • correct inaccurate data;
  • delete your data;
  • receive your data in a portable format;
  • object to or restrict certain processing, and withdraw consent;
  • opt out of the sale of personal data, targeted advertising or profiling. We do none of these;
  • not be discriminated against for exercising these rights;
  • complain to your local data protection authority.

To exercise a right, email support@viableteck.ai. We will verify your request and respond within 30 days (45 days where US state law allows). If your data came to us through an agency, we may pass your request to that agency, which controls that data. You can appeal a decision by replying to our response.

11. Children

GridSocial is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy. If we make material changes, we will notify account holders by email or in the Service before they take effect. The effective date at the top shows when this policy last changed.

13. Contact us

ViableTeck, 5441 S Macadam Ave, Ste N, Portland, OR 97239, USA
Email: support@viableteck.ai