Privacy Policy

Last updated October 22, 2026

ClientReports ("the Service") is operated by InnovativeLabs ("we", "us"). This policy explains what information the Service collects, how we use it, and the choices you have.

1. Information we collect

  • Account information: name, email address and a securely hashed password for agency users and client users.
  • Agency and client details: business names, websites, logos, brand colors and notes that agencies add to reports.
  • Connected account data (Google): when you connect a Google account, you choose to grant the permissions below. We use each one only to read reporting data. We never create, change or delete anything in your Google accounts.
    • openid and email: your Google account email address, so we can show which account is connected.
    • analytics.readonly (Google Analytics): property names and traffic metrics such as sessions, users, conversions and top page paths.
    • webmasters.readonly (Google Search Console): site names and search metrics such as clicks, impressions, search queries and average position.
    • adwords (Google Ads): ad account names and campaign performance such as spend, clicks, impressions and conversions. Google offers this permission only as one scope; we use it read-only and never change campaigns, budgets or billing.
    • business.manage (Google Business Profile): location names and performance metrics such as profile views, calls, website clicks and direction requests. Google offers this permission only as one scope; we use it read-only and never edit profiles, posts or reviews.
    • youtube.readonly (YouTube Data API): the connected channel's name, handle and subscriber count, and the titles of its top videos.
    • yt-analytics.readonly (YouTube Analytics API): channel performance such as views, watch time, average view duration, subscribers gained and lost, likes, comments, shares and traffic sources.
    ClientReports uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
  • Connected account data (Meta): when you connect a Facebook account, we ask for ads_read to read ad account names and ad performance such as spend, impressions, clicks, leads and campaign names, and business_management to list the ad accounts your Business Manager can access. We also read your Facebook name to show which account is connected. We never create or change ads and never spend money.
  • Connected account data (TikTok Ads): when you connect a TikTok for Business account, you grant read access to ad account information and reporting. We read ad account names, IDs and currency, and ad performance such as spend, impressions, clicks, conversions, video views and campaign names, plus your TikTok for Business display name to show which account is connected. We never create or change ads and never spend money.
  • Connected account data (TikTok): when you connect a TikTok profile, we ask for user.info.basic (profile name and ID, to show which profile is connected), user.info.stats (follower, following, like and video counts) and video.list (your public videos' titles, posting dates and view, like, comment and share counts). We never post, edit or delete anything on TikTok.
  • Technical data: basic logs (such as IP address and browser type) used for security and to keep the Service running.

2. How we use information

We use connected account data only to show dashboards and reports to the agency that connected the account and to the clients that agency chooses to share them with. We do not use it for any other purpose.

  • Access is read-only. The Service never creates, edits or deletes anything in your Google, Meta or TikTok accounts and never spends money.
  • We do not sell, rent or trade personal information or connected account data.
  • We do not use connected account data for advertising, retargeting, or building profiles of people.
  • We do not use Google, Meta or TikTok data to train generalized artificial intelligence or machine learning models.
  • People do not read your connected account data, except (a) with your permission, (b) when needed for security, such as investigating abuse, (c) to comply with the law, or (d) when the data has been aggregated and anonymized for internal operations.

3. Google API Services User Data Policy

ClientReports's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we store and protect information

  • The Service runs on Cloudflare's infrastructure. All traffic is encrypted in transit (HTTPS).
  • Google refresh tokens, Meta access tokens and TikTok tokens are encrypted at rest with AES-256-GCM using a key that is kept separately as a server secret.
  • Passwords are stored only as salted hashes.
  • Report numbers fetched from Google, Meta and TikTok are cached for a few hours to keep dashboards fast, then refreshed.
  • Access inside the Service is limited by role: agency users see only their own agency's clients, and client users see only their own reports.

5. Sharing

We share information only with the agency that connected the account, the clients and share-link recipients that agency chooses, and the service providers needed to run the Service (such as our hosting provider, Cloudflare), under confidentiality obligations. We may disclose information if required by law. If InnovativeLabs is involved in a merger or sale, information may transfer under this same policy.

6. Retention and deletion

  • When a connection is removed in the Service, its stored tokens are deleted right away, and its cached report data expires within hours.
  • When a client or agency account is deleted, its data is deleted from our systems.
  • You can revoke access at any time. For Google, go to myaccount.google.com/permissions. For Facebook, go to Settings → Business Integrations. For TikTok, go to Settings and privacy → Security → Manage app permissions in the TikTok app; for TikTok for Business, remove the app from your TikTok for Business account's authorized apps.
  • To ask us to delete your data, email george@rocketfuel.marketing. We'll confirm within 30 days.

7. Children

The Service is for businesses and is not directed to children under 16.

8. Changes

We may update this policy. If we make significant changes, we'll update the date above and, where appropriate, notify account owners.

9. Contact

InnovativeLabs · george@rocketfuel.marketing