Privacy Policy

1. Who we are

IMHIO LTD, Cyprus, is the operator of Iteralift and the controller for the processing described here.

Use our privacy contact form for questions and requests. This policy covers our public website, operator accounts, organization administration, technical operations and the internal Meta integration described below. A funnel or external product may provide a separate notice identifying its operator and its specific processing. This policy does not replace that notice or another company’s policy.

2. Data we handle

• Accounts and access: identity-provider identifiers, email addresses, account verification, organization memberships, roles, invitations, session records and authentication assurances. Password and MFA credentials are handled by our identity service; they are not ordinary workspace analytics.
• Workspace operations: projects, funnel configurations, assets, releases, domains, experiment settings, approvals and audit records, including the operator associated with an action. Content supplied by a team member can itself contain personal data.
• Technical delivery: document requests, timestamps, limited load timing and error signals, session or attempt identifiers and the version being served. In explicitly configured closed tests, technical delivery measurements and experiment assignment records can be collected before analytics consent. They do not establish that a person saw or interacted with content.
• Optional funnel analytics: after the applicable consent, screen visibility, interactions, progression and experiment exposure events. Sensitive answers, email addresses and payment details are excluded from general analytics by default. Current closed tests require fictional answers.
• Contact requests: the reply email, request category and message you submit, and subsequent correspondence. Hosting and email providers also process the technical information needed to deliver and protect these services, which can include network addresses and delivery logs.

We obtain data from you, authorized team members, your use of the service and, when connected, the authorized Meta APIs. We do not buy customer contact lists for this service.

Cookies and similar storage

The public pages and contact form do not set cookies or include advertising pixels, third-party analytics or tracking scripts. The signed-in workspace uses necessary cookies for authentication and security. Funnel sessions and experiments use the storage described in their applicable notices; optional visibility and interaction analytics follow the consent settings for that funnel. A cookie or session expiring does not mean every related audit or database record is immediately erased.

3. Meta integration

The initial integration is intended to let authorized members of our own team create and manage campaigns, ad sets, advertisements and creatives, and read aggregated advertising performance for our own advertising accounts.

When connected, the integration will process the account and asset identifiers needed for those operations, campaign and creative content, settings, aggregate metrics, authorization permissions and access tokens. Meta-provided identifiers or creative content can be personal data even when performance reporting is aggregated. We use this information to perform authorized advertising operations, report results, troubleshoot and protect the connection.

The initial scope excludes Lead Ads submissions, uploading customer lists or Custom Audiences based on those lists, and sending funnel answers, visitor email addresses or payment details to Meta. The public privacy pages contain no Meta pixel. We do not sell Meta Platform Data or use it for unrelated purposes.

Access is limited to authorized team members and service components that need it. We do not ask for your Meta password. See data deletion instructions to request removal of connected data or revoke a connection. Meta handles its own services under the Meta Privacy Policy. We will update this notice before materially expanding the integration’s data use or audience.

4. Why we use personal data

We use account and operational data to provide access, manage authorized work and protect the service. Our legal bases are contract where necessary to provide an agreed service, and legitimate interests in administering and securing our business and internal advertising operations. Optional analytics relies on the applicable consent. We handle rights requests and required records to meet legal obligations, and other correspondence under our legitimate interest in responding to enquiries. Required account or contact information is needed to provide the requested access or response.

Iteralift does not currently make solely automated decisions producing legal or similarly significant effects on individuals. Random assignment of test variants and aggregate advertising reports are used to evaluate content and service performance.

5. Sharing and international processing

Access within Iteralift is governed by separate organization memberships and roles. An account’s membership in one organization does not by itself provide access to another organization’s data.

We use Railway for hosting and storage, Resend for service emails and contact-form delivery, Cloudflare for domain/DNS services, and our configured business mailbox to receive and answer requests. These providers handle the information necessary for their functions. Our identity service uses Keycloak software. Meta receives authorized API requests when the integration is connected. We may also disclose information where required by law or to professional advisers assisting with legal or security matters.

Provider operations can involve processing outside Cyprus and the European Economic Area. Applicable safeguards may include adequacy decisions or standard contractual clauses. Contact us for information about relevant transfers and safeguards. We do not represent that every provider or support operation is located in the EU.

6. How long data is kept

Retention depends on the purpose and record type. In the currently configured closed funnel analytics tests, raw events are retained for 93 days and report projections for 186 days. These limits do not apply to every account, security record, mailbox or backup.

Account, membership and configuration records are kept while needed to operate the workspace, followed by deletion or restricted retention where needed for security, disputes or legal obligations. Request correspondence is kept as needed to resolve the request and document its handling. Backup and provider-log retention follows the relevant operational schedules; deleting active records does not instantly remove every backup copy.

For a connected Meta account, we keep authorization and operational data only while needed for the authorized connection and its stated purposes, subject to applicable Meta requirements. On disconnection or a valid deletion request, we remove or restrict related data as appropriate, retaining only what is required for a specific legal obligation. The integration’s final storage and deletion settings will be checked before it is enabled.

7. Security

We use encrypted transport, role-based access, organization-level data isolation, MFA for protected operations and scoped access for agents and external services. Secrets are kept out of public pages and ordinary analytics. No internet service can guarantee that data will never be exposed. Access by infrastructure operators remains subject to operational controls; this policy does not promise that secrets are inaccessible to the infrastructure owner.

8. Your choices and rights

Where applicable, you may request access, correction, deletion, restriction or portability, object to processing, or withdraw consent without affecting earlier lawful processing. We may need to verify your identity and authority. We normally respond within one month; complex requests may take up to two additional months, with an explanation within the first month. You may complain to the Cyprus Commissioner for Personal Data Protection or your local supervisory authority.

Use the contact form or the postal address below. Our deletion instructions explain what to include. A request does not automatically erase all records; we will explain any applicable limits. The operator workspace and internal advertising tools are intended for authorized adult team members, not children.

9. Contact and changes

Send a privacy request

You can also write to IMHIO LTD, Privacy requests, at:

We will update this page when our processing changes and revise the effective date. Material changes requiring a new notice or consent will be addressed before the affected processing begins.