Who operates pamon.ai
pamon.ai is operated by Totza Ltd. Privacy questions and requests can be sent to [email protected]. The organization using pamon.ai controls which data sources and accounts its authorized users connect. Any signed customer agreement defines the parties' additional responsibilities for customer data.
Information we process
We process information needed to run user accounts and the service, such as sign-in identity, assigned permissions, connection settings, selected source accounts, audit records, and reporting data. An organization may also connect other approved sources; those sources are governed by its configuration and agreement with pamon.ai.
For Google Ads, an authorized user grants permission on Google's consent screen. pamon.ai discovers the Google Ads accounts available to that user. After an organization administrator selects accounts, pamon.ai reads those accounts' currency and time zone and campaign-level daily cost, impressions, clicks, campaign identifiers, names, and status. pamon.ai receives OAuth credentials to maintain this connection. We do not receive the user's Google password.
How we use Google Ads data
We use selected Google Ads data to provide the organization's advertising and outcome reports, reconcile spend with its other approved data sources, show coverage and freshness, and diagnose connection failures. The connector sends read requests; it does not create, edit, or delete Google Ads resources. We do not sell Google Ads data or use it to target advertising to individuals.
Storage, access, and sharing
OAuth credentials are stored in a protected server-side secret store, not in the browser. Selected account references are protected, and campaign and daily reporting records are stored for authorized reports. Access is limited by organization and user permissions. Connections and permission changes are audited. Data is encrypted in transit.
Authorized users within the organization may view reports and may export them if the organization grants export permission. We use infrastructure providers, including Amazon Web Services and Cloudflare for the current pilot, to host and operate pamon.ai. We do not provide Google Ads data to unrelated third parties for their own marketing. We may disclose information when required by law or to protect the service and its users.
How we protect sensitive data
We treat Google Ads data, OAuth credentials, and account information as sensitive and protect them with the following safeguards:
- Encryption in transit. All traffic between browsers and pamon.ai, and between pamon.ai and Google APIs, uses HTTPS (TLS).
- Encryption at rest. The database and server storage reside on encrypted storage volumes. Google OAuth credentials are additionally encrypted by the application with AES-256-GCM before they are stored, using keys kept outside the database. Database backups are encrypted with AES-256.
- Credential handling. OAuth credentials are used only on the server to make read requests. They are never sent to the browser and are not written to logs.
- Access control and isolation. Each organization's data is isolated by database-enforced row-level security, and access within an organization is limited by role and permission. Users sign in with a password and a time-based one-time code (two-factor authentication).
- Least privilege. pamon.ai requests read-only access, reads only the accounts an administrator selects, and stores campaign-level reporting data rather than information about individual people. Server administration is restricted to a small number of authorized personnel using authenticated access.
- Auditing and monitoring. Connection changes, permission changes, and data-collection jobs are recorded in an audit log, and the service is monitored for failures.
Google API Services User Data Policy
pamon.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads data only to provide and improve the reporting features described in this policy. We do not use it for advertising, do not sell it, and do not allow people to read it except with the user's or organization's permission, for security purposes, to comply with applicable law, or as part of aggregated and anonymized operations.
Retention and disconnection
Disconnecting Google Ads stops future collection and removes or revokes pamon.ai's stored Google credential. Previously collected reporting records may remain while the organization uses pamon.ai or as required by its agreement or applicable law. A Google user can also revoke access in Google. The organization may request deletion of its reporting data by contacting us; we handle such requests under the applicable agreement and law. Copies in backups may remain until the applicable backup cycle ends.
Questions and requests
Contact [email protected] with questions or requests about information in pamon.ai. We may ask for information needed to verify the request and, for organization-controlled data, coordinate with that organization's administrator. We respond according to the applicable agreement and law. If this policy changes materially, we will update this page and its date and provide any notice required by law or agreement.