Privacy Policy

This Privacy Policy describes how Bhindi Labs Pte. Ltd. (UEN: 202525565H), a company incorporated in the Republic of Singapore ("we," "us," "our"), collects, uses, and protects information from users of backroom (backroom.xyz), a Meta Ads analytics dashboard (the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

• Account Data: Your email address, used for sign-in via one-time passcode (OTP). We do not store passwords.
• Meta Ads Data: When you connect a Meta ad account, we access campaign, ad set, ad, and insights data through the Meta Graph API using an access token you provide. Access tokens are stored encrypted (AES-GCM) and used solely to fetch your advertising data.
• Chat Data: Conversations with Roi, the in-product AI analyst, are stored to preserve your chat history and are processed by Anthropic (Claude) to generate responses.
• Usage Data: Basic request metadata (IP address, user agent) processed transiently by our infrastructure provider for security and abuse prevention.

2. How We Use Information

• To authenticate you and maintain your session.
• To fetch and visualize your Meta advertising data.
• To provide AI-generated analysis of your advertising data via Roi.
• To send sign-in codes by email (via SendGrid).
• To maintain, secure, and improve the Service.

3. What We Do Not Do

• We do not sell your data. Ever.
• We do not use your advertising data to train AI models.
• We do not share your data with third parties except the processors listed below, strictly to operate the Service.

4. Third-Party Processors

• Cloudflare, Inc. — hosting, storage, and content delivery.
• Meta Platforms, Inc. — source of your advertising data via the Graph API.
• Anthropic, PBC — AI processing for Roi analyst responses.
• Twilio SendGrid — transactional email delivery (OTP codes).

5. Data Retention & Deletion

Account data, encrypted tokens, and chat history are retained while your account is active. You may request deletion of your account and all associated data at any time by emailing us; we will complete deletion within 30 days. Disconnecting an ad account removes its stored token.

6. Security

Meta access tokens are encrypted at rest with AES-GCM. Sessions use secure, HTTP-only cookies. Data in transit is protected with TLS. Access to production systems is restricted.

7. International Transfers

Data is processed on global infrastructure operated by the processors above. By using the Service you consent to processing outside your country of residence, subject to safeguards required by applicable law.

8. Your Rights

Subject to applicable law (including Singapore's PDPA and, where applicable, the GDPR), you may request access to, correction of, or deletion of your personal data, or withdraw consent to processing, by contacting us.

9. Changes

We may update this policy from time to time. Material changes will be reflected by the "Last Updated" date above. Continued use of the Service after changes constitutes acceptance.

10. Contact

Bhindi Labs Pte. Ltd. — hi@lauki.ai