Privacy Policy

Who we are

Clock Off is operated by Clock Off AI. We build and manage Facebook and Instagram advertising campaigns on behalf of the businesses who sign up for the service.

What we collect

• Your account — first name, last name and email address. Your password is stored only as a salted cryptographic hash; we never hold the password itself.
• Your business details — the business name, address, suburb, city, timezone, phone, website, logo, brand colour, advertising budget and target cost per lead that you enter during setup.
• Your Facebook connection — when you choose to connect Facebook, we receive an access token, your Facebook name and account id, and the list of advertising accounts and Pages you have access to. We store the ad account and Page you select.
• Advertising data — campaigns, ad performance and leads generated by the campaigns we run for you.

How your Facebook access is used

We request these permissions — the exact list is shown on Facebook's own consent screen when you connect — and use them only for the purpose described:

• ads_management, ads_read — to create, manage and report on advertising campaigns in the ad account you select.
• business_management — to identify which business your ad accounts and Pages belong to.
• pages_show_list, pages_manage_ads — to list your Pages so you can choose one, and to run ads from the Page you select.
• leads_retrieval, pages_manage_metadata — to receive the leads your ad forms collect and deliver them into your CRM, instead of leaving them in Facebook's Leads Center.

We do not post to your Page, read your messages, or access personal data from your Facebook profile beyond your name and account id. Campaigns we create always start paused — nothing spends money until it is switched on.

How your access token is stored

Your Facebook access token is encrypted at rest using AES-256-GCM with a key held separately from the database. It is never sent to your browser and never shared with anyone outside the services listed below.

Who we share it with

We do not sell your data. We use these providers to run the service:

• Meta Platforms — to create and manage your advertising.
• Stripe — subscription payments. Your card details go directly to Stripe and never reach our servers.
• Clerk — sign-in, including "Continue with Google".
• Anthropic and OpenAI — generating ad copy and images. The business details you enter (never your Facebook token or card details) may be included in generation requests.
• Vercel — application hosting.
• Neon — database hosting.
• Resend — sending account emails such as confirmation and password resets.
• Our own client-management system — your business's name, contact details, chosen ad account and subscription status, so our team can support you.

Where your data lives, and for how long

Our database is hosted in Sydney, Australia, and the providers above process data in Australia and the United States — so your information leaves New Zealand. We only use providers who commit to safeguarding it to a standard comparable to New Zealand privacy law.

We keep your data while your account is active. When your account is deleted, the data described on the data deletion page is removed within 30 days; invoices and payment records are kept by Stripe as required by tax law.

Disconnecting and deletion

You can disconnect Facebook at any time from the setup screen, which deletes the stored access token immediately. You can also remove Clock Off from Facebook Settings → Business Integrations. To delete your account and all associated data, see our data deletion page or email info@audioconnect.co.nz.

Your rights

You may request a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Email info@audioconnect.co.nz and we will respond within 30 days.

Changes

If we change this policy we will update the date at the top of this page and, where the change is significant, tell you by email.