Who we are

Blackbox is an AI media buyer that works for the advertiser across every channel, and proposes rather than spends. It reads campaigns on Meta, Google, TikTok, Snapchat and LinkedIn, recommends changes, and makes a change only after you approve it.

Blackbox is operated by Blackowl Pte Ltd, a company registered in Singapore. Blackowl Pte Ltd is the data controller for the information described in this policy, including data we read from advertising platforms on your instruction.

What we collect

Account information — name, email and organization you provide when you sign up, authenticated via Google.
Connected ad-account data — when you connect a Meta, Snapchat, TikTok, Google or LinkedIn ad account, we read campaign metadata, performance metrics, and (with explicit approval) execute campaign-management actions you've authorized. We never sell this data, and we never share it for anyone else's advertising or for any purpose of our own beyond running Blackbox for you. It is processed only by us and by the service providers listed below, each acting on our instructions.
Connected social and search data — when you connect an Instagram or TikTok account, we read your posts, their results and your follower counts, and we publish a post only when you press Publish or at the time you scheduled it. When you connect Google Search Console, we read your site's search performance; that connection is read-only.
Websites and public pages — when you add a brand, we read its website: the home page, up to two linked pages, and its blog feed. If the site can't be read, we look it up in Google's search results and Google Maps instead, and, if you give us the link, on its public Instagram or Facebook page. When we build your strategy, we read the public websites, social posts and ads of the competitors you name or we find. We read only public pages and never sign in to them. How our reader works.
Files you upload — documents you upload for AI indexing are stored encrypted at rest and used only to answer your team's queries.
Usage telemetry — basic logs of in-app actions for reliability and security.

How we use it

We use the data above to provide the product, generate recommendations, and execute campaign actions you approve. Connected ad-account data stays scoped to your organization; no other customer on Blackbox can see your accounts.

Analytics & cookies

On our public marketing site we use Google Analytics 4 and the LinkedIn Insight Tag to understand how visitors find us and to measure our advertising. These set cookies only after you accept them in the cookie banner — decline and they stay off. We don't use these trackers inside the authenticated app. You can change your choice at any time by clearing this site's cookies.

Third-party platforms

Blackbox integrates with Meta, Snapchat, TikTok, Google Ads, LinkedIn and similar advertising APIs via OAuth. Each platform's privacy policy applies to data we read from them. Tokens issued to Blackbox are scoped to your organization, never exposed through our API or interface, and used only on your behalf. Disconnecting a channel revokes our access at the platform and deletes the token; what else it removes is set out under Data retention & deletion below.

Service providers

We use a small number of service providers to run Blackbox. Each processes data only on our instructions, only for the purpose listed, and none of them may use it for their own purposes. This list is the same one we declare to the advertising platforms we integrate with.

Hetzner Online GmbH (Germany) — hosting and storage. Your account data and connected-platform data live here.
Cloudflare, Inc. (United States) — website hosting, DNS and network protection for traffic to and from Blackbox, and page rendering: when a site's home page turns our reader away or is built by scripts, Cloudflare's browser loads that public page for us.
Google LLC (United States) — the AI models (Gemini) that generate recommendations and the images Studio makes. Campaign performance data is sent to produce the suggestions you see in Plan.
OpenRouter, Inc. (United States) — routing for the same AI requests.
PostHog, Inc. (United States) — product analytics on in-app usage, used to improve reliability and the product itself.
DataForSEO OÜ (Estonia) — search and map data. To look up a brand in Google's search results and Google Maps, and to find and compare competitors and keywords for your strategy, we send the brand's website address, name and search terms.
Web Scraping Guy LLC (United States), which runs ScrapeCreators — reading public social media pages and ad libraries. We send the address of the Instagram or Facebook page you give us for your brand, and the public accounts of competitors we follow for your strategy.

We update this list when it changes. If you need a current copy for a vendor review, email us at the address below.

Data retention & deletion

You can disconnect or delete any connected account from Data at any time. Disconnect revokes our access, deletes the token and the ad performance numbers we synced, and keeps your organic Instagram and TikTok history and your decision history. Delete removes those too.

To delete your account and all associated data, follow the data deletion instructions or email hello@blackbox.plus. We finish within 14 days.

Contact

Questions about this policy: hello@blackbox.plus.

Privacy Policy