Privacy policy.

1. Who we are

Optimizly is a marketing growth platform operated by Multichoice Agency. We decide what happens with the data described below, which makes us the controller for it. You can reach us at hello@optimizly.io or through the contact page.

2. Who this policy is about

This policy covers two groups, and it matters which one you are in:

• Our customers — the people who hold an Optimizly account and connect their websites and advertising accounts to it.
• Visitors to a customer’s website — if you land here after visiting a site that uses Optimizly analytics, that site’s owner decides what is collected and why. We only process it on their behalf, so their privacy policy governs, not this one. Section 8 explains what that involves.

3. What we collect from customers

Account data

Your name, e-mail address and, if you sign in with Google, the profile picture Google returns. If you set a password we store only a hash of it, never the password itself.

Workspace data

The websites you register, the goals and settings you configure, and the content you create or schedule in the platform.

Connected platform data

When you connect Google, Meta, TikTok, LinkedIn or Pinterest, we store the access token the platform issues, its refresh token and expiry, the permissions you granted, and the name and identifier of the advertising account you linked. We then retrieve performance figures for that account: impressions, clicks, spend and conversions, at campaign, ad group and ad level.

We do not create, edit, pause or delete your campaigns, and we do not change budgets or bids. We read reporting and we send conversions back. Nothing else.

Billing data

If you hold a paid plan, our payment provider handles the transaction and we keep the plan, its status and the invoices. We never see or store your full card number.

Technical data

Server logs recording requests to our systems, kept to keep the service secure and working.

4. Why we use it, and on what basis

• To provide the service — creating your account, showing your dashboards, running the integrations you connected. Basis: performance of our contract with you.
• To keep it secure and working — logging, monitoring, debugging, preventing abuse. Basis: our legitimate interest in a service that stays available and safe.
• To bill you — for paid plans. Basis: contract, and the legal obligation to keep financial records.
• To contact you — service messages about your account. Basis: contract. Marketing e-mail only if you asked for it, and every one has an unsubscribe link.

5. How your platform tokens are protected

The tokens that let us read your advertising accounts are the most sensitive thing we hold, and we treat them that way. Every token is encrypted before it is written to our database, using AES-GCM envelope encryption. They are decrypted in memory only, only at the moment an API call is made. They are never written to our logs, never sent to your browser, and never returned by any part of our API.

All traffic runs over HTTPS. Access to your workspace is limited to its members, checked on every request. Calls between our own services carry a shared secret and are not reachable from the internet.

6. Who else processes it

We do not sell your data, we do not share it for anyone else’s advertising, and we do not combine data from different customers into shared datasets. The only third parties involved are the ones that help us run the service:

• hosting and database providers, which store the data
• the advertising and analytics platforms you chose to connect
• AI providers — OpenAI, Anthropic, Google and Perplexity — used only for the content and analysis features, and only with the text you submit to those features
• our payment provider, for paid plans
• our e-mail provider, for service messages

Each is bound by a processing agreement that allows them to act only on our instructions. We may also disclose data where the law requires it.

7. Where it is stored, and for how long

Data is stored on servers in the European Union. Where a provider processes data outside the EU, that transfer rests on the European Commission’s standard contractual clauses or an adequacy decision.

We keep your account data for as long as you have an account. Disconnect a platform and the tokens for that connection are deleted immediately. Delete your workspace and its connections, reporting data and content go with it. Financial records are kept for seven years because tax law requires it. Server logs are kept for a short period and then rotate out.

8. Analytics on a customer’s website

Our tracking script records page views, sessions and conversions on the sites our customers operate. It is first-party: the data goes to the site owner and to us as their processor, and is not shared with other customers or sold on. If you visited such a site and want to know what was recorded or want it erased, contact that site’s owner. They decide; we act on their instruction. Our own use of cookies on this website is described in the cookie policy.

9. Location data

Visit analytics resolve an approximate country, region and city from the visitor’s IP address. That lookup runs on our own servers against a local database, so no IP address is sent to a third party for it. The IP itself is not stored alongside the result. City-level accuracy is roughly 70–85% and should be read as an indication, not a fact about an individual.

The lookup uses the IP to City Lite database by DB-IP, licensed under CC BY 4.0.

10. Your rights

Under the GDPR you can ask us to:

• show you the data we hold about you
• correct it if it is wrong
• delete it
• limit what we do with it, or object to it
• hand it to you in a portable format

Write to hello@optimizly.io and we answer within one month. If you are not satisfied, you can complain to your national data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

11. Changes

When this policy changes we update the date at the top of this page. If a change materially affects you, we tell you before it takes effect.

12. Questions

Email hello@optimizly.io or use the contact page. A person replies.