Privacy Policy – CustomIQ
Last updated: 15 May 2026
Who We Are
CustomIQ Inc. ("CustomIQ," "we," "us") provides an AI-powered marketing automation platform. Our services include analytics dashboards powered by Google Analytics 4, advertising campaign management through Google Ads, AI-generated content creation, and optional publishing to TikTok and Instagram.
Physical Address:
C/ Barbados 11, piso 1, pta. e
Alcalá de Henares, Madrid, 28805
Spain
Information We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account Data | Email, hashed password, time-zone | Create & secure your account |
| TikTok OAuth Data | TikTok user ID, access token, refresh token, avatar | Publish/manage TikTok videos at your request |
| Instagram OAuth Data | Instagram business/creator ID, access token, page ID | Publish/manage Instagram reels at your request |
| User Content | Uploaded/generated videos, captions, thumbnails | Enable editing & cross-posting |
| Usage Data | Log files, IP, device type, analytics events | Improve performance & detect abuse |
| Cookies / Local Storage | Session ID, CSRF token | Keep you signed in, prevent fraud |
| Google OAuth Data | Google account ID, email, access token, refresh token, granted scopes | Authenticate and maintain access to Google Analytics and Google Ads on your behalf |
| Google Analytics (GA4) Data | GA4 property IDs and metadata, account summaries, measurement IDs, data-stream metadata, report metrics (sessions, users, conversions, bounce rate, landing pages, campaigns) | Display analytics dashboards and AI-generated insights; create a GA4 property + data stream when your brand has none |
| Google Ads Data | Google Ads customer IDs, campaign / ad-group / ad metadata, conversion actions, performance metrics | Create, manage and optimize advertising campaigns at your explicit request |
Google API Services — Limited Use
CustomIQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We request the following Google OAuth scopes, each used only to deliver the specific feature listed:
- openid, email, profile, userinfo.email, userinfo.profile — identify the Google account you are connecting and display your name and email in CustomIQ.
- https://www.googleapis.com/auth/analytics.edit — read GA4 reports for your dashboards and, when your brand has no GA4 property yet, automatically create a property and web data stream under your existing Google Analytics account.
- https://www.googleapis.com/auth/analytics.readonly — read GA4 conversion and audience data referenced from the Google Ads configuration flow.
- https://www.googleapis.com/auth/adwords — manage your Google Ads campaigns (read account structure, create / pause / update campaigns and ad groups, retrieve performance metrics) at your explicit request.
Google user data is never:
- Used to train, fine-tune, or improve any generalized AI / ML model.
- Sold, rented, traded, or transferred to data brokers, advertisers, or any other third party for their own use.
- Used for purposes other than the user-facing features described in this policy.
- Read or accessed by humans, except (i) with your explicit consent to resolve a support issue, (ii) for security investigations to detect abuse, or (iii) where required by law.
How We Use Your Information
- To operate, maintain and improve CustomIQ
- To post content to TikTok and/or Instagram when you choose
- To provide support and respond to inquiries
- To comply with legal obligations and enforce our Terms
We process your TikTok, Instagram and Google data solely for the following purposes:
- Authenticating your connection to these platforms
- Reading Google Analytics reports and Google Ads performance data to render dashboards and AI-generated insights
- Creating Google Analytics properties / data streams and Google Ads campaigns at your explicit request
- Publishing content to TikTok / Instagram at your explicit request
- Managing and editing posts and campaigns you've created through our service
- Maintaining service continuity and preventing fraud
We do NOT use your TikTok, Instagram or Google data for:
- Building user profiles or databases beyond service functionality
- Training AI models (your content and data are never used for AI training without explicit opt-in consent)
- Marketing or advertising purposes that benefit CustomIQ rather than you
- Sharing with third parties except as explicitly stated in this policy
- Any purpose not directly related to providing our service
Legal Bases (GDPR)
We rely on contractual necessity to provide the service, legitimate interests for analytics & fraud prevention, and consent for connecting TikTok and Instagram accounts.
Sharing & Disclosure
We never sell your data. We share it only with:
- Supabase (our database and infrastructure provider) under a data processing agreement with SOC 2 Type 2 certification
- Cloud infrastructure & analytics vendors under data-processing agreements
- TikTok (ByteDance Ltd.) when you publish or manage videos through our Content Posting API. We share: TikTok user ID, video content, captions, hashtags, privacy settings, and posting metadata. TikTok's use of this data is governed by TikTok's Privacy Policy. We do not share your CustomIQ account data, email, or other personal information with TikTok beyond what's necessary for posting.
- Instagram (Meta Platforms, Inc.) when you publish or manage posts through Meta's Instagram Graph API. We share: Instagram business/creator ID, content, captions, and posting metadata. Instagram's use of this data is governed by Meta's Privacy Policy. We do not share your CustomIQ account data, email, or other personal information with Instagram beyond what's necessary for posting.
- Google LLC when you connect Google Analytics or Google Ads. We make authenticated requests on your behalf to
analyticsdata.googleapis.com,analyticsadmin.googleapis.comandgoogleads.googleapis.comusing your OAuth tokens. We do not send your other CustomIQ data (TikTok content, Instagram content, brand profile details, billing information) to Google. Google's use of data exchanged through these APIs is governed by the Google Privacy Policy. - AI sub-processors (Google Gemini, OpenAI) for content generation and insight summarization. We send only the minimum context required — typically anonymized aggregates of GA4 / Ads metrics, brand-profile text, or user prompts. We do not send Google OAuth tokens, raw user-identifying GA4 dimensions, or full Google Ads account credentials to these providers.
- Authorities when required by law or court order
Third-Party Platform Compliance
CustomIQ operates as an authorized third-party developer for TikTok, Instagram and Google:
- We comply with TikTok's Developer Terms of Service and API policies
- We comply with Meta's Platform Terms and Instagram Platform Policy
- We comply with the Google API Services User Data Policy (including its Limited Use requirements), the Google Ads API Terms of Service and the Google Analytics terms of use
- We implement technical, physical, and administrative safeguards in accordance with industry standards and platform requirements
- We are subject to audits by TikTok, Instagram and Google to ensure compliance
- We promptly address any security, privacy, or compliance concerns raised by these platforms
Retention & Deletion
Account data is retained while your account is active. TikTok, Instagram and Google OAuth tokens (along with their associated cached data) are deleted within 5 days of disconnection or account deletion. You can request deletion anytime via Settings → Delete account, through our Data Deletion Request page, or by emailing danielprudesa@customiq.ai.
How to Disconnect Your TikTok Account:
You can disconnect your TikTok account at any time by following these steps:
- Log into your CustomIQ account
- Navigate to Settings → Accounts
- Find your connected TikTok account
- Click the "Disconnect" button
Once disconnected, we will immediately stop accessing your TikTok data and will delete all TikTok access tokens, refresh tokens, and associated authentication data within 5 days. Any content you previously posted through our platform will remain on TikTok unless you delete it directly from TikTok.
How to Disconnect Your Instagram Account:
You can disconnect your Instagram account at any time by following these steps:
- Log into your CustomIQ account
- Navigate to Settings → Accounts
- Find your connected Instagram account
- Click the "Disconnect" button
Once disconnected, we will immediately stop accessing your Instagram data and will delete all Instagram access tokens, refresh tokens, and associated authentication data within 5 days. Any content you previously posted through our platform will remain on Instagram unless you delete it directly from Instagram.
How to Disconnect Your Google Account:
You can disconnect your Google Analytics or Google Ads account at any time by following these steps:
- Log into your CustomIQ account
- Navigate to Settings → Accounts
- Find your connected Google Analytics or Google Ads account
- Click the "Disconnect" button
Once disconnected, we will immediately stop calling Google APIs on your behalf and delete all Google access tokens, refresh tokens, and associated authentication data within 5 days. Cached GA4 reports and Google Ads metadata associated with the disconnected account are also purged within the same window. Any GA4 properties, data streams, or Google Ads campaigns we created at your request remain in your Google account; you can manage or delete them directly from Google.
You can additionally revoke CustomIQ's access from Google's side at any time at myaccount.google.com/permissions.
Security
Data Protection:
We partner with Supabase (SOC 2 Type 2 certified) for secure data storage and infrastructure. All data is protected with:
- TLS 1.2+ encryption in transit and AES-256 encryption at rest
- Row-Level Security (RLS) policies on our PostgreSQL database
- Daily automated backups with Point-in-Time Recovery
- TikTok, Instagram and Google OAuth tokens (access tokens and refresh tokens) encrypted at application level with PGP symmetric encryption before being written to the database
Access & Monitoring:
- Least-privilege access controls and role-based permissions
- Multi-factor authentication (MFA) for all internal team accounts
- Continuous security monitoring and audit logging
- API rate limiting and request validation
Security Testing:
- Regular vulnerability scanning and code security analysis
- Penetration testing with industry experts
- Third-party security audits for SOC 2 compliance
- Immediate security patch deployment when needed
Compliance:
We maintain security standards in accordance with TikTok Developer Terms, Meta Platform Terms, SOC 2 Type 2 certification, and GDPR requirements.
Incident Response:
In the event of a data breach affecting your account, we will notify you within 72 hours via email and immediately inform TikTok and Instagram if their systems are affected.
Your Security Actions:
If you suspect unauthorized access, immediately:
- Change your CustomIQ password
- Disconnect your TikTok and Instagram accounts in Settings
- Contact us at danielprudesa@customiq.ai
For security concerns or to report a vulnerability, email danielprudesa@customiq.ai.
User Control and Transparency
You have full awareness and control over your CustomIQ experience:
- Explicit Publishing: We never post content to TikTok or Instagram without your explicit action
- Preview Before Posting: You can review all content, captions, and privacy settings before publishing to TikTok or Instagram
- Content Ownership: You retain all rights to your content; we only process it to provide the service
- Platform Independence: Content created in CustomIQ can be exported and used elsewhere
- No Unauthorized Access: We only access your TikTok and Instagram accounts after you complete OAuth authorization
- Audit Trail: You can review your posting history to both TikTok and Instagram in your account dashboard
International Transfers
Your data may be processed in:
- European Union (primary data center location)
- United States (cloud infrastructure partners)
We ensure adequate data protection through:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements with all cloud service providers
- Compliance with GDPR for EU users, CCPA for California users
TikTok (ByteDance) and Instagram (Meta Platforms, Inc.) may process your data internationally according to their respective privacy policies when you use their publishing features.
Your Rights
Depending on your location, you may have rights to access, correct, delete or port your personal data, object to certain processing, or lodge a complaint with a supervisory authority.
Your Rights Regarding TikTok Data:
When you connect your TikTok account to CustomIQ, you retain full control over your data:
- Access: You can request a copy of all TikTok data we store about you by emailing danielprudesa@customiq.ai
- Revoke Access: You can disconnect your TikTok account at any time through Settings → Accounts, which immediately revokes our access to your TikTok data
- Delete Data: You can request deletion of all your TikTok-related data by disconnecting your account, using our Data Deletion Request page, or contacting us directly
- Control Publishing: We only post to TikTok when you explicitly choose to do so. You maintain full control over what content is published
- Data Portability: You can export your content created in CustomIQ at any time before posting to TikTok
- TikTok's Rights: You can also manage CustomIQ's access to your TikTok account directly through TikTok's settings at tiktok.com → Settings and Privacy → Security and Login → Apps and Websites
For any questions or to exercise these rights, contact us at danielprudesa@customiq.ai.
Your Rights Regarding Google Data (Google Analytics & Google Ads):
When you connect your Google account to CustomIQ, you retain full control over your data:
- Access: You can request a copy of all Google-related data we store about you by emailing danielprudesa@customiq.ai
- Revoke Access: You can disconnect your Google account at any time through Settings → Accounts, or revoke CustomIQ's access from Google's side at myaccount.google.com/permissions
- Delete Data: You can request deletion of all your Google-related data by disconnecting your account, using our Data Deletion Request page, or contacting us directly. Cached GA4 reports and Google Ads metadata are deleted within 5 days
- Control Over Changes: We only create GA4 properties / data streams or modify Google Ads campaigns when you explicitly request it. We do not modify properties, streams, or campaigns that were created outside CustomIQ without your action
- Limited Use Compliance: Your Google data is never used to train AI models, sold or transferred to third parties for their own use, or accessed by humans except as described in this policy
For any questions or to exercise these rights, contact us at danielprudesa@customiq.ai.
Your Rights Regarding Instagram Data:
When you connect your Instagram account to CustomIQ, you retain full control over your data:
- Access: You can request a copy of all Instagram data we store about you by emailing danielprudesa@customiq.ai
- Revoke Access: You can disconnect your Instagram account at any time through Settings → Accounts, which immediately revokes our access to your Instagram data
- Delete Data: You can request deletion of all your Instagram-related data by disconnecting your account, using our Data Deletion Request page, or contacting us directly
- Control Publishing: We only post to Instagram when you explicitly choose to do so. You maintain full control over what content is published
- Data Portability: You can export your content created in CustomIQ at any time before posting to Instagram
- Instagram's Rights: You can also manage CustomIQ's access to your Instagram account directly through Instagram's settings at instagram.com → Settings → Security → Apps and Websites
For any questions or to exercise these rights, contact us at danielprudesa@customiq.ai.
Children and Parental Consent
CustomIQ is not directed to children under 13, and we do not knowingly collect data from children under 13.
For Users Ages 13-17:
- If you are between 13 and 17 years old, you represent that a parent or legal guardian has reviewed and agreed to this Privacy Policy and our Terms of Service
- Parents or guardians can request access to, correction of, or deletion of their child's data by contacting danielprudesa@customiq.ai
- We will verify parental identity before processing such requests
If we discover we have collected data from a child under 13, we will:
- Delete the account immediately
- Delete all associated personal data
- Notify the email address associated with the account (if provided)
To report an account belonging to a child under 13, contact danielprudesa@customiq.ai immediately.
Cookies and Tracking Technologies
We use the following cookies and tracking technologies:
- Essential Cookies: Session management, authentication, and CSRF protection (required for service functionality)
- Analytics Cookies: Usage patterns and feature performance (you can opt out in Settings)
- No Third-Party Advertising Cookies: We do not use cookies for advertising purposes or share cookie data with TikTok or Instagram
Cookie Duration:
- Session cookies: Deleted when you close your browser
- Persistent cookies: Stored for up to 90 days
You can manage cookie preferences in your browser settings, but disabling essential cookies may limit service functionality.
Data Breach and Incident Response
In the unlikely event of a data breach:
- We will notify affected users within 72 hours via email
- We will report the breach to relevant supervisory authorities as required by law
- We will provide details about what data was affected and what actions you should take
- We will take immediate steps to secure systems and prevent further unauthorized access
- We will immediately notify TikTok and Instagram if their API credentials or user data is compromised
If you suspect unauthorized access to your CustomIQ account, immediately:
- Change your CustomIQ password
- Disconnect your TikTok and Instagram accounts
- Contact us at danielprudesa@customiq.ai
Changes to this Policy
We'll post any changes here and update the "Last updated" date. Significant changes will be emailed to registered users at least 7 days in advance.
Contact
For privacy questions, contact danielprudesa@customiq.ai or write to the address above.