Privacy Policy
DVA Ads connects your advertising accounts to Claude, an AI assistant, so you can analyse performance in plain language and make changes that a human always approves. This policy explains exactly what we collect, where it goes, and how to get rid of it.
1. Who we are
DVA Ads is operated by Digital Vibes Asia Sdn Bhd, a company registered in Malaysia, at 2A-5 (Fourth Floor), Jalan SS 6/6, Kelana Jaya, 47301 Petaling Jaya, Selangor, Malaysia. We are the data controller for the information described below. Contact us at markjackson@digitalvibesasia.com.
2. Information we collect
Account and workspace information
When you create an account we collect your email address and a password, which is hashed and stored by our authentication provider — we never see or store your password in readable form. We also store the workspaces you belong to, your role in each (owner, admin, approver or analyst), and any invitations you send or receive.
Advertising account credentials
When you connect an advertising account, the platform gives us an OAuth access token and refresh token scoped to the permissions you granted. We store these tokens encrypted with AES-256-GCM before they touch our database, along with non-secret metadata: the platform, the advertising account ID and name, the scopes granted, and the token expiry. We never receive or store your password for Google, Meta, TikTok, LinkedIn or any other platform.
Advertising performance data
When you or Ezra asks a question, we call the advertising platform's API and pass the results straight back to you. We do not store your campaign metrics — no spend, impressions, clicks, conversions or audience data is written to our database. It passes through our servers in memory and is gone when the request ends.
Operational records
We do keep records of what was done in your workspace:
- Staged changes — when a change is proposed (pausing a campaign, adjusting a budget or bid), we store a description of it and a before/after comparison until you approve or reject it.
- Audit log — who did what and when: connections created, changes staged, approved or rejected.
- Usage counts — the number of tool calls and applied changes per workspace, used for plan limits and billing.
Connector authorisation
If you add DVA Ads to Claude as a connector, we register that client and issue access and refresh tokens. Those tokens are stored only as SHA-256 hashes — we cannot read them back, only verify them.
Technical data
Our hosting provider records standard server logs for security and reliability, which include your IP address, browser user-agent string, the pages requested and timestamps.
3. How we use it
- To authenticate you and show you the workspaces you belong to.
- To read your advertising data when you ask for it, and to stage changes you request.
- To enforce the approval gate and keep an audit trail of every consequential action.
- To meter usage against your plan.
- To keep the service secure, diagnose faults and prevent abuse.
We do not use your data to build advertising profiles, and we do not make automated changes to your advertising accounts. Every change requires a human to approve it.
4. AI processing
This is the part most policies bury, so we will be direct: when you use the in-app assistant, or connect this service to Claude, the advertising data needed to answer your question is sent to Anthropic, the provider of Claude, for processing.
That transfer only happens when you ask a question. Anthropic states that data submitted through its API is not used to train its models. We do not send your platform credentials to Anthropic — only the results of the queries we run on your behalf, and the messages you write. If you would rather no data reach an AI provider, do not use the assistant or the Claude connector; the rest of the service will not send anything.
5. Who we share it with
We do not sell your data, and we do not share it for advertising. We rely on the following processors:
| Provider | Purpose | What it receives |
|---|---|---|
| Vercel Inc. | Application hosting | Request logs, IP address, user-agent |
| Supabase | Database and authentication | Account, workspace, encrypted tokens, audit log |
| Anthropic PBC | AI processing (only when you use Ezra or the connector) | Your messages and the query results they require |
| Advertising platforms you connect | Reading data and applying approved changes | API requests made with the token you granted |
We may also disclose information where required by law, or to protect the rights, safety or property of Digital Vibes Asia Sdn Bhd or others.
6. Cookies
We use two cookies and no others. One holds your authentication session; the other, dva_org, remembers which workspace you are currently viewing. We do not use advertising cookies, analytics cookies or third-party trackers on this service.
7. Security
- All traffic is encrypted in transit with TLS.
- Advertising platform tokens are encrypted at rest with AES-256-GCM.
- Connector tokens are stored as SHA-256 hashes and are never recoverable.
- Database access is restricted to the application's server-side code.
- Changes to your advertising accounts are staged and require explicit human approval, which limits the damage any single mistake or compromise can cause.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately at markjackson@digitalvibesasia.com.
8. How long we keep it
- Platform tokens — deleted immediately when you disconnect the account, or when we delete your workspace at your request.
- Account and workspace data — for as long as your account exists.
- Audit log — retained for up to 24 months for security and accountability, then deleted.
- Usage counts — retained for billing and statutory record-keeping.
- Advertising performance data — never stored, so there is nothing to retain.
9. Your rights
Under the Malaysian Personal Data Protection Act 2010, and equivalent laws that may apply to you, you may request access to the personal data we hold about you, ask us to correct it, limit how we process it, or withdraw your consent. Withdrawing consent to process your advertising credentials means disconnecting the account, which you can do yourself at any time.
To exercise any of these rights, email markjackson@digitalvibesasia.com. We will respond within 30 days.
10. Deleting your data
You can disconnect any advertising account yourself, at any time, from the Connections page — this immediately destroys the stored tokens. Deleting an entire workspace or account is done by emailing us. Full instructions — including how to remove data obtained through Meta, Google, TikTok or LinkedIn — are on our data deletion page.
11. International transfers
Our providers operate globally, so your data may be processed outside Malaysia, including in the United States and the European Union. We rely on our providers' contractual safeguards for those transfers.
12. Children
This service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
13. Changes to this policy
If we change this policy in a way that materially affects you, we will update the effective date above and notify workspace owners by email before the change takes effect.
14. Contact
Digital Vibes Asia Sdn Bhd
2A-5 (Fourth Floor), Jalan SS 6/6, Kelana Jaya, 47301 Petaling Jaya, Selangor, Malaysia
markjackson@digitalvibesasia.com