Effective date: 2 November 2026 · Operator: AboveCEO Online Consulting LLP, Maharashtra, India · Data contact: connect@aboveceo.com

This Data Usage & Protection Policy explains how AboveCEO uses and protects business information and personal data handled through its workspaces, integrations, reports, CRM, campaign tools and optional tracking features. Read it with the Privacy Policy, which gives the broader privacy notice. “Customer Data” means information a customer or its users submit, import, connect or collect through the Services.

1. Data ownership and roles

Customers retain their rights in Customer Data. A business, agency or individual workspace owner decides what data to connect, whose data to include, which users receive access, and what actions the workspace should perform. When Customer Data includes personal information about the customer’s prospects, users, employees or customers, the customer generally determines the purpose and means of processing and is responsible for its notices, lawful basis, consent and instructions. AboveCEO processes that data to provide and secure the Services, support the customer, follow documented instructions and comply with applicable law. The parties’ roles may be further set by a separate written data-processing agreement.

2. What the product uses data for

• Authenticate users and provide the workspace, dashboards, CRM, lead management, reporting, exports and enabled campaign features.
• Retrieve account, campaign, ad, analytics, conversion and asset information from services the customer connects, subject to granted permissions and provider API availability.
• Make requested changes to connected advertising assets where the feature and user permissions permit, and return status or error information.
• Keep customer records, tasks, workflows, reports and preferences available to authorised members of that customer’s workspace.
• Process subscriptions, provide support, prevent abuse, troubleshoot failures and protect the integrity and security of the Services.
• Provide optional customer-site event tracking only when the site owner has installed the SDK and explicitly granted analytics consent.
• Generate an optional AI report summary only when an administrator enables that feature and configures a provider credential. The documented summary input is limited to bounded numeric aggregates, report date range and data status; customer rows, contact details, campaign names, provider errors and raw workflow text are excluded.

We do not sell Customer Data, use it for AboveCEO’s unrelated advertising audiences, or use it to train general-purpose AI models as a product purpose. We do not use a ChatGPT identity sign-in to read user conversations or obtain an API key. Connected providers may independently process data under their own terms.

3. Data minimisation and customer control

Choose only the integrations, assets, fields, users and permissions needed for your use. Some integrations retrieve provider account metadata and performance data needed for the features you use. Workspace role and entitlement checks restrict access to relevant functions, and integration credentials are handled on the server. Customers can manage users and, where available, disconnect an integration or change its selected assets in workspace settings. Disconnecting stops future use of the connection after the request takes effect; it does not itself delete records already exported, copied to reports, retained in backups, or held by the provider.

4. Analytics and measurement

The optional AboveCEO Tracking SDK is designed for customer websites and is separate from merely visiting AboveCEO’s marketing website. The SDK’s consent state defaults to denied; the event-collection endpoint rejects events without affirmative analytics consent and accepts only a defined event list and constrained non-personal parameters. It is not designed for free-text, personal identifiers, URLs or page text. The customer operating the website is responsible for informing visitors, obtaining and recording consent where required, honoring withdrawal and privacy signals, and ensuring that its tags and other vendors follow the same choice. Do not send personal data, email or telephone numbers through event parameters.

5. Sharing and subprocessors

We make Customer Data available only to authorised workspace members and to service providers needed to host, secure, support and deliver the Services, subject to their role and applicable safeguards. Depending on the features enabled, the customer may direct data exchange with Google Ads, Google Analytics 4, Search Ads 360, Meta Ads, Reddit Ads, WordPress/WooCommerce, Razorpay or an AI provider configured for optional summaries. Email may be delivered using the SMTP or email service configured for the product. The precise hosting, email, monitoring and storage vendors may vary by environment; AboveCEO does not publish a complete fixed subprocessor list in this policy. Request the current provider list and available transfer information at connect@aboveceo.com.

Providers may process data in other countries. They may be independent controllers for their own services, and their terms apply to their processing. Customers should assess provider terms and permissions before connecting accounts. We do not control a provider’s retention, security, API availability or independent use of information.

6. Protection measures

Application controls include authenticated sessions, workspace roles and permissions, server-side integration credential handling, request validation, sanitisation of CMS rich text and access checks on tenant-scoped operations. Certain Google Ads and Meta connection vaults use AES-256-GCM encryption in application code. These statements describe controls present in the application code; they do not certify every production infrastructure, database, log, backup, network or key-management configuration. No system is risk-free. See our Security Policy for security reporting and further detail.

7. Retention, export, correction and deletion

Customer Data is kept while needed to provide the Services, at the customer’s direction, for legal and accounting duties, to resolve disputes, to protect the service, and during routine backup cycles. OAuth grants are retained until disconnected, revoked/invalidated, or no longer needed. We do not currently state a single fixed retention period for all records or backups. Workspace owners should use available export, disconnect and deletion controls and contact us to request help with access, correction, export or deletion. We will handle requests under the customer’s instructions, our agreement and applicable law. Some data may need to be retained or temporarily remain in backup copies where legally permitted or required; we will restrict such data from further use except for the reason it is retained and delete it according to applicable processes.

If you are an individual whose information appears in a customer-controlled workspace, contact that business or agency first. The customer can direct us to assist with your request. You can also contact us at connect@aboveceo.com if you cannot identify or reach the customer.

8. Customer responsibilities

Customers must use Customer Data lawfully, give clear notices, obtain any required consent, respect opt-outs and rights, ensure data accuracy, limit access to authorised users, and avoid uploading information beyond what the Services need. Customers must not connect accounts or assets they do not control or have authority to manage. Agencies should ensure their client agreements authorise access and processing. Customers must comply with ad platform policies, marketing and communications laws, data-protection requirements, security obligations and any sector-specific rules. Do not place health, payment, government ID, authentication or other sensitive information in features that are not expressly designed for it.

9. Applicable laws

Data handling is subject to applicable law, which may include India’s Digital Personal Data Protection Act, 2023 and Rules, 2025 when relevant provisions have commenced and apply, GDPR/UK GDPR for covered processing, and U.S. state privacy laws including CCPA/CPRA where territorial scope and statutory thresholds apply. The Indian DPDP framework has phased commencement; this policy does not represent that provisions not yet effective are already in force. A customer remains responsible for obligations that apply to its own collection and use of Customer Data.

10. Changes and contact

We may update this policy to reflect service, security or legal changes. We will publish the current version and update the date above. For data use questions, current provider details, data-processing terms or requests, email connect@aboveceo.com. Do not include passwords, access tokens or unnecessary sensitive personal data in your message.