Privacy Policy

1. Who we are

Sherlock (“Sherlock”, “we”, “us”) is operated by Igloo Media Group LLC, 42 W 82nd Street, New York, NY 10024. For anything in this policy, contact andrew@igloomedia.co.

2. What Sherlock does

Sherlock reads performance data from the advertising accounts you connect, compares it with targets you set, and sends alerts and summaries to your Slack workspace. Sherlock has read-only access to your advertising accounts. It cannot create, edit, pause or delete campaigns, ads, budgets or audiences.

3. Information we collect

Account information

Your name, work email address, company or agency name, role and login details. Team members you invite provide the same.

Advertising account data (read-only)

When you connect Meta Ads, Google Ads or TikTok Ads, we receive an access token from that platform and use it to read:

• account, campaign, ad set or ad group, and ad names, identifiers and statuses
• performance metrics such as spend, impressions, clicks, frequency, conversions, conversion value, add-to-carts and video views
• account currency, time zone and ad review status

We never receive your advertising platform passwords. The performance data we read is aggregated. We do not collect personal information about the people who see or interact with your ads.

Slack data

When you add Sherlock to Slack we receive a bot token and store your workspace identifier, the channels you choose, and the names and identifiers of members you choose to mention. If you reply in a Sherlock thread, we process that reply to act on it. We do not read other messages in your workspace.

Billing information

Payments are handled by Stripe. We receive your billing email, plan, payment status and the last four digits and brand of your card. We do not store full card numbers.

Usage and device data

Log data such as IP address, browser type, pages viewed and actions taken, used to secure and improve the service. We use essential cookies to keep you signed in. If we add analytics cookies we will update this policy and ask for consent where required.

4. How we use information

• to provide the service: check your accounts against your targets and deliver alerts and digests
• to show you dashboards, history and the reasoning behind each alert
• to secure accounts, prevent abuse and debug problems
• to bill you and communicate about your account
• to meet legal obligations

We do not sell your data. We do not use your advertising data for our own advertising, for benchmarking that identifies you, or for any purpose other than providing Sherlock to you.

5. AI processing

Whether a guardrail has been breached is always calculated by fixed code, never by an AI model. We use an AI language model provider (Anthropic) only to turn a rule you write in plain English into a draft you review, to add optional commentary to digests, and, where enabled, to interpret a reply you post in a Sherlock thread. For these purposes we send the text you wrote and the relevant performance figures. We never send access tokens or credentials. Our provider is contractually restricted from using this data to train its models.

6. Platform-specific disclosures

Meta

We access Meta advertising data through the Meta Marketing API using the ads_read permission, solely to provide Sherlock to the business that connected the account. We handle this data in line with the Meta Platform Terms. You can remove Sherlock at any time in your Meta Business Integrations settings.

Google

Sherlock’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google Ads data only to provide and improve the user-facing features of Sherlock
• we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with equivalent protections
• we do not use it for serving advertisements
• our staff do not read it unless you give permission, it is needed for security or legal reasons, or it is aggregated and anonymised for internal operations

TikTok

We access TikTok advertising data through the TikTok Marketing API with read-only reporting permissions, solely to provide Sherlock to the business that connected the account.

7. Who we share information with

We share data only with service providers who help us run Sherlock, under contracts that limit their use of it. The current list is on our Security page. We may also disclose information if required by law, to protect rights and safety, or as part of a business transfer, in which case this policy continues to apply to your data.

8. Agencies and brands

If an agency connects a brand’s advertising account to Sherlock, the agency confirms it has the brand’s authority to do so. People invited to a brand workspace, whether from the agency or the brand, see the same figures for that brand. Agency administrators control which team members can access which brands.

9. How long we keep data

• hourly performance figures: 90 days
• daily account and campaign figures: up to 13 months
• daily ad-level figures: up to 90 days
• raw responses from advertising platforms: a short period for troubleshooting
• account, rule and alert history: for the life of your account
• access tokens: until you disconnect or delete your account, when they are revoked and deleted

10. Deleting your data and your rights

You can disconnect any advertising account or Slack at any time, and you can delete your workspace and all its data. See Data deletion for the steps and timing. Depending on where you live, you may have rights to access, correct, export, restrict or delete your personal information, and to object to certain processing. To use any of these rights, contact andrew@igloomedia.co. We will not treat you differently for doing so. You may also complain to your local data protection authority.

11. Security

Access tokens are encrypted, each customer’s data is isolated at the database level, and access is limited by role. More detail is on our Security page. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

12. International transfers

Sherlock is operated from the United States and your data is processed there and in the locations of our service providers. Where required, we rely on appropriate safeguards such as standard contractual clauses.

13. Children

Sherlock is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.

14. Changes

If we change this policy we will update the date above, and for significant changes we will notify account owners by email before they take effect.

15. Contact

Igloo Media Group LLC
42 W 82nd Street, New York, NY 10024
andrew@igloomedia.co