Privacy Policy

1. Who is responsible

OST Desk ("OST Desk", "we") is the controller of the personal data described here.

OST Desk is a business-to-business service. This policy covers the people who use it on behalf of their business (account owners, team members) and people who submit our request-access form.

2. What we collect

When you request access: name, company, email, your preferred contact (optional: a Telegram, WhatsApp or Discord handle or number, or another app's handle), expected monthly ad spend, the ad networks you're interested in, and any note you add.

When you apply as a partner: the same details, plus how you'll introduce clients and your website. Once you're a partner, your payout details, stored encrypted.

When you have an account:

• identity and contact details: name, email, the contact you prefer us to use (e.g. Telegram username or WhatsApp number), business name and details;
• login credentials: your email and a password stored only as a bcrypt hash; we never store plain-text passwords;
• money records: wallet balance, top-ups, payment method used, fees, account funding, subscription charges, and the payment proofs (e.g. bank statements) you upload;
• verification documents when we need them to verify your business and the source of your funds;
• advertising data for the accounts we operate for you: account IDs and names, status, spend, and campaign identifiers and statuses read from the networks' APIs;
• creatives you upload (images, videos, ad copy).

Automatically: IP address and browser details when you sign in or use the service (for security and rate limiting), and error reports when something breaks (the page, the error and, if you're signed in, your user ID). We use the cookies needed to keep you signed in. If you arrive through a partner's link, we also set one cookie (ost_ref) holding that link's code and the time of the click, for up to the attribution window, so we know who introduced you; it holds nothing about you. We don't use advertising or analytics trackers.

3. Why we use it

• To provide the service (contract): operate your ad accounts, process top-ups and funding, charge fees, show your data in the portal, support you.
• To keep the service secure (legitimate interest): prevent fraud and abuse, limit repeated sign-in attempts, investigate errors.
• To meet legal duties (legal obligation): accounting, tax, anti-money-laundering checks, responding to lawful requests.
• To tell you about your account (contract): alerts about balance, spend, account status and payments, by email or Telegram.

We don't sell personal data and don't use it for advertising.

4. Who we share it with

• Advertising networks (e.g. Meta): only what's needed to run the accounts and campaigns you ask for.
• Messaging providers that deliver our notifications (e.g. Telegram, our email provider).
• Banks and payment providers, to receive and reconcile your payments.
• The partner who introduced you, if any: your company name as you gave it, whether you became a client, and their commission. Never your spend, ad accounts or contact details.
• Authorities, when the law requires it.

Providers act on our instructions and may only use the data to provide their service to us.

5. How long we keep it

• Account and money records: for as long as your account is open and then for 5 years after closure, for legal, tax and anti-money-laundering reasons (see the Account Closure Policy).
• Error reports and request logs: up to 90 days.
• Database backups: rolling, deleted after 14 days.

6. Your rights

Depending on where you are, you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and you can complain to your data-protection authority. We answer verified requests within 30 days. Some data must be kept for legal reasons even if you ask us to delete it; we'll tell you if that applies.

7. Security

Passwords are hashed, traffic is encrypted in transit, uploaded files are stored privately and only shown to your team and our ops desk, and access inside OST Desk is limited by role. No system is completely secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

8. Changes

We'll post changes here and, for material ones, email account owners at least 30 days in advance.