Privacy
Policy

We collect several categories of information to provide and improve the Services:

1.1 Information You Provide

• Account Information: Company name, contact name, email address, phone number, business address, and password credentials when you register for an account.
• Campaign and Creative Information: Campaign briefs, line items, creative assets, and targeting parameters you configure in the platform.
• Audience Information: First-party audience segments and related identifiers you upload or direct us to activate, which you confirm you are entitled to use.
• Billing Information: Subscription plan and seat count, billing contact, and invoicing details associated with your account.
• Communications: Content of messages, support tickets, and feedback you submit to us.

1.2 Information Collected Automatically

• Usage Data: IP addresses, browser type, device information, pages visited, time spent on pages, and referring URLs.
• Campaign Events: Delivery and reporting events such as impressions, clicks, and view-through activity recorded across the campaigns you run.
• Cookies and Tracking: We use essential cookies for authentication and session management. Analytics cookies collect aggregated usage data.

1.3 Information from Third Parties

• Vendors that help us operate and secure the platform, such as cloud hosting, email delivery, and analytics providers.
• Partners and services you choose to authorize or link to your account.
• Publicly available sources used to keep business contact details accurate.

We use the collected information for the following purposes:

• To provide, maintain, and improve the Services.
• To run, serve, and measure the campaigns you configure, and to report on their performance.
• To activate first-party audiences on your instruction, with consent carried through from collection.
• To communicate with you about your account, updates, and support inquiries.
• To detect, prevent, and investigate fraud, platform abuse, and invalid activity.
• To comply with legal obligations and enforce our agreements.
• To analyze usage patterns and improve platform performance and user experience.
• To send relevant product communications (with your consent where required by law).

We do not sell your personal data. We may share information in the following circumstances:

• Service Providers: With trusted vendors who help us operate the platform (cloud hosting, email delivery, analytics, and support tooling), under contracts that limit their use of the data.
• Partners You Authorize: With parties you direct us to share data with as part of running your campaigns.
• Legal and Regulatory: With authorities or as required by applicable law, court order, or governmental regulation.
• Business Transfers: In a merger, acquisition, or sale of all or a portion of our assets.
• With Your Consent: With your explicit direction or consent.

We apply technical and organisational measures designed to protect personal data against unauthorised access, loss, or alteration. These measures may include, for example:

• Encryption of data in transit and access controls at each layer of the platform.
• Hashing of audience identifiers before activation, so raw identifiers are not used in targeting.
• Role-based access controls and authentication controls for account access.
• Security testing on a scheduled cadence, with findings tracked to resolution.
• Training for personnel on data protection and privacy practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

• The duration of your account and use of the Services.
• Legal obligations that require us to keep certain records.
• Pending or anticipated litigation or regulatory inquiries.

Under the PDPO, you may make a data access request for a copy of the personal data we hold about you, and a data correction request to correct personal data that is inaccurate. You may also ask us to stop using your personal data for direct marketing purposes at any time. Where other data protection laws apply — for example the EU GDPR, or US state privacy laws such as the CCPA/CPRA — we handle rights requests in accordance with those laws.

Depending on the law that applies to you, your rights may include:

• Access: Request a copy of the personal data we keep about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal data, subject to legal retention obligations.
• Portability: Request transfer of your data in a structured, machine-readable format.
• Objection: Object to certain processing activities, including direct marketing.
• Limiting processing: Ask us to limit processing under certain circumstances.

To exercise these rights, please contact us at privacy@butebo.com. We will respond within the timeframe required by applicable law. If you believe we have not handled your request properly, you may contact the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong.

Consent choices are carried through from collection to activation, so the preferences people express follow their data as it moves across the platform. We use essential cookies for authentication and session management, and analytics cookies for aggregated measurement. Hong Kong does not have a separate statute dedicated to cookies; we handle cookie-based data in line with the PDPO and the guidance issued by the PCPD. Where we use your personal data for direct marketing, we do so in accordance with the applicable requirements of the PDPO, including providing you with a way to opt out. You can also control cookies through your browser settings, and the Advertising Policy describes the standards we apply to the campaigns that run on the platform.

As a global advertising platform, your information may be transferred to and processed in countries other than Hong Kong. Section 33 of the PDPO, which would restrict cross-border transfers of personal data, is not currently in force; we nonetheless handle such transfers under contracts and due diligence appropriate to the circumstances and the sensitivity of the data, and require recipients to protect it consistently with this policy.

• Terms of Service — the agreement that governs your use of the platform.
• Refund Policy — subscription billing, cancellations, and refunds.
• Advertising Policy — the content standards every campaign must meet.