Privacy Policy

Effective date: September 5, 2026

This Privacy Policy explains how the marketing agency Alerteon ("we," "the Company," "the Data Controller") collects, uses, stores, and protects personal data, including data obtained through the Meta Platform (Instagram), WhatsApp, and TikTok ad accounts (TikTok Marketing API), in connection with our targeted advertising services (TikTok Ads, Instagram) and our handling of inquiries from prospective clients.

1. Who is the Data Controller

The Data Controller for personal data is:

Registered name: Akmataliev Bek (sole proprietor / individual entrepreneur)
Address: 94 Molodoy Gvardii Blvd., Bishkek, Chuy Region, 720010, Kyrgyz Republic
Phone: +996557522395
Email for personal data inquiries: [email protected]
Website: https://alerteon.com
Taxpayer ID (PIN): 21793159100630
State registration number: 502920

For any questions regarding the processing of personal data, exercising your data subject rights, or requesting deletion of your data, contact us at [email protected]. We respond to such requests within 30 days.

2. Who this policy applies to

This policy applies to:

visitors of the website https://alerteon.com;
users who message us via Instagram Direct or comment on the business account @alerteon.target;
users who contact us via WhatsApp;
owners of TikTok ad accounts who have granted us access via the TikTok Marketing API;
clients and prospective clients (leads) whose data is entered into our CRM during consultation and sales.

3. What data we collect

3.1. Data obtained through Instagram (Meta Platform)

Through the official Instagram API and our business account @alerteon.target, we receive and process:

Instagram-scoped user ID;
username and profile name;
profile picture (avatar);
content of Instagram Direct conversations: text messages, attachments (images, files, stickers);
comments left on the business account's posts;
message metadata: timestamps, read status;
aggregated, non-individualized account statistics (insights): reach, engagement, and similar metrics.

We use this data solely to respond to user inquiries through our unified inbox (CRM) and to carry on subsequent communication about the service the user is interested in. We do not use data obtained through the Meta Platform for advertising targeting, and we do not share or sell it to advertising networks, data brokers, or other third parties for marketing purposes.

3.2. Data obtained through the TikTok Marketing API

In providing our ad-management service, and with your express permission (OAuth authorization of the ad account), we gain access to advertising-platform data. In particular, through the TikTok Marketing API we process:

identifiers and names of the ad account, campaigns, ad groups, and ads;
performance metrics: budget spend, impressions, clicks, CTR, CPC, conversions, and other reporting metrics;
campaign and ad group settings — for launching, managing, and optimizing advertising on your instructions.

This data belongs to the owner of the ad account (our client). We act as a processor operating on behalf of and in the interest of the client, and we use the data solely to provide the agreed services.

3.3. Data provided directly by the user

During a conversation (Instagram Direct, WhatsApp, or the website contact form), a user may voluntarily provide:

name;
phone number;
business niche/industry;
estimated advertising budget;
city.

3.4. Data from the WhatsApp channel

If a user contacts us via WhatsApp, we receive their phone number, WhatsApp profile name (if provided), and the content of the conversation — stored and protected under the same terms described below.

3.5. Technical data

When visiting the website, standard technical data may be collected (IP address, device and browser type, pages visited) via the web server and Cloudflare, to the extent necessary to operate and secure the site.

4. Legal bases and purposes of processing

We process personal data on the following legal bases:

Consent of the data subject — the user initiates the conversation via Instagram Direct, comments on a post, or messages us on WhatsApp, thereby consenting to the processing of the data provided for communication purposes;
Client instruction (OAuth authorization) — the owner of a TikTok ad account grants us access to the account's data so we can manage advertising on their behalf;
Necessity for pre-contractual relations and contract performance — processing lead data is necessary for consultation, preparation of a commercial proposal, and conclusion of a services agreement;
Legitimate interest of the Controller — maintaining CRM operations, analyzing inquiries, and improving service quality.

Purposes of processing:

receiving and handling inquiries from prospective clients;
providing consultations on targeted advertising services (TikTok Ads, Instagram);
setting up, managing, and optimizing TikTok Ads campaigns on the client's instructions;
preparing commercial proposals and closing deals;
maintaining client records and interaction history in the CRM;
fulfilling obligations under concluded service agreements.

5. How data obtained from advertising platforms is used

5.1. Meta (Instagram)

We explicitly state: data obtained through the Instagram API (messages, comments, profile information, insights) is used exclusively for the purposes stated above — handling inquiries and communicating with prospective and existing clients within our CRM. This data:

is not used to serve advertising to the user or to build advertising audiences;
is not shared with advertising networks, data brokers, or third-party analytics/marketing platforms;
is not sold;
is accessed only by agency staff who have a legitimate work-related need (CRM access) to handle the specific inquiry.

5.2. TikTok Marketing API

Data obtained through the TikTok Marketing API is used strictly for the purposes authorized by the owner of the ad account, and in accordance with the TikTok Developer Terms, TikTok Business Products (Ads) Terms, and applicable TikTok policies. We:

do not sell or transfer this data to third parties for advertising or other unrelated purposes;
do not use it to profile end users beyond the scope of managing the client's advertising;
restrict access to the data to staff who need it to provide the service;
terminate access to and delete the data obtained upon revocation of authorization or at the client's request.

6. Who we share data with

We disclose data only to the limited set of parties necessary to provide our services:

Meta Platforms, Inc. — as the source of data obtained through the Instagram API, in accordance with Meta's platform policies;
TikTok Ltd. — as the source of ad account data obtained through the TikTok Marketing API, in accordance with TikTok's platform policies;
Cloudflare — as our network infrastructure and traffic delivery provider (website protection, email routing via Cloudflare Email Routing); Cloudflare does not have access to the content of CRM conversations;
OpenAI — used as an AI assistant that helps agency staff draft responses to inquiries; fragments of a conversation may be processed to the extent necessary to generate a draft reply; OpenAI is not used to make decisions about users and does not share data with third parties for advertising purposes;
government authorities — only pursuant to a lawful request under the laws of the Kyrgyz Republic.

We do not share or sell personal data to advertising brokers, data aggregators, or other third parties for marketing purposes.

7. Data storage and retention

Data is stored on the agency's own server, hosted in a co-located data center in Bishkek, Kyrgyz Republic.
Access to the server and database is restricted to agency staff who need it for their work duties.
Data transmitted between the client, Meta/WhatsApp/TikTok servers, and our system is encrypted in transit (HTTPS/TLS).
The database is not publicly exposed and is not indexed by search engines.
Conversation history and lead records are retained in the CRM for up to 3 years from the date of last contact, after which the data is deleted or anonymized.
TikTok ad account data is retained for the duration of the agreement with the client and is deleted upon revocation of authorization or termination of the relationship.
Upon a user's request, data may be deleted earlier than this period (see Section 9).

8. Security measures

We apply the following safeguards:

access to the server and database restricted by individual staff accounts;
encryption of data in transit (HTTPS/TLS) between systems;
secure storage of ad account access tokens;
infrastructure hosted in a controlled data center with restricted physical access;
regular backups and access monitoring.

9. Your rights

As a data subject, you have the right to:

Access — obtain information about what data of yours we process;
Rectification — request correction of inaccurate data;
Erasure — request complete deletion of your data from our CRM and conversation history;
Withdraw consent or authorization — withdraw your consent to processing, or the TikTok ad account authorization, at any time, which stops further processing (except where processing is necessary to perform an existing contract or comply with legal obligations).

How to exercise your rights

Send a request to [email protected], specifying:

which right you wish to exercise;
your Instagram username, phone number, or TikTok ad account ID, so we can locate your record in our CRM.

We review and act on such requests within 30 days of receipt.

10. Data deletion

If you would like to delete your personal data from our system, a detailed step-by-step guide is available on a dedicated page:

→ https://alerteon.com/data-deletion

That page also describes exactly what is deleted, the timeframe, and how to receive confirmation of deletion.

11. Children

Our services are directed at businesses and entrepreneurs and are not intended for individuals under 18 years of age. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this policy from time to time. The current version is always available at https://alerteon.com/privacy. The effective date is stated at the top of this document.

13. Contact us

For any questions regarding this policy or the processing of personal data:

Email: [email protected]
Phone: +996557522395
Address: 94 Molodoy Gvardii Blvd., Bishkek, Chuy Region, 720010, Kyrgyz Republic