Privacy Policy

This Privacy Policy explains what personal data 1000ants processes, why, on which legal basis, who receives it, how long we keep it and which rights you have. It follows the EU General Data Protection Regulation (Reg. (EU) 2016/679 — "GDPR") and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

1. Controller

The data controller responsible for processing your personal data is:

We have not appointed a Data Protection Officer, as none is required under Art. 37 GDPR.

2. What We Collect

1000ants is a marketing operating system. Customers connect their marketing accounts (Google Ads, Google Search Console, Meta Ads, Instagram, Facebook Pages, LinkedIn, TikTok Ads, Zoho CRM, WordPress). Our agents analyse the data and prepare changes; a change is made on a connected account only after a member of the customer's team has approved it.

2.1 Account & profile data

• Name, business email address, and chosen display name
• Workspace name, role, and account type (solo, agency, etc.)
• Login data (login times, IP address of the last login)

You need to provide your name and email address to create an account; without them we cannot provide the service. Connecting platforms and everything else is optional.

2.2 Access credentials for connected platforms

When you connect a platform, we receive and store the credentials that let us access it on your behalf (OAuth tokens; for WordPress an Application Password you create; for TikTok Ads a business access token). We use them only to access that platform and delete them when you disconnect it.

2.3 Data from your connected platforms

On your instruction, 1000ants retrieves data from the platforms you connect so our agents can analyse it. Depending on the platform, this may include:

• Google Ads: campaigns, ad groups, keywords, search terms, ads, assets, conversion actions, audience reports, Quality Score, click records (gclid), change history (including the email address of the person who made a change) and Google's recommendations.
• Google Search Console: search queries, pages, clicks, impressions, positions, property and sitemap details, and URL inspection results.
• Meta Ads (Facebook / Instagram): campaigns, ad sets, ads, creative details and performance metrics (impressions, clicks, spend, conversions, demographics).
• Instagram (professional accounts): your posts and their metrics, profile figures (username, follower and post counts), and the comments people write under your posts — see section 9b.
• Facebook Pages: your Page's posts and their metrics, Page figures, and the comments under your posts, including the commenter's name and Facebook ID — see section 9b.
• LinkedIn: posts you publish via 1000ants, the publishing member's ID and display name, and for LinkedIn Ads, campaigns and reporting metrics.
• TikTok Ads: campaigns, ad groups, ads and performance metrics.
• WordPress: posts, pages and categories of the site you connect; articles saved as drafts.
• Zoho CRM: deals, leads, accounts, contacts, the custom fields you map, status changes, deal amounts and dates.

We keep earlier states of this data so you can see how your accounts developed, within the limits in section 7.

This data may contain personal data of other people (e.g. CRM contacts, people who comment on your posts). You remain the controller of that data; 1000ants is your processor. For business customers, our Data Processing Agreement applies.

2.4 Product usage data

• Chat messages you send to 1000ants's agents and their answers
• Content and changes our agents prepare (e.g. ad campaigns, social posts, comment replies, email sequences, creative briefs)
• A record of agent runs, approvals and the changes made on connected accounts, including who approved them
• Information about your business that you provide or that we compile from your website and connected accounts
• Reports and other results our agents produce for you
• Records of your use of the service (e.g. which features were used, volume and cost)
• Documents you upload
• Research results about third parties from publicly available sources (e.g. competitors, publications, podcasts, journalists)
• Outreach emails you choose to send via your own connected mailbox, and the mailbox credentials you provide

2.5 Website & analytics data

• Server log files (IP address, browser, requested URL, referrer, time) when you visit 1000ants.ai or use the app
• Google Analytics measurements (only if you have consented via the cookie banner) — page-view, session and device data. You can change your choice at any time via "Cookie settings" in the footer.

3. How We Use Your Data

We use personal data to provide, maintain, secure and improve our services, in particular:

• To provide and maintain the service: sign you in, show your workspace and the data of your connected accounts, and run the agents you use on the data you have connected.
• To show and answer comments on your posts: comments on your Instagram and Facebook posts appear in your workspace, where you can read and answer them. Details in section 9b.
• To carry out changes you have approved: our agents prepare changes — e.g. ad campaigns, Meta campaigns, social posts, comment replies or edits to existing campaigns and content. Nothing is written to a connected account until a member of your team has approved that specific change; the approval is the last step.
• To secure and improve our services.
• To support and communicate with you: answer support requests and send service emails (e.g. account confirmation, security notices).
• To comply with legal obligations.

Google API data. 1000ants's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services. Some research features use YouTube API Services to read public channel and video information. By using these features you are also subject to the YouTube Terms of Service; Google's handling of data is described in the Google Privacy Policy. If you have granted an application access to your Google account, you can revoke it at any time at security.google.com/settings/security/permissions.

4. Lawful Basis (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b) GDPR): everything needed to provide and maintain 1000ants for you — your account, agent runs, the data of your connected accounts, carrying out changes you have approved, billing.
• Legitimate interest (Art. 6(1)(f) GDPR): server logs, security and abuse prevention, improving our services, research from public sources, and creating anonymised usage statistics when an account is deleted. Our interest is the secure and reliable operation and development of the service.
• Consent (Art. 6(1)(a) GDPR): Google Analytics and any other non-essential cookies. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c) GDPR): e.g. keeping accounting records.

For personal data of other people in your connected accounts (CRM contacts, people who comment on your posts), we act as your processor (Art. 28 GDPR) and process it only on your instruction; the lawful basis is yours as the controller.

We also use data in anonymised and aggregated form to provide and improve our services (Art. 6(1)(f) GDPR; our legitimate interest is a better service).

5. Recipients & Processors

We use the following providers, who process data on our behalf under data processing terms, or receive data as part of the platform you connect.

A current list of processors is available on request. We inform customers in advance of changes to it. For business customers, our Data Processing Agreement applies; the providers in this table are the sub-processors it authorises.

6. International Transfers

Some recipients in §5 are located outside the EU/EEA, mainly in the United States (and, for TikTok and depending on your Zoho data centre, Singapore, India, Australia, Japan or China). Such transfers are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified, on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). You can request a copy of these safeguards at the address in §1.

7. Retention

We keep personal data only as long as needed for its purpose:

• Account & profile data: as long as your account exists (see "Account deletion" below).
• Platform credentials: until you disconnect the platform or delete your account.
• Data from connected platforms, including its history: as long as your workspace exists, within the limits each platform sets (table below).
• Disconnecting an account: we stop accessing it at once. Where a platform requires it, the data from that account — including its history and the comments on your posts — is deleted within the period in the table below; if you reconnect the same account within that period, the data is kept. Data from platforms that do not require deletion stays with your workspace until you delete the workspace or your account. If you remove our access at the platform instead, the same rules apply from when we detect it. A deletion request through Meta (see our Data Deletion page) is carried out at once.
• Content you create in your workspace, such as settings, uploaded documents, results and drafts, stays until you delete the workspace or your account, also after you disconnect an account, unless a platform's terms require us to delete it earlier. So does the name and ID of an account you had connected.
• Account deletion: when you delete your account, all platform connections are disconnected at once and the deletion periods in the table start for their data. The rest of your account, including platform data no deletion period applies to, can be restored for 30 days by signing in again or by asking us (connections then have to be connected again); after that we delete all personal data and all workspace content. We may keep anonymised and aggregated information that can no longer be linked to you, your company or any person; for data from a connected platform, as far as that platform's terms allow.
• Server logs: 14 days.
• Google Analytics data: 14 months.
• Records we must keep by law (e.g. invoices and accounting records): for the statutory period; during that time they are used only for that purpose.

8. Your Rights

Under the GDPR you have the right to:

• Access (Art. 15): learn whether and which personal data we hold about you, and receive a copy.
• Rectification (Art. 16): have inaccurate or incomplete data corrected.
• Erasure (Art. 17): have your personal data deleted, subject to legal exceptions. See our Data Deletion page.
• Restriction of processing (Art. 18).
• Data portability (Art. 20): receive your data in a structured, machine-readable format.
• Object (Art. 21): object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests.
• Withdraw consent (Art. 7(3)): at any time, with effect for the future (e.g. analytics, via "Cookie settings").
• Lodge a complaint (Art. 77) with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You may also complain to the authority of your EU/EEA member state of residence, place of work or of the alleged infringement.

Where we process data as a processor for one of our customers (for example comments on a customer's posts, §9b), we forward your request to that customer and support them in answering it.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).

To exercise your rights, email contact@1000ants.ai. We respond within one month (Art. 12(3) GDPR).

9. Cookies & Analytics

• Strictly necessary cookies and storage: needed for the website and the app to work (e.g. sign-in session, security, workspace selection, remembering your cookie choice). They are set without consent because they are essential to the service you requested.
• Analytics cookies (Google Analytics): measure how visitors use 1000ants.ai. They are set only if you consent in our cookie banner. You can withdraw consent at any time via "Cookie settings" in the footer; the Google Analytics cookies are then deleted from your browser.

We use no other cookies, advertising pixels or tracking on 1000ants.ai.

9a. Data from Creator Profiles

We operate a directory of public profiles of content creators on social networks, which our customers use to find creators for business collaborations. If you run such a profile, we may process data from it. The controller is TwentyOne Monkeys OÜ (§1).

What data. Username and previous usernames, display name, profile description, follower, subscriber and post counts, contact details you have published yourself (such as an email address or phone number), linked websites and profiles, and topic keywords describing the profile. We do not process content that is not publicly accessible.

Source. Publicly accessible profiles on social networks and public interfaces of the platform operators.

Purpose and legal basis. To provide a searchable directory through which our customers can find creators for business collaborations. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in facilitating business collaborations between companies and professionally active creators.

Recipients. Customers of 1000ants, who see profiles as search results in our platform, and the AI model providers Anthropic, OpenAI, Google and Perplexity, which process profile data on our behalf to provide the directory. They are located in the United States (see §6 for the safeguards).

Retention. As long as the profile is publicly available. Once it is no longer reachable, we delete it.

Your rights. Access, rectification, erasure, restriction and data portability, and a complaint to a supervisory authority (§8). No automated decision within the meaning of Art. 22 GDPR is made.

9b. Comments on Our Customers' Posts

This section is for people who comment on Instagram or Facebook posts of a business that uses 1000ants.

Who is responsible. The business whose post you commented on is the controller. TwentyOne Monkeys OÜ processes your comment on that business's behalf, as its processor (Art. 28 GDPR).

What data and where it comes from. Your username (Instagram) or name (Facebook), your ID on that platform, the text and time of your comment, its likes and replies, and whether it is hidden — received from Meta's Instagram and Facebook Pages APIs through the business's own connection.

Purposes. To show the business its comments so it can read and answer them (a reply is sent only after a member of the business's team approves it), and to provide the analyses the business uses 1000ants for.

Recipients. Members of the business's 1000ants workspace, and the AI model providers listed in §5, which process the text on our behalf in the United States (§6).

Retention. As long as the business keeps its account connected and its workspace exists; deleted at our next sync after you delete the comment on Instagram or Facebook, within 30 days after the business disconnects the account, and at once after a deletion request through Meta.

Your rights. You can exercise your rights under §8 against the business whose post you commented on, or write to us at contact@1000ants.ai; we will forward your request to that business and support it in answering.

10. Children

1000ants is a service for businesses. It is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Security

We protect personal data with appropriate technical and organisational measures (Art. 32 GDPR).

12. Changes to This Policy

We update this Privacy Policy when the service or the law changes. We inform workspace owners of material changes by email or in the product. The "Last updated" date above shows the current version.

Contact

Questions about this Privacy Policy or how we handle your data: contact@1000ants.ai.
TwentyOne Monkeys OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia — registry code 17570457.