Introduction

At AskRocco, a service operated by Ajungo Holdings LLC, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy outlines our practices concerning the collection, use, and protection of your data when you use our AI-powered, Slack-native application (the App). By using our App, you agree to the terms outlined in this policy.

Section 1: Information We Collect

1.1  Ad Platform Data

When you connect your Meta Ads account to AskRocco, we collect historical and real-time ad data, typically going back up to two years, across your entire account. This includes, but is not limited to:

• Campaign performance metrics
• Ad spend data
• Click-through rates
• Conversion data
• Audience targeting information
• Creative-level performance metrics (e.g., CTR, frequency, and engagement by individual ad)

Note: AskRocco does not collect actual creative asset files (images or videos) from your Meta Ads account. We collect only performance metrics associated with individual ads.

1.2  Meta Ads Platform Integration and Tech Provider Status

AskRocco operates as a Technology Provider under Meta's Platform Terms (last updated February 3, 2026). This means AskRocco accesses Meta Platform Data on behalf of you, the client, solely for your benefit and at your direction. We do not use your Meta Platform Data for our own independent purposes or for the benefit of any other client.

AskRocco accesses your Meta Ads data exclusively through the official Meta Business API under permissions you explicitly grant via OAuth. We do not access any Meta data beyond the advertising scopes you authorize.

‍Important: AskRocco never accesses your personal Facebook or Instagram profile data. Our API access is scoped strictly to your ad account performance data and nothing beyond it.

1.3  Slack Data

AskRocco connects to your Slack workspace to deliver Meta Ads insights, reports, and actions directly in Slack. The following describes exactly what Slack data we access and why:

Messages in your Rocco channels. We read messages only in the dedicated brand channel(s) Rocco is added to, so the assistant can understand your question and respond in context. We do not read messages in channels Rocco has not been added to.

Files you share with Rocco. When you upload a document or image to Rocco (for example, a brand asset or a creative to analyze), we download and process that file to generate your requested output.

Your Slack profile basics. We access your name, time zone, and email address to link your Slack user to your AskRocco account, personalize responses, and manage team access.

Channel and workspace metadata. We read basic channel and workspace information (such as channel IDs and whether a channel is shared externally) to route responses to the correct place and to identify external or guest participants.

1.4  Conversation History

We collect and store the conversation history between you and Rocco within the App. This includes queries, responses, and any other information shared during these interactions.

1.5  Organization and Login Information

To provide secure access and manage user authorization, we collect basic information about your organization and Meta login, including:

• OAuth metadata
• User roles
• Business ID
• Ad account IDs

1.6  Usage Data

We collect data on how you interact with our App, including features used, frequency of use, and other analytics that help us improve our service.

1.7  Stripe Data

Stripe: When you connect Stripe, we read business data from your Stripe account, such as payments, refunds, invoices, subscriptions, payouts, balance, disputes, and products and prices. We read it live when you ask a question and do not keep a copy of it. We remove customer names, email addresses, phone numbers, addresses, payment method details, and similar customer information before the data goes to our AI provider. We also store your Stripe account ID, whether the account is live or test, when it was connected, and a record of your consent.

Section 1A: Google User Data

When you connect a Google Ads account, AskRocco requests the scope https://www.googleapis.com/auth/adwords (read and manage the Google Ads accounts you select). When you connect a Google Analytics property, AskRocco requests the scope https://www.googleapis.com/auth/analytics.readonly (read-only access to the Google Analytics 4 properties you select). Each scope is requested only when you connect that product, and no other scopes are requested.

What we access. From Google Ads: campaign, ad group, ad, keyword, and conversion performance data, and audience-segment performance metrics, for the accounts you connect — including spend, impressions, clicks, CTR, CPA, and ROAS. From Google Analytics: aggregated traffic, engagement, and conversion metrics for the properties you select. We access only the accounts and properties you explicitly select, no other Google product data, and no Google profile data at all.

How we use it. Solely to provide AskRocco's user-facing features: answers to questions you ask Rocco, cross-channel reporting that presents your Google and Meta performance together, and — where you enable RoccoGo — campaign optimization within guardrails you configure.

Write access to Google Ads. The Google Ads API provides a single scope covering both read and write access; Google offers no read-only alternative. Where you enable RoccoGo for a Google Ads account, we use this access to apply changes such as budget adjustments, bid adjustments, and pausing or enabling campaigns and ad groups. Where RoccoGo is not enabled, we use the scope for reporting only.

Who receives it. Reports and answers containing your Google data are delivered into your Slack workspace and processed by Slack under your organization's agreement with Slack. Beyond that, we share Google user data only with processors acting on our behalf under contract: our cloud hosting provider (including database and search infrastructure), OpenAI (text and embedding processing), Datadog (service monitoring — receives Google account and property identifiers), and Sentry (error monitoring). Google user data is not sent to Google Gemini, which we use only for image generation from creative assets. OpenAI operates under a paid API agreement that prohibits using your data to train its models, as described in Section 5. We do not sell, rent, license, or monetize Google user data, and we do not transfer it to advertising platforms, data brokers, or information resellers.

Artificial intelligence and machine learning. We do not use information received from Google APIs to develop, improve, or train generalized or non-personalized AI or machine-learning models, whether our own or a third party's.

Human access. AskRocco personnel do not read your Google user data except: with your affirmative agreement (for example, a support investigation you request); for security purposes such as investigating abuse; to comply with law; or on aggregated, anonymized data for internal operations. Access is restricted and logged.

How we protect it. Google user data is encrypted in transit and at rest, staff access is limited by access controls and authentication, and customer accounts are logically isolated from one another. See Section 6 for our general security practices.

Retention and deletion. Google user data follows the retention periods in Section 8. You may disconnect your Google account at any time from within AskRocco, or revoke access at https://myaccount.google.com/permissions. When you disconnect, we stop all access to your Google accounts. Stored Google user data is then retained under the periods in Section 8 unless you request deletion at privacy@askrocco.ai, in which case we delete Google user data held by AskRocco promptly, except where retention is required by law. Disconnecting does not delete copies previously delivered to third-party destinations you control, such as your Slack workspace; those copies are governed by your settings and agreement with the destination provider.

Limited Use. AskRocco's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Section 2: How We Use Your Information

2.1  Providing and Improving Our Services

We use the collected data to:

• Deliver ad performance insights and analytics
• Generate AI-powered recommendations for campaign optimization
• Improve the accuracy and relevance of Rocco's responses
• Enhance the functionality and user experience of our App

2.2  How We Use Your Slack Data

Slack data is used exclusively to:

• Generate AI-powered answers, daily performance briefs, recommendations, and creative based on your Meta Ads data and your questions
• Store your conversation history with Rocco so the assistant can provide continuity and more relevant responses across sessions
• Post Rocco's replies, reports, and onboarding messages into your channel. Rocco always posts as itself (the app) and never posts or takes actions as you
• Send your queries and the context needed to answer them to trusted third-party AI providers (described in Section 5) to generate responses

2.3  Personalization

We use your conversation history and ad account data to personalize your experience within the App, providing more relevant insights and recommendations over time.

2.4  Analytics and Research

We analyze aggregated, anonymized data to identify industry trends, benchmark performance, and conduct research to improve our services. This analysis is performed at a macro level and does not involve examining individual account details.

Section 3: Prohibited Uses of Platform Data

In compliance with Meta's Platform Terms, AskRocco will not use Meta Platform Data for any of the following purposes, and you may not instruct AskRocco to do so:

• To discriminate against people based on personal attributes including race, ethnicity, color, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, or medical condition
• To make eligibility determinations about people for housing, employment, insurance, education, credit, or government benefits
• To perform, facilitate, or provide tools for surveillance of any kind
• To sell, license, or purchase Platform Data
• To build or augment user profiles without valid user consent
• To re-identify, de-anonymize, or reverse-engineer any anonymized Platform Data
• For any purpose other than managing and optimizing your own Meta Ads campaigns

Section 4: What We Will Never Do With Your Slack Data

AskRocco is committed to the following restrictions on your Slack data:

• We do not use your Slack messages, conversations, files, or any Slack data to train, fine-tune, or improve AI models, neither our own models nor our providers'. We use OpenAI and Google under their paid API terms, which prohibit using submitted data to train their models.
• We do not sell, rent, license, or monetize your Slack data in any form, ever.
• We do not give anyone access to content they could not already see in Slack. AskRocco respects Slack's privacy model and never exposes private channels, messages, or files to people who do not already have access to them in Slack.
• We do not read channels Rocco has not been added to, and we do not join channels without your action.
• We do not impersonate you. Rocco only ever posts and acts as the Rocco app, never on your behalf as your user.
• We do not email you without your consent.
• We do not use your data for advertising, building user profiles, surveillance, eligibility decisions, or any form of discrimination.
• We do not commingle your data with other customers' data. Each customer's data is logically isolated.

Section 4B: What We Will Never Do With Your Stripe Data

• We do not sell, rent, license, or publish your Stripe data.
• We do not use your Stripe data to train, fine-tune, or improve AI models, ours or our providers'. We use OpenAI under paid API terms that prohibit training on submitted data.
• We do not use your Stripe data to decide eligibility for credit or insurance, to create a consumer report, or to take adverse action against any person.
• We do not change anything in your Stripe account. Access is read-only. AskRocco cannot move money, issue refunds, create charges, or edit customers.
• We do not collect card numbers, bank account numbers, or your Stripe API secret keys.
• We use your Stripe data only to answer your questions and to improve your own experience in AskRocco, and we do not mix it with other customers' data.

Section 5: Third-Party AI Processing

To generate responses and creative, AskRocco sends your queries and the necessary context to two third-party large language model providers:

OpenAI for text responses, search, audio transcription, and embeddings.

Google (Gemini) for image generation.

These providers process the data only to return a result to you, under our paid API agreements with each, which prohibit using your data to train their models:

OpenAI. Inputs and outputs are retained for up to 30 days for abuse monitoring and then deleted (or not retained at all where a Zero Data Retention arrangement applies), and API data is not used to train OpenAI's models. Processed in the United States.

Google (paid Gemini API). Under the paid Services terms, Google does not use your prompts or responses to train or improve its models. Prompts and responses are logged for a limited period solely for abuse detection, safety, and legal compliance. Processed on Google's cloud infrastructure.

Of these providers, only OpenAI receives data obtained from Google APIs (Google Ads and Google Analytics); Google user data is not sent to Gemini.

The same providers process Shopify order and product data when generating reports and answers.

When you ask a question about Stripe, the Stripe data needed to answer it, after customer information has been removed, is sent to OpenAI. Stripe data is never sent to Google Gemini, which is used only for image generation.

Section 6: Data Protection and Security

We implement robust security measures to protect your data from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest using industry-standard protocols
• Regular security audits and vulnerability assessments
• Strict access controls and authentication procedures for our staff
• Logical data isolation to prevent cross-contamination between accounts
• No collection of Meta user login credentials

We maintain an accessible mechanism for reporting security vulnerabilities. If you identify a potential security issue, please contact privacy@askrocco.ai.

Section 7: Meta Audit Rights

As a Technology Provider operating under Meta's Platform Terms, AskRocco may be subject to review, monitoring, or audit by Meta or its designated third-party auditors to verify compliance with Meta's Platform Terms and data security requirements. By using AskRocco, you acknowledge that such reviews may occur and that AskRocco is obligated to cooperate with them fully.

Section 8: Data Retention

We retain your data for as long as your account is active or as needed to provide our services. Specifically:

• Ad platform and analytics data (Meta Ads, Google Ads, and Google Analytics) is retained for up to 24 months from the date of collection
• Conversation history is retained for up to 12 months
• Organization and access data is retained for the duration of your active subscription
• Shopify order, product and report data: 7 days after uninstall or disconnect; backups 30 days

Stripe data: We do not keep a copy of your Stripe data. We keep short-lived technical logs of each question and the redacted results used to answer it for up to 90 days. Answers Rocco posts are part of your conversation history, which we keep for up to 12 months. If you disconnect Stripe, uninstall the AskRocco app from Stripe, or Stripe revokes our access, we delete your Stripe access token and these logs right away, and backups are deleted within 30 days. We keep your Stripe account ID and connection and consent record for as long as your AskRocco account exists. To delete conversation history that contains Stripe answers, email privacy@askrocco.ai.

We will delete your Meta Platform Data promptly when:

• You request deletion of your account or data
• Retention is no longer necessary for a legitimate business purpose
• You cease using AskRocco or your account is terminated
• Meta requests deletion for user protection
• Required by applicable law or regulation

To request deletion, contact us at privacy@askrocco.ai or use the in-app data deletion mechanism. Some anonymized, aggregated data may be retained for analytical purposes, but this data cannot be traced back to your individual account in any way.

Section 9: Information Sharing and Disclosure

We do not sell, license, or share your Meta Platform Data, company name, user information, or individual ad account data with third parties under any circumstances.

We may share limited data with service providers (such as cloud infrastructure providers) solely as needed for them to deliver services on our behalf. All such providers are contractually bound to use your data only for that purpose and are prohibited from using it for their own benefit.

We may share anonymized, aggregated data for internal analysis and service improvement. This data cannot be traced back to individual users or companies.

We may disclose data if required to do so by applicable law, court order, or governmental authority. We will retain proof of any such legal requirement and, where permitted by law, will notify you before complying.

Section 10: A Note on AI Accuracy

AskRocco is an AI-powered assistant. AI-generated insights, recommendations, and creative may be inaccurate, incomplete, or not suited to your situation. Always review Rocco's output before acting on it in a live campaign or other context.

Section 11: Your Rights and Choices

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to certain exceptions)
• Opt out of certain data processing activities

These rights are available to all users regardless of location.

To exercise these rights, contact us at privacy@askrocco.ai.

Section 12: Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the updated policy on our website, updating the Effective Date at the top of this document, and sending notice via email or in-app notification to active users prior to the changes taking effect.

Section 13: Compliance with Laws and Regulations

We are committed to complying with all applicable data protection laws and regulations, including but not limited to the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Meta's Platform Terms and Developer Policies, and Slack's API Terms of Service and App Directory requirements.

Section 14: International Data Transfers

Your data may be stored and processed in the United States. For users whose data originates in the European Economic Area or the United Kingdom, such transfers are conducted in accordance with applicable data transfer frameworks, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, consistent with Meta's Platform Terms.

Section 15: Shopify Integration

What we collect from Shopify. When a merchant installs AskRocco from the Shopify App Store, we read: orders (totals, line items, discounts, refunds, timestamps, fulfillment status), products and collections, and sales analytics reports. Shopify requires apps that use its analytics API to hold access to customer name, email address, phone number and postal address. AskRocco does not display, export or store these fields, and does not build customer profiles or query customer records directly.

What we collect from the merchant. Your account email, your Shopify store domain, and your Slack workspace details.

What we collect from your customers. Nothing. AskRocco does not add scripts, pixels or forms to your storefront.

How we use Shopify data. To answer your questions about sales in Slack and to produce your daily sales summary, shown alongside your Meta Ads performance. We do not sell this data, use it for advertising, or use it to train AI models.

How long we keep it. Shopify order, product and report data is retained while your store is connected. When you uninstall the app or disconnect your store, we delete this data within 7 days. Backups are deleted within 30 days.

Where it is processed. Data is stored and processed in the United States on Amazon Web Services and MongoDB Atlas. Transfers from the EEA/UK are covered by the Standard Contractual Clauses and UK IDTA described above.

Deletion and access requests. Merchants and their customers can request access to or deletion of their data at privacy@askrocco.ai. We honor Shopify's customer data-access and deletion requests within 30 days.

Section 15B: Stripe Integration

AskRocco connects to Stripe through the AskRocco app on the Stripe App Marketplace, using OAuth. You approve access on Stripe's consent screen and in AskRocco before anything is connected.

What we can read, and why:

• Charges and refunds, to answer questions about revenue and payments.
• Invoices, to answer questions about paid, open, and overdue invoices.
• Subscriptions and prices, to report active, trialing, and canceled subscriptions and calculate MRR.
• Payouts and balance, to report upcoming and past payouts and net revenue after Stripe fees.
• Disputes, to report open disputes and chargebacks.
• Products, to name what was sold.
• Account events, so we know right away if you uninstall the app and can delete your access token.

How we use it: access is read-only, data is read live when you ask a question, customer information is removed, and the result is sent to OpenAI to write the answer.

How to disconnect: use Integrations in AskRocco, or uninstall the app in your Stripe Dashboard. Either one ends access and deletes your token immediately. Stripe is a trademark of Stripe, Inc. AskRocco is not affiliated with or endorsed by Stripe.

Section 16: Cookie Policy

Our App does not use cookies directly. However, any third-party services we use, such as analytics tools or cloud hosting providers, may use cookies as part of their functionality. We recommend reviewing those services' cookie policies for more information.

Section 17: Third-Party Links and Services

Our App may contain links to third-party websites or services, such as Meta Business Manager or AI infrastructure partners. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

Section 18: Data Breach Notification

In the event of a data breach that compromises the security of your personal information, we will notify you and the relevant authorities as required by applicable laws and regulations, and will notify Meta using Meta's required incident reporting process.

If a breach affects Stripe data, we will also notify Stripe without undue delay and within 72 hours of becoming aware of it.

Section 19: Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Ajungo Holdings LLC

216 Midland Ave, Ste. 2

Wayne, PA 19087

United States

Email: privacy@askrocco.ai

By using AskRocco and its products, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.