The practical controls we use when handling client information, files and account access. Last updated 22 October 2026.
We ask for named user invitations with the lowest permission level that supports the work. If a platform cannot support this, use a temporary password shared through a secure password manager and change or revoke it after the task.
Google Ads, Meta Ads, LinkedIn Ads and similar accounts remain owned and billed by the client. We use access only for the agreed campaign, setup, optimisation and reporting. We do not export audiences, payment details or account data for unrelated work.
Send only information needed for the project. We store working files in the tools used for the engagement, restrict access to the people doing the work, and avoid keeping credentials in documents or chat threads. Never send a plain-text password if a secure invitation is available.
We may use reputable hosting, design, project-management, storage, analytics, form or advertising platforms selected for the project. Their processing is governed by their own terms and privacy notices. We will identify material third-party tools in the project scope where relevant.
At project close, we hand over agreed assets and remove our access when requested or when the agreed support period ends. We may retain limited records needed for accounting, legal compliance, backups, dispute resolution or ongoing support.
If we discover unauthorised access affecting client information under our control, we will investigate, take reasonable containment steps and notify the affected client where appropriate.
For a data-access request or project-specific security question, email hello@webmaginary.com.
