Privacy Policy

Who we are

Clock Off is operated by Clock Off. We build and manage Facebook and Instagram advertising campaigns on behalf of the businesses who sign up for the service.

What we collect

• Your account — first name, last name and email address. Your password is stored only as a salted cryptographic hash; we never hold the password itself.
• Your business details — the business name, address, suburb, city, timezone, phone, website, logo, brand colour, advertising budget and target cost per lead that you enter during setup.
• Your Facebook connection — when you choose to connect Facebook, we receive an access token, your Facebook name and account id, and the list of advertising accounts and Pages you have access to. We store the ad account and Page you select.
• Advertising data — campaigns, ad performance and leads generated by the campaigns we run for you.

How your Facebook access is used

We request these permissions and use them only for the purpose described:

• ads_management, ads_read — to create, manage and report on advertising campaigns in the ad account you select.
• business_management — to identify which business your ad accounts and Pages belong to.
• pages_show_list, pages_manage_ads — to list your Pages so you can choose one, and to run ads from the Page you select.

We do not post to your Page, read your messages, or access personal data from your Facebook profile beyond your name and account id. Campaigns we create always start paused — nothing spends money until it is switched on.

How your access token is stored

Your Facebook access token is encrypted at rest using AES-256-GCM with a key held separately from the database. It is never sent to your browser and never shared with anyone outside the services listed below.

Who we share it with

We do not sell your data. We use these providers to run the service:

• Meta Platforms — to create and manage your advertising.
• Vercel — application hosting.
• Neon — database hosting.
• Resend — sending account emails such as confirmation and password resets.

Disconnecting and deletion

You can disconnect Facebook at any time from the setup screen, which deletes the stored access token immediately. You can also remove Clock Off from Facebook Settings → Business Integrations. To delete your account and all associated data, see our data deletion page or email hello@clockoff.ai.

Your rights

You may request a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Email hello@clockoff.ai and we will respond within 30 days.

Changes

If we change this policy we will update the date at the top of this page and, where the change is significant, tell you by email.