Privacy & Data
Protection Policy.
YOUR PRIVACY AND DATA SECURITY ARE FUNDAMENTAL TO OUR PARTNERSHIP. WE ARE COMMITTED TO TRANSPARENCY, ENCRYPTED PROTECTION, AND FULL COMPLIANCE WITH SOUTH AFRICAN PRIVACY LAWS (POPIA).
How EstrasMedia Protects Your Information
This Privacy Policy outlines how EstrasMedia (“we”, “us”, or “our agency”) collects, processes, and safeguards personal and client business information when you engage our performance marketing services, request consultation strategy calls, or access our unified ad campaign management portal across South Africa and international channels.
Collecting Operational Information
To deliver high ROAS advertising, manage ad campaigns, and facilitate client communications, EstrasMedia collects necessary business and personal data.
1. Client Onboarding & Strategy Leads
Examples: Full name, business email address, WhatsApp/mobile contact number, company name, and website URL.
Purpose: To coordinate strategy calls, analyze ad account readiness, and configure client CRM access.
Source: Provided directly by you via contact forms, WhatsApp inquiries, or strategy consultation bookings.
2. Ad Account Access & Payment Data
Examples: Ad Account IDs (Meta, Google, TikTok), business portal access permissions, and billing records.
Purpose: To configure ad campaigns, manage media spend efficiency, and process agency service retainer subscriptions.
Source: Granted directly by clients during agency onboarding via secure partner access links.
3. Account Sign-in Data
Examples: Name, email address, a securely hashed password (or your Google account identifier if you sign in with Google).
Purpose: To create, secure and identify your EstrasMedia account.
Source: Provided by you, or by Google when you choose to sign in with Google.
Connected Social Accounts
When you connect a Facebook Page, an Instagram professional account or a TikTok account to our social media automation service, you give us permission through that platform's own login screen. We never see or store your password for those platforms.
What We Receive
The account or Page ID and name, a secure access token (and, for TikTok, a refresh token) together with its expiry date, and basic profile details such as the display name. From TikTok we request only basic profile information and permission to publish posts.
What We Use It For
Only to publish the posts in your content plan to the account you connected, and to keep the connection working, for example by renewing an expiring token. We do not use these permissions to read your private messages, to post anything that is not part of your plan, or to sell or share the data.
How Long We Keep It, Disconnecting & Deletion
We keep connection details only while the account stays connected to an active subscription. You can disconnect at any time by removing EstrasMedia's access in the settings of Facebook, Instagram or TikTok. You can also ask us to permanently delete your connection details and other stored information by emailing the address at the bottom of this page.
Data Security & Access Controls
EstrasMedia employs strict server-side encryption, two-factor authentication, and restricted partner permissions across all client ad portals. We do not store raw credit card credentials; all financial billing is handled through PCI-compliant payment partners (PayFast).
Sharing Information With Strategic Partners
EstrasMedia never sells or rents client databases to third-party brokers. Information is shared strictly for service execution:
- Ad Platform Partners (Meta, Google, TikTok): Syncing audience segments and conversion tracking pixels for ad optimization.
- Payment Networks (PayFast / Banks): Encrypting transactions for retainer plans and billing processing.
- Client CRM & Messaging Tools: Enabling automated WhatsApp/SMS lead notifications for client teams.
- Social Platforms (Meta, TikTok): Receive the posts we publish to your connected accounts on your behalf.
- Hosting, Image Storage & AI Providers: Our hosting and database providers (for example Render, Vercel and MongoDB Atlas), image storage (Cloudinary) and AI tools (OpenAI) process the business information, images and instructions you give us so that we can create and publish your content.
Some of these providers store or process data outside South Africa. We only use providers that apply appropriate data-protection safeguards.
Your POPIA Rights (South Africa)
Under the Protection of Personal Information Act (POPIA), you have the right to request access to your agency records, update outdated business details, or request permanent deletion of your stored information from the EstrasMedia system at any time.
Privacy Inquiries & Data Requests
For POPIA inquiries, data removal requests, or general support, contact our legal team directly:
support@estrasmedia.com