Privacy

What OobiMax does

OobiMax is an approval-first performance marketing system. It connects to advertising and measurement platforms, uses relevant cited public market context, maintains one current Campaign Optimization Plan for every active campaign, executes only approved supported actions, and learns from later outcomes. Earlier recommendation and delivery records remain available as history during migration.

Data we process

Depending on what a workspace connects, OobiMax may process:

• workspace, user, brand, source, account, delivery, automation, and settings records
• Google Ads account, campaign, ad group, asset, keyword, search term, audience, budget, performance, and approved-action data
• Meta Ads business, ad account, campaign, ad set, ad, creative, audience, budget, performance, and approved-action data
• TikTok Ads advertiser, campaign, ad group, ad, creative, audience, budget, performance, policy, aggregate Pixel health, and approved-action data when the connected permissions provide it
• GA4 and Search Console read-only measurement evidence mapped to a brand, plus provider-specific aggregate Meta Pixel/CAPI and TikTok Pixel health
• bounded public Google News RSS and Google Trends RSS items derived only from public Brand Profile fields, with citations, timestamps, and context-only labels
• Slack workspace/channel and Telegram chat/connect metadata plus earlier recommendation messages needed for historical delivery and interactive approval
• sanitized exact-campaign context used by the managed Oobi Campaign Agent and, only through explicitly created scoped Agent Access, a customer-owned campaign agent
• Agent Access grant metadata, token hash and display prefix, agent run/proposal provenance, Oobi adjudication, and generalized capability-gap records; raw Agent Access tokens are shown once and are not retained
• owner-authorized workspace-strategy proposals, including a proposed change to one Brand Profile field or a campaign-planning draft assembled from bounded profile, account, campaign, and approved-creative context
• audit logs, run logs, plan snapshots, change sets, delivery records, earlier recommendation decisions, retry records, and support context needed to operate the service safely

How we use data

OobiMax uses connected data only to provide and improve the user-facing OobiMax workspace experience.

• discover reachable accounts and map brands to the right accounts
• collect and analyze campaign performance and account state
• build and refresh a complete Campaign Optimization Plan for one exact campaign
• validate and adjudicate managed or customer-agent proposals without granting those agents provider-write, approval, launch, or spend authority
• let an authorized owner review, apply, or dismiss a proposed Brand Profile amendment and open a campaign proposal as an uncreated Campaign Builder draft
• show the plan, its evidence boundary, uncertainty, expected effect, risk, and next review in the Dashboard
• execute only actions that an authorized operator approves
• track execution status, failed-action recovery, and post-action learning
• protect the service through audit logs, abuse prevention, troubleshooting, and security monitoring

Google API data

OobiMax uses Google Ads OAuth for account discovery, campaign collection, campaign-plan analysis, and approved Google Ads actions through the mapped source. GA4 and Search Console use a separate read-only Google Measurement connection for brand-scoped evidence. Google Auth Platform branding is verified for OobiMax, and Google Data Access verification for the Google Ads scope is approved.

OobiMax's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• we do not sell Google user data
• we do not use Google user data for unrelated advertising, retargeting, credit decisions, or data brokerage
• we do not transfer Google user data to third parties except as needed to provide OobiMax features, comply with law, maintain security, or with the workspace's direction

Sensitive data protection

OobiMax protects sensitive connected-platform data, including Google API data, with technical and operational controls designed to reduce unauthorized access, loss, alteration, or disclosure.

• production traffic is served over HTTPS/TLS so data is protected in transit
• Google OAuth tokens, platform integration secrets, webhook secrets, and OobiMax-managed AI credentials are stored as encrypted secret payloads where OobiMax stores them
• workspace data is isolated by tenant, and Dashboard access uses authenticated sessions plus workspace permission checks
• connected-platform actions require an authorized operator approval before OobiMax executes supported changes
• important source, mapping, campaign-plan, change-set, legacy recommendation, delivery, execution, billing, and admin actions are recorded in audit logs
• Retired Slack and Telegram recommendation callbacks fail closed so old messages cannot trigger a current action
• diagnostic, support, and audit surfaces redact token-like secrets before display or export where those surfaces include integration context

Sharing and processors

OobiMax does not sell workspace data. We share data only when needed to operate the product, when a workspace selects a destination, when required by law, or when needed for security and support.

• Earlier Slack and Telegram recommendation messages are historical records only; current Campaign Plans stay inside OobiMax
• Oobi-managed AI providers may receive sanitized exact-campaign advisory context only to provide OobiMax features
• a customer-owned agent receives only bounded Google/Meta/TikTok Oobi campaign intelligence, brands or exact campaigns, and read/propose scopes an authorized owner/admin explicitly grants with recorded consent through Agent Access; Oobi does not send provider credentials, provider API access, approval, or execution authority
• when workspace-strategy scopes are explicitly granted, a customer-owned agent may also receive bounded Brand Profile, mapped-account, current-campaign, approved-creative, and prior-build context and submit owner-reviewed profile or campaign-planning proposals; raw provider payloads, credentials, and user-level events remain excluded
• cloud infrastructure, email, monitoring, and support processors may handle limited operational data needed to run OobiMax
• when a visitor submits a public beta request and gives consent, OobiMax may use submitted contact information such as email address for privacy-safe advertising measurement, including hashed enhanced conversions handled by Google on OobiMax's behalf
• Google, Meta, Slack, Telegram, AI providers, and infrastructure processors remain separate third-party platforms with their own terms and controls

Public website and ad measurement

OobiMax uses first-party analytics and advertising measurement on the public website to understand whether campaigns lead to legitimate beta requests.

When you submit a beta request and accept the form consent, OobiMax may share hashed first-party contact information, such as your email address, with Google only for conversion measurement and attribution. OobiMax does not sell this information or use it to approve campaign actions.

• beta request form data is used to respond to the request and evaluate beta fit
• ad measurement helps OobiMax understand which campaigns produce real beta requests
• measurement data remains separate from OobiMax's approval-first campaign execution model

Security and workspace isolation

Workspace data is scoped by tenant. A workspace should not see another workspace's sources, accounts, mappings, plans, change sets, earlier recommendations, delivery records, or settings.

• integration secrets and OobiMax-managed AI credentials are encrypted
• Dashboard sessions use secure production cookie behavior
• important operator and Agent Access actions are audited
• Agent Access is expiring, revocable, least-privilege, rate-limited, and stores only a token hash plus non-secret display prefix
• Retired Slack and Telegram callbacks fail closed

Retention and deletion

OobiMax keeps workspace records for as long as needed to provide the service, support the workspace, preserve audit history, maintain security, comply with legal obligations, or protect backup integrity.

Workspace owners can request deletion through the Data Deletion page. You can also revoke Oobi Agent Access inside Security and revoke OobiMax access inside Google, Meta, Slack, Telegram, or another connected platform at any time.

Contact

For privacy questions or requests, email support@oobimax.io.