Privacy policy

AdHub is an advertising management platform operated by Tomorrow Labs, a business established in the Republic of South Africa. This policy applies to the AdHub console, the client portal, the free tools at /tools, and the emails and reports we send as part of the service.

It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA). Where this policy uses the words responsible party and operator, they carry POPIA’s meaning — roughly what other laws call a controller and a processor.

AdHub holds two different kinds of personal information and our responsibility is not the same for both. Blurring them would send people to the wrong party with their questions, so we set them out separately.

We collect what the service needs to work, and we have tried to make this table specific enough to be checkable rather than broad enough to cover anything.

We do not collect special personal information as POPIA defines it — health, biometrics, religious or political belief, race, trade union membership or criminal behaviour — and we ask you not to load it into free-text fields such as brief descriptions or task notes.

We do not sell personal information, and we do not share it with third parties for their own marketing.

• Performance of a contract — running your account, holding your briefs and campaigns, taking payment. Without this we cannot provide the service at all.
• Legitimate interests — security logging, abuse prevention, and the audit record of who changed what. We have weighed these against your interests and consider a tamper-evident record of budget changes to be squarely in the interests of everyone using the account.
• Consent — marketing email, and connecting a third-party platform. Both are opt-in and both can be withdrawn: unsubscribe, or disconnect the integration in your settings, which deletes the stored tokens.
• Legal obligation — tax and company records we are required to keep.

Most of the list below is under your control. AdHub talks to an advertising platform, a work tracker or a storage provider only once someone in your account connects it — an account that connects nothing has a much shorter list than this page might otherwise suggest.

We will also disclose personal information where the law requires it, or to establish or defend a legal claim. If we are compelled to hand over your data we will tell you, unless we are legally barred from doing so.

Your account data is stored on servers operated by our hosting provider. Several of the service providers listed above operate outside the Republic of South Africa — this is unavoidable for a product built on the advertising platforms’ own APIs, since those platforms are not hosted locally.

Section 72 of POPIA permits such transfers where the recipient is bound by a law, binding rules or a contract that upholds principles substantially similar to POPIA’s. We rely on contractual terms with each provider to meet that standard, and we do not transfer personal information to a provider that will not accept them.

• Traffic between you and the service is encrypted in transit (TLS).
• Passwords are stored as salted hashes. We cannot read your password, and neither can anyone who obtains the database.
• OAuth tokens for your connected platforms are encrypted at rest with a key held in the deployment environment, not in the database. A stolen database backup does not hand anyone your ad accounts.
• Two-factor authentication is available on every account and we recommend enabling it, particularly for owner and admin roles.
• Every account is scoped to its agency at the query level, and client users are additionally scoped to their own client record.
• Changes to budgets, campaign status and account settings are written to an audit log.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information we will notify you and the Information Regulator as section 22 of POPIA requires, in writing and as soon as reasonably possible after establishing the scope.

Retention periods are listed per category in clause 3. In general: we keep customer content until you delete it or for 90 days after an account closes, whichever comes first; security logs for 12 months; and financial records for the period our tax obligations require.

Deleting an integration deletes its stored tokens immediately. Deleting a brief, campaign or client removes it from the service; residual copies may persist in encrypted backups for up to 30 days before they age out.

If we are the responsible party for your information — see clause 2 — you have the following rights, and exercising them costs nothing and will not affect your account.

Write to privacy@tomorrowlabs.co.za. We will respond within 30 days. We may ask you to confirm your identity first — not as an obstacle, but because handing someone else’s data to whoever asks for it is the failure this whole policy exists to prevent.

AdHub is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child’s information has reached us, tell us and we will delete it.

The console sets a session cookie when you sign in, and a small number of preference cookies. These are strictly necessary — the service cannot keep you signed in without them — so they are not subject to an opt-in banner.

The public tool pages may display advertising from a third-party ad network, which sets its own cookies under its own policy. Advertising never appears inside the console.

When we change this policy we change the effective date at the top. For a change that materially reduces your rights or widens what we do with your information, we will tell account owners by email at least 14 days before it takes effect, rather than relying on you to re-read the page.

Questions, requests and complaints: privacy@tomorrowlabs.co.za.

You have the right to complain to the supervisory authority, and you do not have to raise it with us first: