what we do with
your data.

Beyond Ads, based in India, is the data controller for everything on this page: we decide what is collected and what it is used for. You can reach us about any of it at hello@gobeyondads.com.

The form on the contact page asks for your name, your brand, a work email, a WhatsApp number to reach you on, your role, and a short description of what is not working. It may also ask optional questions, such as your website, the channels you are running, or the band your monthly ad spend falls into.

With your enquiry we also record how you reached us: the page you landed on, the site that linked you here, and any campaign tags in that link. It is stored with your enquiry, not in a cookie, and tells us which of our channels are working.

We do not ask for a payment detail or a government identifier anywhere on this site, and there is no account to create and no password to set.

If you apply for a role on the careers pages, we ask for your name, email, phone number, current location, experience, current and expected pay, notice period, an optional LinkedIn profile, how you heard about us, a cover note and your resume as a PDF.

Applications are stored in Hiring HQ, the hiring system we run at hire.gobeyondads.com. We use AI tools to help screen resumes, summarise interviews and draft replies; a person reviews every application and makes every decision, and nobody is rejected automatically by AI. Later stages may involve an interview platform and, before an offer, background verification and references. The full candidate notice, including the third parties involved at each stage, is at hire.gobeyondads.com/privacy.

Separately, the server that hosts this site keeps ordinary access logs (IP address, timestamp, the page requested, the browser string) for as long as we need them to keep the site running and secure. Those logs are not linked to a named person and are not shared with anyone.

The chat button in the corner of the site is an AI assistant that answers from the text of this website. What you type into it, along with the earlier messages in the same conversation, is sent to a third-party AI service provider, acting as our processor under contract, to generate a reply. The provider may be located outside India, so this is a cross-border transfer of your data. It processes the conversation only to return the reply to us, and where its terms allow that commitment it is contractually barred from using it to train its models or for any purpose of its own. We send it only what it needs to reply. It may hold the conversation for a limited period under its own retention terms.

If you choose to give the assistant your name, brand, email and what you are stuck on, it will read them back and ask you to confirm before doing anything with them. On your confirmation they are submitted to exactly the same place as the contact form above, with the same email to the founders, and are handled the same way from then on. The assistant will not ask for payment details, passwords or ID numbers, and you should not give it any.

We keep the conversation. Each chat is stored in Beyond Ads HQ, the internal app we run, for 90 days and then deleted. The founders read them to see what people ask and where the assistant falls short, and once a day the assistant itself reviews the day’s conversations to propose improvements, which a person approves or rejects before anything changes. A copy also sits in your browser’s session storage so the chat survives moving between pages, and is gone when you close the tab. The assistant is rate-limited, and you can always use the contact form or email instead.

To reply to your enquiry, and to work out whether we are the right people for your brand. One of the founders reads it, usually comes back with a question or two about your margin structure, and either takes the conversation forward or tells you we are not a fit.

If we do end up working together, the same details carry into onboarding so nobody has to ask you for them twice. If we do not, the enquiry sits in our records until it is deleted on the schedule below.

We do not use anything you send us through a form to market at you. There is no newsletter and no drip sequence. The Meta pixel and Google Analytics described below are the one way your visit can feed an advertising audience, and they work from page views, not from what you type.

Under India’s Digital Personal Data Protection Act 2023 we process your data on the basis of your consent, and this page is the notice that consent is given against. Filling in a form and pressing send is the consent for that form. For advertising data in Beyond Ads HQ, a client sharing their ad account with our Business Manager, or our business owning the account, is the consent for that account. It covers the purposes described above and nothing wider.

You can withdraw that consent at any time by emailing hello@gobeyondads.com. Withdrawing is as easy as giving it, costs you nothing, and we will delete what we hold unless we are required by law to keep it. Withdrawal does not undo anything we lawfully did before you withdrew.

We advertise on Meta ourselves, including for hiring, and we want to know whether those ads work. So every page on this site loads the Meta pixel. It tells Meta which pages you viewed, when you viewed a role and when you submitted an application, along with your IP address, browser information and, if you are logged into Facebook or Instagram, who you are. Meta sets its own cookies (_fbp and, after clicking a Meta ad, _fbc) to do this, and uses the data under its own policy, including to build audiences we can advertise to.

We also load Google Analytics (GA4) on every page. It records which pages you visit, how you got here and roughly where you are, using cookies such as _ga; we use it to see which pages and campaigns bring people in. Google processes this under its own policy and may do so on servers outside India. We do not run Google Ads conversion tags.

What we do not do: there is no session recorder, no heatmap tool and no other third-party script. Neither the pixel nor the Google tags receive what you typed into a form, your resume, or anything from Hiring HQ; they see that a form was sent, not what was in it.

Opting out: a content blocker or your browser’s tracker blocking stops these tags loading; you can also manage how Meta uses your off-Meta activity in your Facebook or Instagram settings, and how Google uses yours at myadcenter.google.com or with Google’s Analytics opt-out browser add-on. Nothing on this site breaks if they are blocked.

The typeface is served from our own servers through Next.js font hosting, so loading a page here sends no request to any font provider.

When you submit the contact form, this site posts it to its own server, which forwards it to Beyond Ads HQ, the internal operations app we run at hq.gobeyondads.ai. A job application is forwarded the same way to Hiring HQ. In both cases your browser never talks to the internal app directly.

Inside Beyond Ads, access is limited to the founders and the small number of people who need it to respond to you. Outside Beyond Ads, two parties touch your data: the email provider that carries that notification, which processes it only to deliver the message and may do so on servers outside India; and, only if you use the chat assistant, the third-party AI service provider that generates its replies, as described in the assistant section above.

We do not sell your data, rent it, trade it or share what you send us with advertising platforms, data brokers or any other client. The Meta pixel and Google Analytics are the one exception on the advertising side, and they are limited to what the section above describes. The advertising data we read through Beyond Ads HQ, described below, moves the other way: it comes from the ad platforms into our own app, and it stays with the brand it belongs to. We would disclose it if a law or a court in India compelled us to, and we would tell you unless we were forbidden from doing so.

Beyond Ads HQ is the internal operating app we run at hq.gobeyondads.ai. It is not part of this website, it has no public sign-up, and only Beyond Ads team members can use it. We use it to run the advertising of the brands we work with, and that means reading data from the advertising platforms those brands run on, including Meta.

This section is a set of commitments. Where it says “we do not” or “we will”, that is the rule we hold ourselves to, and our client agreements say the same. When we use data from Meta we also follow Meta’s Platform Terms and Developer Policies; where those are stricter than this page, they apply.

Whose accounts we access, and on what authority

We access an ad account, Facebook Page or Instagram account only when our own business owns it, or when the client that owns it has shared it with the Beyond Ads Business Manager or otherwise authorised our access, under our client agreement with them. We do not access any account that has not been granted to us, and we do not try to reach data beyond what the client has granted.

For a client’s account, the client decides what we may access, we process the data on the client’s behalf and on its instructions, and the client can take that access back at any time. That authorisation, given under our client agreement, is the basis on which we process the account’s data. It covers the purposes listed below and nothing wider.

Exactly what we access

Through Meta’s Marketing API, and the equivalent tools of the other ad platforms a client uses, we read only these categories:

• Ad account information: the account name and ID, currency, time zone, spending limits and status.
• Campaign, ad set and ad structure and settings: objectives, budgets, bids, schedules, placements and the targeting settings configured in the account.
• Performance insights: spend, reach, impressions, clicks, conversions, costs and the other metrics the platform reports, in aggregated form.
• Creative assets and ad copy: the images, videos, headlines and text used in the client’s ads.
• Page and Instagram account data, only where the client grants it: the name and ID of the Page or account, and its posts and their engagement metrics, as needed to run and report on that client’s ads.

What we do not collect

Insights reach us only in aggregated form: the totals and counts the platform reports for an account, campaign, ad set or ad. We do not collect, and we will not ask for:

• Facebook or Instagram user profile data;
• anyone’s friends, followers lists or social connections;
• messages, including Page inbox and Instagram direct messages;
• personal data about the people who see, click or respond to ads. We never learn who they are;
• special category or sensitive data, such as health, religion, political views, sexual orientation, caste or ethnicity, or financial status.

What we use it for

Only these purposes, and only for the client the data belongs to:

• reporting on that client’s advertising performance;
• analysing what is and is not working in that client’s advertising;
• planning that client’s campaigns and budgets;
• pacing spend against that client’s budget;
• creating, editing and managing that client’s campaigns, ad sets and ads, at the client’s instruction.

What we will never do with it

We do not, and we will not:

• sell, license or rent it, or give it to anyone in exchange for anything;
• pass it to data brokers, ad networks or any other business that collects or resells data;
• use it to build, add to or enrich a profile of any person;
• use it to create audiences or to target ads anywhere outside that client’s own ad account;
• use one client’s data for another client, combine it with other clients’ data, or publish benchmarks or comparisons that reveal a client;
• use it for surveillance, or to track or monitor any individual;
• use it to make or inform decisions about anyone’s eligibility for housing, employment, credit or insurance, or to discriminate against anyone;
• use it to train general-purpose AI models.

Who inside Beyond Ads can see it

• Least privilege. Each team member gets only the access their role needs.
• Assigned staff only. Only the team members assigned to a brand can see that brand’s data.
• Named accounts. Everyone uses their own named account. There are no shared logins.
• Encryption. Access tokens and other credentials are encrypted at rest, and all data is encrypted in transit.
• Audit logs. We keep logs of who accessed the data and of every change made through HQ.
• Leavers and movers. When someone leaves Beyond Ads or moves off a brand, we remove their access to that brand’s data.

Companies that process it for us

A small number of service providers process this data on our behalf. Each one is under a written contract, bound to confidentiality and security obligations, and allowed to use the data only to provide its service to us. We stay responsible to our clients, and to Meta, for what they do with it.

• Amazon Web Services (Lightsail, Mumbai, India) hosts HQ and runs databases that store HQ’s data.
• ClickHouse Cloud (Mumbai, India) runs databases that store HQ’s data, including its reporting and analytics data.
• Windsor.ai is a data connector that brings reporting data from the ad platforms into HQ. It may process data outside India.
• Third-party AI service providers, acting as our processors under contract, analyse campaign data, ad copy and ad creative so our team can get answers, summaries and descriptions faster. They may be located outside India, which makes this a cross-border transfer. They process the data only to return results to us. Where their terms allow that commitment, they are contractually barred from using our data to train their models or for any purpose of their own. We send them only the minimum data each task needs.

Where it is stored, and transfers outside India

HQ’s data is stored in databases on AWS Lightsail and ClickHouse Cloud, both in Mumbai, India (ap-south-1). Some processing happens outside India: the data connector and our AI service providers may process data on servers in other countries. Every such transfer goes to a provider under contract, is limited to what the task needs, and is encrypted in transit. We do not transfer this data to any country the Government of India has restricted under the DPDP Act.

How long we keep it

• We keep a client’s advertising data only while our engagement with that client is active, and only as long as we need it for the purposes above.
• When the engagement ends or the client revokes our access, we delete that client’s data from our active systems within 30 days and from backups within 90 days. If the client asks us to do it sooner, we will.
• Access tokens are deleted immediately when access is revoked or the connection is disconnected.
• The only exception is a legal hold: if a law, court or regulator requires us to keep specific data, we keep only that data, only for as long as required, and use it for nothing else.

If there is a security incident

If we become aware of a security incident affecting this data, such as unauthorised access, loss or disclosure, we will contain and investigate it, and we will:

• notify the affected clients without undue delay, telling them what happened, what data was involved and what we are doing about it;
• notify Meta as its Platform Terms require, where Meta data is involved;
• notify the Data Protection Board of India, and the people affected, where the DPDP Act requires it.

Requests from Meta

We cooperate with Meta when it audits or checks how we use data from its platform, including its data use checkups, and we give it the information it asks for. If Meta or the client requires us to delete data we obtained from Meta, we delete it and confirm that in writing.

Requests from governments and law enforcement

We disclose client advertising data to a government body or law enforcement agency only when the law requires it. We review every request for legality, challenge requests that are overbroad or unlawful, and disclose only the minimum the request lawfully requires. Unless the law forbids it, we tell the client first.

How a client revokes our access

1. Open Meta Business Settings (business.facebook.com/settings) for the business that owns the ad account.
2. Go to Users > Partners, select Beyond Ads, and remove us as a partner, or remove only the ad accounts, Pages or Instagram accounts you want to take back.
3. If you gave our system user access to an asset directly, remove it from that asset’s assigned people and partners. If our app is connected to your business, remove it under Integrations > Connected apps.
4. Optionally, email hello@gobeyondads.com so we can confirm. Revoking access starts deletion on its own.

After you revoke access, HQ can no longer read the account, and we stop all processing of its data. Any access token for that connection is deleted immediately. The data we already hold is deleted from our active systems within 30 days and from backups within 90 days, as above, and we confirm in writing once it is done if you ask us to.

This is how to ask us to delete data, and what we commit to when you do. It applies to the advertising data in Beyond Ads HQ and to anything you sent us through this website.

Who can ask

• A client brand, for its advertising data in HQ. The request must come from someone authorised to act for the business that owns the ad account.
• Any individual, for the data they sent us through this website: contact form enquiries, chat conversations and job applications.

How to ask

Email hello@gobeyondads.com with the subject Data deletion request, and include:

• for a brand, the brand name and the ad account ID or IDs concerned; for an individual, the email address or phone number you used with us;
• the scope: everything we hold, or only specific data.

Checking it is you

Before we delete anything, we check the request is genuine. For an individual, we confirm it with the email address or phone number we already hold. For a brand, we confirm that the person asking has authority to act for the business that owns the ad account, for example with a known contact at the brand or an admin of its Meta Business Manager. We ask for no more than we need for this check and use it for nothing else.

How long it takes

• We confirm we have received your request within 7 days.
• We complete the deletion from our active systems within 30 days, and from backups within 90 days.
• When it is done, we confirm in writing what was deleted, and anything we kept and why.

What we may keep, and why

We keep only what a law requires us to keep, and only for as long as it requires it: invoices, billing and tax records under Indian tax and company law, the client agreement itself, and a record of your deletion request so we can show we acted on it. Anything we keep is used for that legal purpose alone and is deleted when the obligation ends.

Facebook Login

Nobody signs in to this website or to Beyond Ads HQ with Facebook, and no visitor or client uses Facebook Login. The only Facebook sign-in involved is by authorised Beyond Ads team members, who use it to authorise HQ’s access to the ad accounts described above. The access token that sign-in produces is stored encrypted, and we store no profile data beyond what is needed to identify the authorising team member’s connection.

If an enquiry does not lead to work, we delete it within twenty-four months, or straight away if you ask us to. If it does lead to work, we keep it for as long as you are a client and for the period afterwards that our tax and contractual obligations require, and then delete it. Job applications are kept while they are being considered and afterwards for internal review; ask and we purge them, including uploaded files, within 30 days.

The site is served over HTTPS, the handover to HQ happens server to server rather than in your browser, and access to the stored enquiries is restricted to named accounts. No system is perfect, but nothing here is left casually open.

Advertising data in Beyond Ads HQ follows the stricter schedule in the HQ section above: deleted from active systems within 30 days and from backups within 90 days after the engagement ends or access is revoked.

This site is aimed at people running brands and people looking for work. It is not directed at children, and we do not knowingly collect data from anyone under eighteen. If you believe a child has sent us something through a form, tell us and we will delete it.