Privacy policy.

§ 01Who we are

Fat Tail Ads, LLC ("Fat Tail Ads," "we," "us," or "our") is a performance-media consultancy registered in Florida, United States. This policy explains how we handle personal information collected through this website, our client portal, our intake and contact forms, and the marketing and measurement work we perform on behalf of clients.

For most personal information processed through this website, Fat Tail Ads acts as the controller. When we run advertising, analytics, or measurement on behalf of a client, we typically act as a processor (or service provider) on that client's instructions, and the client's own privacy policy governs that data. Where the two roles meet, this policy describes our website practices; the relevant client engagement agreement governs the rest.

§ 02Scope

This policy applies to this website and directly connected services. It does not apply to third-party websites we link to, to advertising platforms operated by others (such as Google, Meta, Microsoft, or LinkedIn), or to a client's own properties where we are engaged as a service provider. Those are governed by their respective operators' policies.

§ 03Information we collect

Information you provide directly

• ◆Contact and inquiry details — name, work email, phone, company, role, and the message you submit through our forms.
• ◆Engagement information — monthly media spend, primary channel, and other context you share when scoping an engagement.
• ◆Client-portal credentials — email and authentication data if you are granted portal access, plus documents shared within an engagement.
• ◆Correspondence — the content of emails, calls, and messages you send us.

Information collected automatically

• ◆Device & connection data — IP address, browser type, operating system, and language, recorded in standard server logs.
• ◆Usage data — pages viewed, referring URLs, time on page, and interaction events, where analytics are enabled with your consent.
• ◆Cookies & identifiers — see §04 and §05 below.

We do not intentionally collect special-category (sensitive) personal data through this website, and we ask that you do not submit it through our forms.

§ 04Cookies & similar technologies

Cookies are small text files stored on your device. We also use related technologies — local storage, pixels (web beacons), software development kits, and server-to-server event APIs — which we refer to collectively as "cookies" here. We group them into four categories:

Strictly necessary cookies are required for the site to function and cannot be switched off. All other categories are off by default until you consent. You can accept, reject, or fine-tune categories at any time:

Manage cookie preferences

You can also use Cookie settings in the site footer.

§ 05First-party vs third-party cookies

First-party cookies are set by this domain. We use them to keep the site working, remember your consent choices, hold your form and portal state, and measure our own traffic. They are not shared with advertisers.

Third-party cookies are set by other domains whose services we embed — analytics, advertising, scheduling, and measurement providers. When enabled with your consent, these allow the relevant provider to recognize your browser across sites for the purposes described in §04. Because browsers and platforms are deprecating third-party cookies, we increasingly rely on first-party and server-side measurement (see §09) rather than cross-site tracking.

§ 06Third-party services & processors

We rely on a small set of vendors to operate the site and our practice. Each processes personal information only as needed for its function, under its own terms and our agreements:

• ◆Hosting & content delivery — to serve this website and log requests.
• ◆Analytics — e.g. Google Analytics, for aggregate traffic measurement (consent-gated).
• ◆Advertising & measurement platforms — e.g. Google Ads, Microsoft Advertising, Meta, LinkedIn, TikTok — for conversion measurement and, where applicable, retargeting and lift testing (consent-gated).
• ◆CRM & forms — e.g. a GoHighLevel-based pipeline that receives and stores inquiry submissions.
• ◆Scheduling — embedded calendar/booking tools used to arrange calls.
• ◆Email & productivity — to correspond with you and manage engagements.

A current list of processors and the safeguards applied is available on request via the contact in §21.

§ 07How we use information

• ◆Respond to inquiries, scope engagements, and provide our services.
• ◆Operate, secure, and improve this website and the client portal.
• ◆Measure the performance of our own marketing — with consent where required.
• ◆Send engagement-related and, where permitted, occasional practice updates. You can opt out of the latter at any time.
• ◆Comply with legal, tax, and contractual obligations, and enforce our agreements.

§ 08Legal bases (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we process personal information under one or more of these bases:

• ◆Consent — for non-essential cookies and optional marketing communications. You may withdraw consent at any time.
• ◆Contract — to respond to your requests and deliver services you ask for.
• ◆Legitimate interests — to run, secure, and improve our website and practice, balanced against your rights.
• ◆Legal obligation — to meet record-keeping, tax, and compliance duties.

§ 09Advertising & measurement

Measurement is the core of what we do, and we hold our own data practices to the same standard. A tracked conversion is not a caused conversion — so wherever possible we favor privacy-respecting, consent-based measurement over indiscriminate tracking.

• ◆Server-side events — conversion data may be sent platform-to-platform via server APIs (e.g. Conversions API, Enhanced Conversions) rather than only through browser pixels.
• ◆Hashed identifiers — where identity is matched, identifiers such as email are hashed before transmission; we do not transmit raw identifiers for matching.
• ◆Aggregated & modeled measurement — we use incrementality tests, geo-experiments, and modeled (aggregate) conversions in place of individual-level tracking where we can.
• ◆No sale of personal information — we do not sell personal information for money, and we honor opt-outs of "sharing" for cross-context behavioral advertising as defined by applicable law.

§ 10Client account access

Clients can grant Fat Tail Ads access to their advertising, analytics, and business accounts (for example Google Ads, Google Analytics, Google Tag Manager, Google Search Console, Google Merchant Center, Google Business Profile, YouTube, Meta, LinkedIn, and Microsoft Advertising) through our client-access tool at fattailads.com/connect. You never share a password with us: you either accept an access request inside the platform itself, add our team as a user in the platform's own settings, or sign in with the platform and approve a specific, limited permission on the platform's own consent screen.

• ◆What we receive — the identifiers of the accounts you choose to share (such as an account or property ID), the access level you grant, your name, company, and contact email, and the date and status of each grant.
• ◆How sign-in tokens are handled — when you approve a permission through a platform's sign-in screen, the resulting access token is used only during that session to create the access you approved, then discarded. We do not store your platform passwords or your sign-in tokens.
• ◆What we keep — a record of the request and its status, so we can confirm access was granted and let you know if anything is incomplete.
• ◆Revoking access — you can remove Fat Tail Ads' access at any time from each platform's user, partner, or manager-link settings, or ask us to remove it via §21.

Credentials that Fat Tail Ads uses on its own behalf to confirm that access was granted are stored encrypted and are never shared.

§ 11Google user data

This section explains exactly which Google user data our client-access and account-management tool, FTA Connect, accesses, why, and how we handle it. It covers two ways Google data reaches us.

1. Clients who sign in with Google to grant access

On fattailads.com/connect, a client may sign in with Google and approve specific permissions so the tool can add our team to the Google products they select:

• ◆Google Analytics (analytics.readonly, analytics.manage.users) — we list the Analytics accounts the client can see, so they can pick one, then add Fat Tail Ads as a user on that account.
• ◆Google Tag Manager (tagmanager.readonly, tagmanager.manage.users) — we list the client's Tag Manager accounts and containers, then invite Fat Tail Ads as a user.
• ◆The client's sign-in token is used only during that session to create the access they approved, is never written to our database, and is revoked and discarded once the grant is made. We keep only the account name and ID they chose and the result of the grant.

2. Fat Tail Ads' own Google account

Our staff connect Fat Tail Ads' own Google account to FTA Connect so it can request and confirm access to the accounts clients ask us to manage. Through that account the tool uses:

• ◆Google Ads API (adwords) — to send manager-link requests from our manager account to the Google Ads customer IDs clients give us, and to read whether each link was accepted. We read link status only; this tool does not copy campaign, keyword, audience, or performance data.
• ◆Google Analytics Admin API (analytics.readonly) — to confirm a client's Analytics account is now visible to our team (account names and IDs).
• ◆Tag Manager API (tagmanager.readonly) — to confirm access to a client's Tag Manager account and containers (names and IDs).
• ◆Search Console API (webmasters.readonly) — to confirm a client's site property is shared with us and at what permission level.
• ◆Merchant API (content) — to confirm access to a client's Merchant Center account and to see pending access invitations for our team.
• ◆Business Profile APIs (business.manage) — to list and accept manager invitations a client sent us and confirm access to their locations.
• ◆Sign in with Google (openid, email) — to identify which Fat Tail Ads staff member is signed in to the private admin console.

How we store, protect, and retain Google data

• ◆We store only what is needed to track access requests: account names and IDs, the access level, status, and dates, plus an audit log of each action.
• ◆Fat Tail Ads' own Google refresh token is encrypted at rest with AES-256-GCM and is only used server-side. Client tokens are never stored.
• ◆Request records are kept for the life of the client engagement and up to 24 months afterwards, then deleted. You can ask us to delete them sooner (see §21).

Limited Use

Fat Tail Ads' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• ◆We use Google user data only to provide the access features described above, which the client requested.
• ◆We do not use Google user data for advertising, and we do not sell it.
• ◆We do not transfer Google user data to others except as necessary to provide the access you requested, to comply with law, or as part of a merger or acquisition with notice to you.
• ◆We do not allow humans to read Google user data except with your consent, for security purposes, to comply with law, or when the data is aggregated and anonymized.
• ◆We do not use Google user data to develop, improve, or train generalized AI or machine-learning models, and FTA Connect has no image or AI-generation features.

Revoking access and deleting data

You can revoke our app's access at any time at myaccount.google.com/permissions, and remove Fat Tail Ads from any Google product in that product's user or manager-link settings. To have us delete the Google-related records we hold, email privacy@fattailads.com; we confirm deletion within 30 days.

§ 12Meta data & deletion

When you share Meta assets (such as ad accounts, Pages, catalogs, datasets, or Instagram accounts) with the Fat Tail Ads business portfolio, Meta records that partner relationship; we receive the asset identifiers and the permissions you granted, and use them only to deliver our services.

Requesting deletion

To have us delete information we hold that was received from Meta, email privacy@fattailads.com with the subject "Data deletion request" and the name of your business or the account involved. We will confirm deletion within 30 days. To remove Fat Tail Ads' access to your Meta assets, open Meta Business Suite → Settings → Partners, select Fat Tail Ads, and remove it or the specific assets.

§ 13How we share information

We share personal information only with the processors in §06, with professional advisors and authorities where legally required, and in connection with a business transfer (such as a merger or acquisition). We do not sell your personal information.

§ 14Data retention

We keep personal information only as long as needed for the purpose it was collected, then delete or anonymize it. Inquiry and CRM records are typically retained for the duration of any engagement plus a reasonable follow-up window; cookie lifespans are listed in §04; legal, tax, and accounting records are kept for the periods the law requires.

§ 15Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information; to object to or restrict certain processing; to withdraw consent; and — under U.S. state laws such as the CCPA/CPRA — to opt out of the "sale" or "sharing" of personal information and to be free from discrimination for exercising these rights.

To make a request, contact us using §21. We will verify your request and respond within the timeframe required by applicable law. You may use an authorized agent where the law permits. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

§ 16Do Not Track & Global Privacy Control

Some browsers send a "Do Not Track" signal; there is no common standard for how to respond, so we do not act on DNT. We do honor the Global Privacy Control (GPC) as a valid opt-out of "sale"/"sharing" where required by law. You can also set cookie categories directly in our preferences panel.

§ 17International transfers

We are based in the United States, and information we process may be transferred to and stored in the U.S. or other countries. Where personal information is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where needed.

§ 18Children’s privacy

This website is intended for business audiences and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

§ 19Security

We apply administrative, technical, and organizational safeguards appropriate to the sensitivity of the information we hold — including access controls, encryption in transit, and least-privilege access to client data. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

§ 20Changes to this policy

We may update this policy as our practices or the law change. Material changes will be reflected by the "Last updated" date above and, where appropriate, by a notice on the site. Continued use of the website after an update constitutes acceptance of the revised policy.