Privacy Policy

This Privacy Policy explains what personal data Danny Clans Media Limited ("Company", "we", "us") collects through the customer dashboard at dashboard.dannyclans.systems ("Dashboard") and through DC Assistant, our assistant on Telegram, why, who sees it, how long we keep it and what your rights are. It applies to the Dashboard and DC Assistant — including to people who use DC Assistant without a Dashboard account, for example to have a landing page reviewed; the public website at dannyclans.com has its own policy.

We are the data user responsible for this data under the Personal Data (Privacy) Ordinance of Hong Kong SAR. Where you are in the European Economic Area, the United Kingdom or California, the additional rights in section 5 also apply.

1. What Information We Collect

Account Information

• Name, work email address and phone number.
• Password, stored as a salted hash and never as typed; and the two-factor secret if you turn that on.
• Business name, address, tax or registration number, and your business registration certificate, which Advertising Platforms require.

Team Members

• For each person invited to your team: name, email address, role (Admin or Manager), who invited them and when, whether they have joined, and when they last signed in. Each member has their own password and two-factor setting, stored as above.

Payment Information

• The amount, date, method and reference of each deposit, and any proof of payment you upload or send to DC Assistant.
• Card payment identifiers from our card processor. We never see or store your card number.
• For USDT, the transaction hash and the sending address as recorded on the blockchain.
• The bank account you name in your service agreement, for refunds.

Advertising Information

• The advertising accounts opened for you and their platform identifiers.
• Business Manager IDs you give us, and screenshots you upload when clearing funds.
• Every movement of money between your wallet and your accounts, and the invoices, receipts and statements that record it.
• The campaigns, ads, lead forms, pixels and audiences you create or manage through the Dashboard or DC Assistant: their settings, the images, videos and text you upload, your landing-page addresses, and the performance figures we read from the Advertising Platforms.
• The results of checks we run on your landing pages: which tracking tags were found, whether the page loaded, and policy reviews you ask for.

Facebook Connection

• If you choose "Connect with Facebook": your Facebook user ID and name, the Pages and Instagram accounts you select, and an access token, which we store encrypted and use only to list your Pages and share the ones you choose with our Business Manager.

DC Assistant (Telegram)

• If you link DC Assistant: your Telegram user ID, username and display name, and the chat ID.
• The messages, photos, documents and voice notes you send it, the transcription of each voice note, and a log of each request — what it was understood to mean and what was done. We keep the transcription, not the recording.
• Your settings (time zone, report time, alerts) and the automation rules you set up, with a record of each time a rule acted.
• In groups: the questions put to DC Assistant, and answers our own staff give, which it may learn from.

Signature and Consent

• When you sign your service agreement: the typed or drawn signature, the time, your IP address and browser, and the consent statements you ticked.
• Each time you accept the dashboard Terms, Privacy Policy and Refund Policy: the version, the date and time, your IP address, your browser identification string, how you accepted (at registration or after a change), and a SHA-256 fingerprint of the exact text shown to you. We also archive that text. Every acceptance is kept, not only the latest, and you can see and download each from the Documents page of your Dashboard.

Verification Information

• Identity or business documents you provide when we ask under our KYC & AML Verification Policy, and the result of any sanctions or blockchain-analytics check that we or our payment providers carry out.

Technical and Usage Information

• Your IP address and browser details on sign-in and on each request, the devices you have marked as trusted, and a log of actions taken in your account, showing which member of your team took each one.
• How you use the Dashboard, through the analytics and advertising tags described in section 3.
• Support tickets and messages you send us.

What you must give us, and what happens if you do not

• To open an account or join a team: your name, a work email address and a password. Without them there is no account.
• To apply for an advertising account: your business name, address, registration or tax number and registration certificate, because every Advertising Platform requires them. Applications are held until they are complete.
• When we ask under the KYC & AML Verification Policy: the documents requested. If they are not provided, the account may be suspended and deposits and refunds held until they are, as section 14 of the Terms describes.
• Everything else — a phone number, trusted devices, two-factor authentication, the Facebook connection, DC Assistant, support messages — is voluntary. Not giving it limits only the feature it belongs to.

Where you give us personal data about other people — directors, owners, an authorised representative, the colleagues you invite — you confirm that you are entitled to, and that you have told them where to find this policy. You can keep your own details up to date on the Profile page at any time, and we will correct anything you tell us is wrong.

2. How We Use Your Information

• To run your account: verify deposits, move money as you instruct, open and manage advertising accounts, issue invoices, receipts and statements, and answer support.
• To apply to Advertising Platforms on your behalf, which means submitting your business details and documents to Meta, Google, TikTok and others as part of applications you ask us to make.
• To run the campaign tools: create and change campaigns, ads, lead forms, pixels and audiences on the Advertising Platforms as you instruct, read back their performance, and check your landing pages.
• To run team access: send invitations, let each member sign in, apply their role, and record who did what.
• To run DC Assistant: understand your messages, pictures and voice notes, answer you, carry out what you confirm, run the rules you set, and send the reports and alerts you choose.
• To keep the Dashboard safe: recognising sign-ins from unfamiliar devices, unusual payment patterns, and misuse.
• To understand how people find and use the Dashboard and to measure our own advertising, as section 3 describes.
• To meet our legal obligations: keeping business and tax records, preventing money laundering, checking that we are not dealing with sanctioned parties, and responding to lawful requests.
• To tell you things about your account — a deposit cleared, an application decided, an agreement to sign, a daily report you asked for. We do not send marketing from the Dashboard or DC Assistant.

We will not use your data for any purpose not listed here, or for direct marketing, without first telling you and obtaining your express consent; you would be able to opt out at any time, free of charge.

3. Cookies and Tracking Technologies

Cookies the Dashboard needs

The Dashboard sets two cookies of its own: one to keep you signed in, which also protects your forms against forgery and expires after eight hours without activity, and one to remember a device you have chosen to trust for fifteen days. If your browser blocks them, you cannot sign in. The Dashboard also saves your display and sound preferences in your browser; they never leave it.

Analytics and advertising tags

The Dashboard also loads Google Tag Manager with Google Analytics 4, and the Meta Pixel. They set their own cookies and tell Google and Meta which pages are visited, from which browser and IP address, and when key steps happen — creating an account and adding funds, with the amount. When you are signed in, Google Analytics also receives a user ID: a one-way code made from your customer number, from which neither Google nor anyone else can work back to you. We use this to understand how people find and use the Dashboard and to measure our own advertising. Meta also receives the same key steps directly from our server (its Conversions API), with your IP address, your browser identification, the Meta cookie identifiers in your browser, the page address and, for added funds, the payment method; your email address and customer number are turned into a one-way SHA-256 code before they leave us, and Meta never receives them in plain text. Blocking these cookies, or using the ad and privacy settings of your Google and Meta accounts, does not stop the Dashboard from working.

The Dashboard's fonts are loaded from Google Fonts and Fontshare, which receive your IP address and browser details to serve them.

4. Who We Share It With, and Do Not Sell

• Our staff, on a need-to-know basis with permissions set per role. Access to money-moving functions and to your bank details is restricted, and every action is logged.
• The other members of your team, who see your company's account according to their role.
• Advertising Platforms, when you ask us to apply, to share an account or a Page, or to run a campaign: your business details and documents, the Business Manager IDs you give us, and the campaigns, creative, targeting, lead forms and landing pages you create. They send back the performance figures we show you.
• Payment providers: our card processor (currently Stripe) receives what a card payment needs; our USDT payment provider (currently OSL) sees transactions to the addresses it issues for you and may carry out its own blockchain-analytics and sanctions screening of the sending address; our banking provider (currently Airwallex) sees incoming transfers and their remitter details. Each has its own privacy policy for data it holds in its own right.
• Telegram, which carries every message between you and DC Assistant under its own privacy policy.
• Our AI provider (currently Anthropic) receives, in order to interpret them and answer you: the text and screenshots you send DC Assistant, the names and figures of your accounts and campaigns needed for the answer, the rules you describe, the content of landing pages it reviews, and, in groups, the questions asked and our staff's answers. Our speech-to-text provider (currently Groq) receives voice notes in order to transcribe them. Both act on our instructions under their business terms. We do not send them your password or card details, nor bank details other than what appears on a payment screenshot you send.
• Google and Meta, for the analytics and advertising tags described in section 3.
• Screening services, if we use them, receive only the name or address being checked and return a result.
• The providers who host the Dashboard and deliver our email, including the sign-in codes, invitations and notifications it sends you, under contracts that limit what they may do with the data and how long they may keep it.
• Regulators, courts and law enforcement where the law requires it, and professional advisers under a duty of confidence.

We do not sell personal data for money, and we do not share it with anyone for their own marketing. If you are a California resident: the Meta Pixel and Google tags described in section 3 may count as "sharing" for advertising under California law; you can opt out by blocking those cookies or by writing to us, and we will stop sending your events to Meta.

5. Your Rights

Everyone (PDPO)

You may ask whether we hold personal data about you, ask for a copy of it, and ask us to correct it. Write to the Data Protection Officer at help@dannyclans.com or at the address in section 10; we respond within forty days and may ask you to prove who you are first. We may charge a fee for a copy, which will not be excessive. If we cannot meet an access request we will tell you in writing within forty days and say why. If we decline to correct something because we believe it is accurate, we will say why and attach your version to the record so that anyone reading it sees both. You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong SAR.

You can disconnect DC Assistant at any time from Profile → Telegram or with /unlink, remove your Facebook connection with the Disconnect button on the Ad identity page or in your Facebook settings, and ask us to delete your DC Assistant conversation log.

EEA and UK residents (GDPR)

In addition: the rights to erasure, to restrict processing, to data portability, to object, and to withdraw consent where processing is based on it. Our lawful bases are performance of our contract with you, our legal obligations, and our legitimate interest in running the Dashboard safely and measuring our own advertising. You may complain to your local supervisory authority.

California residents (CCPA)

In addition: the rights to know what we collect and whether it is sold or shared, to delete, to opt out of sale or sharing, and not to be discriminated against for exercising these rights.

Retention periods in section 6 limit erasure: records the law requires us to keep are kept for that period even after a request.

6. Data Retention

• Financial records — deposits, top-ups, clearances, invoices, receipts, statements and the ledger behind them: seven years after the transaction, as tax and company law require.
• Your signed service agreement and the record of your acceptance of our Terms: seven years after your account closes.
• Account information, including your team members' details: while your account is open and for three years after it closes, or after a member is removed.
• Business documents you uploaded: while your account is open and for as long as an application made with them may be questioned by an Advertising Platform, then deleted.
• Campaign information and the creative you uploaded: while your account is open and for one year after it closes. The copies held by the Advertising Platforms are kept under their own policies.
• The Facebook connection: until you disconnect it, or until a week after the token expires, which Meta sets at about sixty days.
• DC Assistant: the conversation log, voice-note transcriptions and the record of each time a rule acted, twelve months; your settings and rules, until you delete them or disconnect. Voice recordings are not stored. Questions and answers learned in groups are kept until we remove them, and contain no account data.
• Sign-in codes and trusted-device records: deleted once they expire.
• The activity log of actions taken in your account, which is part of the audit trail of the financial records: as long as those records.
• Support tickets: three years after they are resolved.

When you close your account we delete or anonymise everything not covered by a period above.

7. Security

Connections are encrypted. Passwords are stored as salted hashes. Two-factor authentication is available to you and your team and required for our staff. Tokens that let us act on your Facebook account are stored encrypted. Uploaded documents and generated agreements are stored outside the public web root and served only to the account they belong to. Staff access is by role and is logged. Bank details on an agreement are visible only to staff who need them to pay refunds.

No system is perfectly secure. If we learn of a breach that affects your data we will tell you without undue delay, what we know and what we are doing, and we will notify the Office of the Privacy Commissioner for Personal Data where its guidance calls for it. We keep a record of every security incident, whether or not it is reported.

8. Automated Checks and International Transfers

We do not make decisions about you by automated means. DC Assistant uses AI to understand what you ask and to suggest actions, but it acts only on your Confirm tap or on an automation rule you set up yourself, and a rule acts only on your own campaigns in the way you told it to. Our USDT payment provider may apply its own screening to incoming payments, and our card processor to card payments; if a payment is held as a result, a member of our staff reviews it and decides what happens, and you may ask us to reconsider and to explain the outcome.

The Dashboard is hosted on servers we control with an infrastructure provider in Germany, in the European Union. Our card processor operates from the United States and Singapore, our banking provider from Australia, Singapore and Hong Kong SAR, our USDT provider from Hong Kong SAR, and our AI and speech-to-text providers from the United States. Telegram, Google, Meta and the other Advertising Platforms process data in many countries. Where personal data leaves Hong Kong SAR we transfer it only to providers who commit in writing to protect it to a standard equivalent to this policy, or, for the Advertising Platforms and Telegram, when you ask us to use them.

9. Children

The Dashboard and DC Assistant are for businesses and are not intended for anyone under 18. We do not knowingly collect data from children; if we learn we have, we delete it.

10. Contact Us

Questions and requests about your data, including access and correction requests, go to the Data Protection Officer, Danny Clans Media Limited, S022, 2/F, The Capital, 61–65 Chatham Road South, Tsim Sha Tsui, Hong Kong, or by email to help@dannyclans.com.

11. Last Updated

This policy was last updated on 2026-09-26. If we change it in a way that matters we will show you the new version in the Dashboard and ask you to accept it; the version you accepted, and when, is recorded against your account.