Privacy Policy

1. Who we are

Coldform is a performance marketing service operated by Hamza Aly, based in Egypt (“Coldform”, “we”, “us”). We run paid advertising and growth campaigns for e-commerce brands, and we operate this site as a reporting tool for the clients we work with.

This policy explains what data we handle, why, where it is stored, and how to have it removed. For any question about it, or to request deletion, contact hamzaaly@coldform.agency.

2. What we collect

Data from advertising and social platforms

With the account holder’s authorisation, we connect to third-party platform APIs — including TikTok, Meta (Facebook and Instagram) and Shopify — to retrieve data about accounts we have been given access to. Depending on the platform and the permissions granted, this can include:

• Basic account and profile information, such as display name, username, and avatar.
• A list of content posted to the account, including videos, captions, thumbnails and links.
• Performance and analytics data, such as views, impressions, clicks, engagement, ad spend, purchases and revenue.
• Advertising creative and the copy that ran alongside it.
• Store-level order and revenue totals, used to measure advertising performance.

We only access accounts we have been explicitly granted access to, either our own or a client’s, through that platform’s official authorisation flow. We do not collect data about members of the public, and we do not buy or scrape data.

Data clients give us directly

Brand names, product and pricing information, creative files, and the contact details of the people we work with.

Data collected automatically

Our hosting provider keeps standard server logs, which include IP addresses, browser type and the pages requested. These are used for security and to keep the service running. We do not use advertising cookies or third-party tracking pixels on this site.

3. Why we use it

• To run, measure and improve advertising campaigns for our clients.
• To produce performance reports — the pages on this site exist to show a client what ran on their account and what it returned.
• Where a client has asked us to, to publish content to their connected accounts.
• To operate, secure and debug the service.

We do not sell personal data, and we do not share it for advertising purposes. We do not use data retrieved from a platform API to build profiles of individuals, to train machine-learning models, or for any purpose other than serving the account holder it came from.

4. Where it is stored, and who can see it

Data is stored in Supabase (hosted PostgreSQL and file storage) and served through Vercel. Both are third-party infrastructure providers acting on our behalf, and both may store data outside Egypt.

Client reporting pages are reachable through a long, unguessable URL and are not indexed by search engines. Anyone holding that link can view that brand’s page, so links should only be shared with people the client intends to see them. Administrative access is password protected and limited to Coldform.

Platform access tokens are held as encrypted environment variables on the hosting provider and are never written to our database or exposed to the browser.

5. Third parties we rely on

• Vercel — application hosting.
• Supabase — database and file storage.
• TikTok, Meta, Shopify, Google — the platforms whose APIs we connect to, under the authorisation the account holder has granted.

Each of these has its own privacy policy governing what it does with data on its own systems.

6. How long we keep it

Campaign and performance data is retained for as long as we work with the client, and for up to twelve months afterwards so that historical reports remain accurate. Data retrieved from a platform API is deleted when the account holder disconnects our access or asks us to remove it, whichever comes first.

7. Your rights, and how to delete your data

You can, at any time:

• Ask what data we hold about you or your account.
• Ask us to correct anything inaccurate.
• Ask us to delete it. Email hamzaaly@coldform.agency and we will delete the data and confirm within 30 days.
• Revoke our access directly from the platform itself — for TikTok, under Settings → Security & permissions → Manage app permissions. Revoking access stops any further collection immediately.

8. Children

This service is for business use and is not directed at children. We do not knowingly collect data from anyone under 13.

9. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes will be communicated directly to active clients.

10. Contact