Privacy Policy
This Privacy Policy explains how YK DIGITAL LTDA, a company registered in Brazil under company number (CNPJ) 58.092.338/0001-09 ("YK Digital", "we", "us"), collects, uses, stores, shares and protects personal data, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — "LGPD") and other applicable regulations.
By using our website, our services or our internal advertising management tools, including Cave API (caveapi.com), you acknowledge that you have read and understood this Policy.
1. Data controller
YK DIGITAL LTDA
Company number (CNPJ): 58.092.338/0001-09
Privacy contact: privacidade@caveapi.com
General contact: contato@caveapi.com
2. Data we collect
2.1. Data you provide
- Contact details voluntarily submitted by e-mail or form, such as name, e-mail and phone number.
- Identification details of partner companies requesting our services.
2.2. Data collected automatically
- IP address, browser type, operating system, pages visited, date and time of access.
- Cookie identifiers and advertising measurement technologies (pixels), where applicable.
2.3. Advertising account data obtained through APIs
We operate our own campaign management tools. When the owner of an advertising account grants us express authorization, we access — through the official application programming interfaces (APIs) of advertising platforms — data relating to that account, such as:
- the structure and settings of campaigns, ad groups and ads;
- aggregated performance metrics such as spend, impressions, clicks and conversions;
- advertising assets such as creatives, product catalogs and audience lists created by the advertiser;
- technical identifiers of the account, the Business Center and linked assets.
This data belongs to the advertiser and is accessed solely to operate, optimize and report on that advertiser's campaigns.
3. How we use data
- Service delivery: to create, run, monitor and optimize advertising campaigns for the accounts that authorize us.
- Reporting and analytics: to consolidate performance metrics and produce dashboards tracking spend and return.
- Operational automation: to apply management rules defined by the advertiser, such as pausing or adjusting budgets based on performance.
- Communication: to respond to requests and provide support.
- Security and legal compliance: to prevent fraud and comply with legal and regulatory obligations.
4. Legal bases
We process personal data on the following LGPD legal bases: performance of a contract (art. 7, V), compliance with a legal or regulatory obligation (art. 7, II), legitimate interests (art. 7, IX) and consent (art. 7, I), where required.
5. Data obtained through TikTok APIs
We use the official TikTok for Business APIs to manage advertising campaigns for the ad accounts that grant us authorization. With respect to such data, we commit to the following:
- Limited purpose: data is used only to operate, optimize and report on the campaigns of the ad account that granted the authorization.
- No commercialization: we do not sell, rent or license this data to third parties.
- No improper cross-use: we do not combine data from different ad accounts for purposes unrelated to managing each account, nor do we use it to build profiles of individuals.
- Minimal retention: we retain data only as long as necessary for the purpose, and delete it when authorization is revoked or the data is no longer needed.
- Revocation: the advertiser may revoke our authorization at any time, directly in their account settings on the platform. Revocation immediately terminates our access.
- Compliance: we comply with applicable TikTok terms and policies, including commercial product and data terms, as well as applicable data protection laws.
6. Data sharing
We do not sell personal data. We may share it in the following cases:
- Advertising platforms (such as TikTok, Meta and Google), strictly to deliver and measure the contracted campaigns.
- Infrastructure and software providers acting as processors under contract and confidentiality obligations, such as hosting, database and e-mail delivery.
- Public authorities, where required by law or court order.
7. International transfers
Some of our service providers are located outside Brazil. In such cases, we adopt appropriate contractual safeguards under articles 33 and following of the LGPD.
8. Retention and deletion
We retain data for as long as necessary to fulfil the purposes described in this Policy or to comply with legal obligations. Once the purpose ends, data is securely deleted or anonymized.
9. Security
We adopt technical and administrative safeguards, including need-based access control, encryption in transit, storage of credentials in secret vaults, and access logging. No system is entirely immune to incidents; in the event of a material incident, we will notify data subjects and the Brazilian Data Protection Authority as required by law.
10. Your rights
You may at any time request: confirmation that processing exists; access to your data; correction of incomplete or outdated data; anonymization, blocking or deletion; portability; information about data sharing; and withdrawal of consent. Simply write to privacidade@caveapi.com. We will respond within the statutory deadlines.
11. Cookies and measurement technologies
Our website and campaign pages may use cookies and measurement pixels to assess advertising performance. You can manage cookies in your browser settings; disabling them may affect some functionality.
12. Children's data
Our services are intended for companies and individuals over the age of 18. We do not knowingly collect data from minors.
13. Changes to this Policy
We may update this Policy to reflect legal or operational changes. The date of the latest update is always shown at the top of this page.
14. Contact
Questions, requests or complaints regarding privacy: privacidade@caveapi.com.