Privacy Policy

1. Overview

DEFY™ AdSymphony ("we", "our", or "us") is an advertising performance management platform operated by DEFY. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform at bidharmony.defycommerce.co and any associated services (collectively, the "Service").

By accessing or using the Service you agree to the practices described in this policy. If you disagree, please discontinue use of the Service.

2. Information We Collect

2.1 Account Information

When you register, we collect your email address, hashed password, assigned role (App Admin, Admin, or Manager), and platform access preferences. We do not store plaintext passwords.

2.2 Advertising Platform Data

If you connect a third-party advertising account (Amazon Ads, Meta Ads, Google Ads, or Shopify), we access performance metrics — such as spend, impressions, clicks, conversions, and revenue — through each platform's official API using OAuth tokens you explicitly authorize. We store aggregated metrics in our database to power dashboards and reporting.

2.3 Usage Data

We may log standard server-side information including IP addresses, browser type, pages visited, and timestamps for security monitoring and debugging purposes. This data is not sold or used for advertising.

2.4 Cookies & Local Storage

We use browser local storage to remember your active brand selection and session token. We do not use third-party tracking cookies or advertising pixels.

3. How We Use Your Information

• Authenticate users and maintain secure sessions
• Display advertising performance dashboards and reports
• Sync metrics from connected ad platforms on your behalf
• Enforce role-based access controls across brands
• Diagnose bugs, improve reliability, and enhance features
• Comply with legal obligations

We do not sell, rent, or share your data with third parties for marketing or advertising purposes.

4. Third-Party Integrations

The Service integrates with the following platforms via their official APIs. Your use of these integrations is also governed by each platform's own privacy policies:

• Amazon Advertising API — governed by Amazon's Privacy Notice
• Meta Ads API — governed by Meta's Privacy Policy
• Google Ads API — governed by Google's Privacy Policy
• Shopify Admin API — governed by Shopify's Privacy Policy

We request only the minimum API scopes required to read performance data. We do not create, modify, or delete ads on your behalf without explicit user action within the platform.

5. Data Storage & Security

Your data is stored in a PostgreSQL database hosted on Railway. We use industry-standard security practices including:

• Bcrypt password hashing (plaintext passwords are never stored)
• JWT-based session tokens with expiry
• HTTPS-only transport (TLS encryption in transit)
• Role-based access controls limiting data visibility
• Environment-variable-managed secrets (not hardcoded)

Network Security

Our application and database run on managed cloud infrastructure (Railway), which provides network-level protections, including:

• Provider-managed firewalls and edge protection, including DDoS mitigation, in front of the Service
• Network monitoring and intrusion detection at the infrastructure layer
• Network segmentation and isolation between services, with the database not exposed to the public internet
• Anti-malware protection and host firewalls on the endpoints used to administer the Service

No system is perfectly secure. If you discover a security vulnerability, please contact us immediately at the address below.

6. Incident Response

We maintain a documented Incident Response Plan governing how we detect, respond to, and report security incidents affecting personal data or data accessed through connected platform APIs (including Amazon Information). The plan is summarized below.

6.1 Roles & Responsibilities

A designated Security Lead owns the incident response process and is the primary point of contact for any suspected or confirmed incident. The Security Lead coordinates investigation, containment, and communication, and may engage engineering and infrastructure personnel as needed. Every team member is responsible for reporting a suspected incident to the Security Lead immediately upon discovery.

6.2 Detection & Internal Reporting

Suspected incidents may be identified through server and access logs, alerts from our cloud infrastructure provider, or reports from users or researchers. Any team member who becomes aware of a suspected incident must report it to the Security Lead within 24 hours of detection so that triage can begin.

6.3 Response Procedure

• Triage — assess scope, severity, and what data may be affected.
• Contain — revoke compromised credentials/tokens, isolate affected systems, and stop ongoing exposure.
• Eradicate — remove the root cause (e.g., patch, rotate secrets, close the vector).
• Recover — restore normal operation and verify integrity.
• Review — conduct a post-incident review and record lessons learned and remediations.

6.4 Notification

For any security incident involving Amazon Information, we will notify Amazon at security@amazon.com within 24 hours of confirming the incident. We will notify affected users, and any regulators, without undue delay and within the timeframes required by applicable law.

6.5 Plan Review & Testing

The Incident Response Plan is reviewed and tested at least once every six months, and is updated following any material incident or significant change to our systems, so that roles, contacts, and procedures remain current.

7. Access & Authentication

We enforce the following access and password controls on all accounts that can reach the Service's systems, administrative functions, source control, cloud infrastructure, or data (including personal data and data accessed through connected platform APIs):

• Password strength — a minimum of 12 characters including at least one special character; common or previously breached passwords are not permitted.
• Multi-Factor Authentication (MFA) — required on every account with access to production systems, source control, cloud infrastructure, or personal or Amazon Information.
• Rotation & expiration — passwords expire and are rotated at least once every 365 days, and immediately upon any suspected compromise or personnel change.
• Uniqueness — credentials are unique per person and per system, and are never shared between users or reused across systems.
• Secure storage — user passwords are stored only as bcrypt hashes, never in plaintext; application secrets and API credentials are held in environment variables and are never hardcoded or committed to source control.
• Least privilege — access to systems and data is granted based on job duties and revoked promptly when no longer required.

8. Data Retention

We retain your account data for as long as your account is active. Advertising metrics are retained to power historical reporting. You may request deletion of your account and associated data at any time by contacting us. Upon deletion, your data will be removed within 30 days except where retention is required by law.

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Revoke OAuth access to connected ad platforms at any time via those platforms
• Object to or restrict certain processing

To exercise any of these rights, contact us at the address in Section 11.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the revised policy. For material changes we will notify account holders via email where possible.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact: