Privacy Policy
Last updated: September 2026. AdFlow Manager is operated by BIKE DIGITAL LTDA.
Controller and contact
AdFlow Manager (the "Platform"), operated by BIKE DIGITAL LTDA, is the controller responsible for the data described here. Official privacy channel: privacidade@adflowmanager.tech.
Account data
When an account is created or granted, we process name, work email and the linked organization/company, to identify who operates the Platform.
Authentication data
We keep only what is needed to authenticate you: a password hash (never the plaintext password) and the session. Secrets never travel to the browser.
OAuth integrations (Meta, Google Ads, TikTok)
When you connect an ad account, we receive an OAuth authorization token with minimal scope. The token is encrypted on the server on the spot, never shown, logged or returned to the browser. In this phase we do not create, change or pause campaigns. The authorized scopes allow reading metrics and, when you enable conversion measurement, sending Google MEASUREMENT events (click identifier and value) — without your personal data (name/email/phone).
Advertising data and metrics
From connected platforms we read account metadata and performance metrics (impressions, clicks, cost, conversions and value) to measure and present results. We do not sell data.
Technical logs, session and cookies
We keep technical logs (timestamp, endpoint, status, IP) for security and diagnostics. Login uses a session token (bearer) stored locally in your browser; the server does NOT set session cookies. In the authenticated panel we do NOT use advertising trackers or third-party cookies.
Typographic fonts (Google Fonts)
The public site pages load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). To display the typography, your browser contacts Google and sends your IP address on page load — this happens regardless of the cookie banner. It sets no advertising cookies and does not identify you personally.
Measurement on public pages (Google and TikTok)
On our PUBLIC pages (the marketing site and the offer landings) — unlike the authenticated panel — we use Google (Google Ads) and TikTok measurement technologies to assess campaign performance (measurement and attribution). These load ONLY AFTER your consent in the cookie banner; if you decline, they are not loaded. After acceptance they may collect data such as cookies and your IP. On offer pages (e.g., /academia-portugues) we also record a TikTok content-view event, without personal data. Declining consent does not prevent browsing.
First-party measurement on landings
On the offer landing we also collect, on OUR own domain, usage metrics WITHOUT personal data: an anonymous session id, device type, scroll depth and engagement signals, sent to our server (/go/t1-telemetry). There is no name, email, phone or document; this first-party measurement does not depend on the cookie banner.
Ad click identifiers
When present in the URL, we forward Google ad click identifiers (gclid/wbraid/gbraid) to OUR outbound links to attribute the conversion to the right campaign. This forwarding is for measurement, is first-party (does not by itself trigger a third-party request) and happens regardless of consent; it does NOT include your name, email, phone or document.
Consent and EEA visitors
We apply consent signals (Consent Mode): by default third-party measurement (Google and TikTok) stays OFF until you accept, and declining keeps it off. Typographic fonts (Google Fonts) and first-party measurement (no personal data) do not depend on this banner. For visitors in the European Economic Area (EEA) additional obligations may apply, assessed case by case — this is not a blanket statement of GDPR compliance.
Purpose
We process data to provide the service, authenticate access, operate the integrations you authorized and measure media performance. Each purpose is explicit and independent.
Legal basis
Under Brazil’s LGPD, we process data based on contract/service performance, consent for each integration, and legitimate interest for security and fraud prevention.
Third-party checkout and affiliation
Offer pages take you to a THIRD-PARTY checkout (e.g., Hotmart), governed by the checkout’s own privacy policy — the purchase happens OFF our domain. We take part in affiliate programs/networks (e.g., Impact.com) to credit the referral; that process does not receive your personal data from us.
Sharing and subprocessors
We do not sell personal data. We share the minimum with infrastructure providers (hosting/database); with Google and TikTok for MEASUREMENT on public pages (after consent); and with Google Fonts (typography). We do NOT send conversions to Google today; if that measurement is enabled, it is limited to click identifier and value, without personal data. Conversion features that use contact data (e.g., email/phone protected by hashing) only operate if and when you explicitly enable them.
Security
Encryption of secrets at rest, HTTPS in transit, restricted access and an audit trail for sensitive operations. No system is fully immune; we work to reduce risk.
Retention and minimization
We retain data only as long as the purpose requires, with configurable purging. The panel favors aggregates; individual identification is an explicit, audited action.
International transfer
Infrastructure may involve providers outside your country. When it does, we apply safeguards consistent with applicable law.
Your rights (LGPD)
You may request confirmation, access, correction, portability, anonymization and deletion of your data, and revoke consents. Write to privacidade@adflowmanager.tech.
Revoking integrations
You can disconnect an integration at any time in the panel; revocation takes immediate effect and stops new reads. Tokens are invalidated.
Data deletion
To delete your account and associated personal data, request it at privacidade@adflowmanager.tech. Data required by law may be retained for the legal period.
Changes and contact
We may update this policy; material changes will be signaled. Questions: privacidade@adflowmanager.tech.
Ready to start?
Start in shadow mode: everything is simulated, nothing is published. You promote real execution when you decide.