Privacy policy
This policy describes how CIGOS handles data today.
Who operates the service
CIGOS is operated by TOP TALENT JOINT STOCK COMPANY, business registration number 0317394402, Tầng 1, số 68 đường số 11, khu dân cư Cityland Park Hills, Phường Gò Vấp, Thành phố Hồ Chí Minh, Việt Nam.
Questions about this policy or about your data: privacy@cigos.app.
What this policy covers
This policy covers this website and the CIGOS service. The service is in early access and is opened team by team.
Data the service handles
| Category | What it contains | Where it comes from |
|---|---|---|
| Account data | Sign-in identifier, optional display name, hashed sign-in and session tokens, and a record of authorisation decisions. | You, or the owner of your workspace. |
| Advertising data | Spend, impressions, clicks, conversions and conversion values; names and settings of campaigns, ad sets or ad groups, ads and creatives; budgets; change history. | The Meta, Google Ads and TikTok ad accounts you connect. |
| Analytics data | Aggregated website and app measurements. | The Google Analytics or Firebase property you connect. |
| Business data | Revenue totals that you choose to supply. | You. |
| Creative files | Images, video and audio that you upload or generate in the product. | You. |
The service is built to read aggregated advertising and analytics figures, not information about individual people. Some free-text fields can contain personal information by accident: campaign and ad names, ad text and links, search queries from Search Console, and files you upload.
This website sets no cookies and runs no analytics. It is served by Cloudflare, which keeps technical logs of requests.
What the data is used for
- Showing advertising performance and checking the quality of the data behind it.
- Producing diagnoses and recommendations that a person reviews and approves.
- Keeping the service secure: sign-in, access roles and the authorisation record.
The data is not sold and is not used to advertise to anyone. The product has no function that creates, edits or pauses campaigns in your ad accounts.
Advertising and analytics platforms
Today, data from Meta, Google Ads, TikTok and Google Analytics reaches the service through a third-party data connector, which holds the access you grant. The service only reads data.
Direct connections to each platform are planned. Before one is offered, this section will state for that platform what is read, under which permission, and how the data may be used.
A direct connection to Meta (Facebook Login for Business) has been built but is not offered yet. Once offered, the service asks for ads_read (and public_profile, which Meta grants every app by default) to read the figures of the ad accounts you choose; it never creates, edits or deletes ads. The access token Meta issues is kept in a credential store on the server, never in the browser. To tie a connection to its workspace and to handle deletion requests, the service records the app-scoped Meta user id and the Meta business id. How to remove the app and request deletion: see the Data deletion page.
Google Ads and Google Analytics data reaches the service through the data connector. For the properties you authorise, Search Console and Google Analytics data can also be read directly from Google with read-only permissions (webmasters.readonly and analytics.readonly). The service never changes anything in those properties.
CIGOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to show you the figures and analysis of your own accounts in the service. It is not sold, not used for advertising, not used to build audiences, and not read by people unless you ask us to, for security, or to meet a legal obligation.
TikTok Ads data reaches the service through the data connector today. A direct connection through the TikTok API for Business is being prepared. Once offered, it asks only for the reporting permissions of the advertiser accounts you authorise, reads campaign performance figures, and never creates, edits or deletes ads. TikTok data is used in aggregated form to evaluate advertising performance; it is not used to build audiences or for retargeting. To withdraw access, remove the app in TikTok Ads Manager or write to us; deletion works as described on the Data deletion page.
You can withdraw access at any time in the settings of the platform or of the data connector where you granted it, and you can ask us to remove the connection.
Other companies that process data
| Company | Role | When |
|---|---|---|
| Windsor.ai | Data connector: holds the access grants and returns advertising and analytics data. | For every connected account today. |
| OpenAI | Writes explanations from the figures and names included in the request. | Only when the optional explanation feature is on. |
| Google (Gemini, Veo, Text-to-Speech) | Generates creative drafts from the inputs you provide. | Only when you use creative generation. |
| xAI | Generates creative drafts from the inputs you provide. | Only when you use creative generation. |
| Microsoft Azure Speech | Turns voice-over text into audio. | Only when you use voice-over generation. |
| Backblaze B2 | Stores encrypted database backups. | Always. |
| Cloudflare | Serves this website (Cloudflare Pages) and protects traffic to the service. | Always. |
| Hosting provider | Runs the server and the database. | Always. Akamai Technologies (Linode), servers in Singapore. |
The legal entity and the country of each company are listed on the Data processors page, linked at the bottom of every page.
Storage and retention
Data is stored in a database on a rented server. Location: Singapore.
Backups are encrypted before they leave the server. Backups on the server are kept for 14 days. Backups outside the server are kept according to the backup retention schedule: 30 days.
Automatic deletion after a fixed period is not built yet. Advertising and analytics data is kept for as long as your workspace is active. It is deleted when you ask, or within 30 days after you stop using the service. Sign-in and authorisation records are kept for up to 24 months, and messages sent to our support and privacy addresses for up to 24 months. Until automatic deletion is built, removal is done by the operator; see the data deletion page.
Your choices
- Ask what data the service holds for your workspace.
- Ask for a correction of account data.
- Ask for deletion of a connection, a workspace or your account.
- Withdraw the access you granted at the platform or the data connector.
Write to privacy@cigos.app. We answer within 30 days. No data protection officer has been appointed; this address is the contact for privacy matters.
Depending on where you live, the law may give you rights over your personal data, such as access, correction and deletion. We handle a request from anyone as described on this page.
Children
The service is made for businesses that run advertising. It is not directed to children.
Changes and effective date
Effective date: 15 November 2026. Later changes will be published on this page with a new date. The English text prevails; the Vietnamese text is a translation.