Tracky 개인정보 처리방침

Tracky (tracky.10million.kr) is an ad performance and experiment management service operated by Tenmillion Marketing Co., Ltd. (텐밀리언마케팅 주식회사), 경기도 용인시 수지구 죽전로 150 B104, Republic of Korea. Contact: contact@10million.kr.

• Tracky account: your Google account's email, name and unique ID, a username and last login time; for usernames we issued, a password stored only as a one-way hash.
• Brand: brand name, store platform, Meta ad spend range, team size, whether you want to hear about order-data connections, plan and trial period, and the ad accounts you turned on.
• Waitlist: your Google account's email, name and unique ID, and brand name, if you ask to be told when sign-up opens.
• Meta (Facebook): your access token and its expiry, and data from the ad accounts, Pages and business assets you authorize via Facebook Login (ads_management, ads_read, pages_read_engagement, pages_show_list) — ad account names and IDs, campaigns, ad sets, ads, creatives, performance metrics, Page name, picture and follower count, pixels and catalogs.
• Google: access and refresh tokens, and the IDs and names of Drive folders and files you choose or Tracky creates.
• Values you enter: Anthropic API keys, ad account settings (main result, collaborative ads, automatic creative approval), AI model choice.
• Claude app connection: app name, scope, hashed tokens, last used time.
• Automatically generated: experiment change history, temporary file-sharing and upload records, a login cookie, and server access logs (IP address, request URL and time, browser information).

Experiment records and creative files are stored in your own Google Drive, not on our servers. Ad performance is fetched from Meta when needed and cached in server memory for at most a few hours.

To sign you up and in, show only the ad accounts your brand turned on and apply your plan's limits; to tailor setup guidance and decide where to open new features first (in aggregate); to email the waitlist when sign-up opens and tell you about new features you asked to hear about; to show ad performance dashboards and experiment retrospectives; to create ads you approve in your ad account in a paused state (you turn ads on and set budgets yourself); to save experiment records and creatives to your Drive; to provide AI features when you ask; and to send review reminders, fix errors and keep the service secure. We use data received from Meta and Google only for these purposes. We do not sell it, use it for ad targeting or profiling, or share it with data brokers. Our use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.

Account, brand and connection data and API keys are kept until your account is deleted; deleting it from My page removes them immediately. Waitlist entries are kept until we tell you sign-up has opened or you ask us to delete them, and at most one year. Meta access tokens expire after about 60 days. Claude connection tokens are invalidated and removed when you disconnect. Experiment change history is deleted after 7 days, temporary sharing and upload records when they close or expire, and server access logs after 14 days.

We do not provide your personal data to third parties unless you consent or the law requires it. We use these processors: Amazon Web Services (servers in Seoul, Korea); Google LLC, USA (Drive storage); Anthropic, PBC, USA (in-app AI chat on request); Slack Technologies, LLC, USA (review reminders for brands our own team runs: ad account and experiment names — never for other brands); GitHub, Inc., USA (only where agreed with a brand under a managed-service contract, a private repository holding that brand's dashboard data: aggregated metrics and creative thumbnails).

If a law enforcement agency or other public authority asks us for user data, we first review whether the request follows the required legal process and has a valid legal basis (such as a warrant or court order); we refuse and challenge requests that are not lawful, for example ones without a legal basis or that are overly broad; we disclose only the minimum data needed to satisfy a lawful request; and we keep a record of each request, its legal basis, the requesting authority and people involved, and our response.

We use one login cookie (tracky_auth, 14 days). It holds only who is signed in. We do not use analytics or advertising cookies.

You can delete your account and data at any time from My page › Delete account. You can also ask to access, correct or delete your data, or withdraw consent, by emailing contact@10million.kr. We act within 10 days after verifying your identity. See Data deletion instructions for how to remove Tracky's access and delete your data.

All traffic uses HTTPS. Passwords and Claude connection tokens are stored only as hashes. Meta and Google tokens and API keys stay in access-restricted server storage, never in the browser. Ads are only ever created paused.

This policy is effective from October 24, 2026. We will post changes on this page at least 7 days before they take effect.