Privacy Policy

Beyond Ads is a tool run by Beyond (Global Support Limited) in New Zealand to draft advertising creative and report on how it performs. It is used by Beyond staff and by a small number of invited beta users, and its marketing page lets people ask for a beta place. It holds little personal information: the details people give when they ask for a place, the email addresses of the people who sign in, and advertising performance figures for the accounts they connect. It does not collect information about the people who see the adverts, and it does not sell or share data for advertising or any other purpose.

Beyond (Global Support Limited), New Zealand, is responsible for the information described here. For any question about this policy, or to ask for your information to be corrected or deleted, contact kyle@gobeyond.co.nz.

We hold the following.

• Beta requests. What you enter on the marketing page when you ask for a place: your name, email, business, what you sell, where you advertise, a rough monthly spend if you give one, and any note. We also keep a one-way hash of the network address the request came from, used only to limit repeated requests. It cannot be turned back into the address.
• Sign-in details. The email address of each person with access, Beyond staff and beta users, and the session record that keeps them signed in. There are no passwords: sign-in is by emailed link, one time code or passkey.
• Product pages you submit. The link, and the product information read from that public page.
• Generated creative. The ad angles, scripts and briefs the tool drafts, and whether each one was approved or rejected.
• Advertising performance data. Aggregate figures for the campaigns of each connected advertising account, such as spend, impressions, clicks and conversions, read from the platform’s advertising API with the account holder’s permission. These are campaign totals. They do not identify anyone who saw or clicked an advert.
• Usage records. How much AI processing each account’s work used and what it cost us, so we can run the service at a fair price.

The tool itself uses no cookies for advertising or analytics. The marketing page sets none. The only cookies the tool sets are the ones that keep a signed-in user signed in, and on funnel pages (below) one that remembers your sign-up link on that device. We count page visits and which parts of the tool are used with Plausible, which sets no cookies and keeps no personal details.

A funnel page is a page an advert links to, run by the business behind the advert on this service, that asks for your email and sends you a link to sign up. We use that email only to send the link and up to four reminders about the offer you asked for, from go@gobeyond.co.nz. Every reminder has an unsubscribe link that works straight away. Your email, which advert you came from, which device you used and how far you got are kept in that business’s account and never shown to another.

So the business can see who its pages reach and fix a page that breaks on some phones, the page also records your IP address, the town and country it points to, your phone or computer model, its system, browser or app, screen size and language. Your IP address is kept only with your email; page visits are counted without it. If a page shows an error, the error and your device are recorded, never anything you typed.

The emails carry a small tracking image and tagged links, so the business can see whether the email was opened and the link used. A funnel page may also load that business’s TikTok or Meta advertising pixel, which sets their cookies so they can show you their adverts again. Your name is never sent to TikTok or Meta.

If the business has switched on server events for its page, and you came from one of its TikTok or Meta adverts, we tell that platform when you give your email, go on to sign up and finish signing up, so it can measure and improve the advert. What goes is your email and a reference for you, both scrambled one way (hashed with SHA-256) so they can’t be read, the platform’s own click reference and cookies, and your IP address and browser. It is sent once for each step, and never for a visit we judge to be outside the advert’s market, a bot or a throwaway email address.

If you are in the United Kingdom, the European Union or the European Economic Area and the page uses advertising pixels, it first asks whether you accept advertising cookies, with Accept and Reject alike. Until you accept, no TikTok or Meta pixel loads, our emails to you carry no tracking image, and no server events are sent about you. Your answer is kept in a cookie on the funnel pages and with your email.

Where the tool connects to TikTok, it does so against advertising accounts that the person connecting them owns or has been authorised to manage, using access granted through TikTok’s own authorisation flow. What it reads is limited to the scopes granted at that point.

That data is used to show the account holder which of their ad angles performed best, and to improve the angles the tool drafts next. Beyond can see it, to support the account holder and run the service. It is never shown to another account. We do not combine it with data from other sources to profile individuals, we do not pass it to anyone outside Beyond, and we do not use it for any advertising of our own. Access can be revoked at any time from TikTok Business Center, and revoking it stops any further collection.

Patterns drawn from results across all accounts, such as which kinds of opening hold attention, are used to improve the angles the tool drafts for everyone. Only the pattern is used. Product names, links, clients, scripts and figures are never shown to another account, and nothing used this way identifies an account or a person.

Video shots the tool makes that show no product, logo or brand (a person, a place, a moment) are added to a shared library every account can use in its own ads. Only the shot and a short description of what is in it are shared, never the account, product, client or script it was made for. Shots showing anything of yours stay in your account.

An account can add a real person’s photos to Studio so their face appears in its videos, and, as a separate step, recordings of them speaking so the tool can read new scripts in their voice. The account must record who gave that person’s permission and tick that they agreed, separately for the face and for the voice. Photos and recordings are kept privately in that account and reached only through short-lived links. Photos go to BytePlus to make the video frames; recordings go to ElevenLabs to learn the voice. Removing the person, or Forget voice, deletes the learned voice at ElevenLabs straight away. Anyone whose face or voice is used can ask the account, or us at the address below, to have it removed.

To run the tool for the purposes described: deciding on beta requests and contacting the people who made them, drafting advertising creative, keeping a record of what was approved, reporting on how it performed, and working out what the service costs to run. We do not use this information for anything else, and we do not sell it or make it available to anyone for their own purposes.

Only the service providers that make the tool work, and only so far as each needs in order to do its job.

• Supabase, for the database and authentication. Data is held in Supabase's Sydney region.
• Vercel, for hosting.
• Anthropic, which receives product page content and generates the ad angles.
• TikTok, where we read advertising performance for the accounts connected to the tool, and, when a business switches on server events on a funnel page, which receives hashed emails as described under Funnel pages.
• Meta, which receives the same hashed details through its Conversions API when a business switches on server events on a funnel page.
• Resend, which delivers the emails the tool sends, such as the morning results summary.
• BytePlus, which makes video frames and clips, including from photos added in Studio.
• ElevenLabs, which reads voiceovers and, in Studio, learns a person's voice from their recordings with their permission.

We may also disclose information where the law requires it. Because these providers operate internationally, some information is stored or processed outside New Zealand.

Product runs, generated angles and performance records are kept while they are useful for comparing past results, and deleted when they are not. A beta request is kept while it is being considered and while the beta runs, then deleted. Sign-in records are deleted when an address loses access, and a beta account’s data is deleted on request when it ends. Anything may be deleted sooner on request.

Access requires sign-in as an approved address, checked on every page and every action rather than only at the front door. The only thing the public marketing page can do is add a beta request; it cannot read anything back. There are no shared passwords. Credentials for connected services are held as server-side environment variables and are never sent to the browser.

Under the New Zealand Privacy Act 2020 you may ask what personal information we hold about you, ask for it to be corrected, and ask for it to be deleted. Write to kyle@gobeyond.co.nz and we will respond within 20 working days. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner at privacy.org.nz. If you are in Australia, you may also have rights under the Australian Privacy Act 1988.

We may update this policy. The date at the top of this page shows when it last changed.