Privacy policy

AdHub is an advertising management platform operated by Tomorrow Labs, a business established in the Republic of South Africa. This policy applies to the AdHub console, the client portal, the free tools at /tools, and the emails and reports we send as part of the service.

It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA). Where this policy uses the words responsible party and operator, they carry POPIA’s meaning — roughly what other laws call a controller and a processor.

AdHub holds two different kinds of personal information and our responsibility is not the same for both. Blurring them would send people to the wrong party with their questions, so we set them out separately.

We collect what the service needs to work, and we have tried to make this table specific enough to be checkable rather than broad enough to cover anything.

We do not collect special personal information as POPIA defines it — health, biometrics, religious or political belief, race, trade union membership or criminal behaviour — and we ask you not to load it into free-text fields such as brief descriptions or task notes.

We do not sell personal information, and we do not share it with third parties for their own marketing.

• Performance of a contract — running your account, holding your briefs and campaigns, taking payment. Without this we cannot provide the service at all.
• Legitimate interests — security logging, abuse prevention, and the audit record of who changed what. We have weighed these against your interests and consider a tamper-evident record of budget changes to be squarely in the interests of everyone using the account.
• Consent — connecting a third-party platform, and advertising cookies on the free tools. Both are opt-in and both can be withdrawn: disconnect the integration in your settings, which deletes the stored tokens, or change your choice under “Cookie settings”.
• Legal obligation — tax and company records we are required to keep.

Most of the list below is under your control. AdHub talks to an advertising platform, a work tracker or a storage provider only once someone in your account connects it — an account that connects nothing has a much shorter list than this page might otherwise suggest. The providers every account uses are also kept on a separate sub-processors page, which we update before any change takes effect.

We will also disclose personal information where the law requires it, or to establish or defend a legal claim. If we are compelled to hand over your data we will tell you, unless we are legally barred from doing so.

Your account data is stored on servers operated by our hosting provider, named with its region on the sub-processors page. Several of the recipients listed above operate outside the Republic of South Africa, most of them in the USA: the “Where” column in clause 5 says which. This is unavoidable for a product built on the advertising platforms’ own APIs, since those platforms are not hosted locally.

Section 72 of POPIA allows personal information to be sent outside South Africa only where one of its grounds applies. We rely mainly on the first: the recipient is bound by a law, binding corporate rules or an agreement that gives an adequate level of protection, with principles substantially similar to POPIA’s, including for any onward transfer. We do not transfer personal information to a provider that will not accept such terms. Where a transfer happens because you chose it, such as connecting a platform or turning on Meta MCP, it is also necessary to give you the service you asked for.

[Placeholder wording, for counsel to confirm the s72 grounds relied on.]

• Traffic between you and the service is encrypted in transit (TLS).
• Passwords are stored as salted hashes. We cannot read your password, and neither can anyone who obtains the database.
• OAuth tokens for your connected platforms are encrypted at rest with a key held in the deployment environment, not in the database. A stolen database backup does not hand anyone your ad accounts.
• Two-factor authentication is available on every account and we recommend enabling it, particularly for owner and admin roles.
• Every account is scoped to its agency at the query level, and client users are additionally scoped to their own client record.
• Changes to budgets, campaign status and account settings are written to an audit log.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information we will notify you and the Information Regulator as section 22 of POPIA requires, in writing and as soon as reasonably possible after establishing the scope. We report to the Regulator through its eServices portal, the channel it requires for these notifications.

Retention periods are listed per category in clause 3. In general: we keep customer content until you delete it or for 90 days after an account closes, whichever comes first; figures from connected platforms for 25 months, counted from the date they are for rather than the date we fetched them; security logs for 12 months; and financial records for the period our tax obligations require. A job runs every night and deletes what has passed its period, so these are limits we enforce, not just intentions.

The one exception is a legal hold. If we must keep a workspace’s information as evidence — for a dispute, an investigation or a request we are bound to answer — we restrict it rather than delete it, as section 14(6) of POPIA allows: nothing of that workspace’s is deleted by the nightly job, and a closed workspace is not purged, until the hold is lifted. We lift it as soon as the reason for it has passed.

Deleting an integration deletes its stored tokens immediately. Deleting a brief, campaign or client removes it from the service. Deleted data stays in our encrypted backups for up to 35 days, then is gone. We do not restore it from a backup except to recover the service after a fault, and if we ever do, we delete it again.

If we are the responsible party for your information — see clause 2 — you have the following rights, and exercising them costs nothing and will not affect your account.

Write to privacy@tomorrowlabs.co.za. We will respond within 30 days. We may ask you to confirm your identity first — not as an obstacle, but because handing someone else’s data to whoever asks for it is the failure this whole policy exists to prevent.

AdHub is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child’s information has reached us, tell us and we will delete it.

The console sets a session cookie when you sign in, and a small number of preference cookies. These are strictly necessary — the service cannot keep you signed in without them — so they are not subject to an opt-in banner.

The public tool pages show one ad, served either by Carbon Ads (run by BuySellAds) or by Google AdSense. Advertising never appears inside the console.

• On your first visit to a public page we ask whether you agree to advertising cookies. You can change your choice at any time with the “Cookie settings” link in the footer.
• Carbon Ads loads only after you accept. Until then its script is not fetched at all, so Carbon receives nothing from your visit. Once loaded, it sees your IP address and the page you are on.
• Google AdSense ads are always non-personalised, whatever you choose. Until you accept, we also tell Google (through its Consent Mode) not to use cookies for ad storage; if you accept, Google may use cookies to measure ads and limit how often you see them, but not to personalise them.
• We record each choice so we can show what was agreed: a random identifier kept in your browser, the choice, the version of the question and the time. We do not record your IP address or browser details with it.

You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites, and manage personalised advertising from Google at myadcenter.google.com.

When we change this policy we change the effective date at the top. For a change that materially reduces your rights or widens what we do with your information, we will tell account owners by email at least 14 days before it takes effect, rather than relying on you to re-read the page.

Questions, requests and complaints: privacy@tomorrowlabs.co.za.

You have the right to complain to the supervisory authority, and you do not have to raise it with us first: