Privacy Policy

Effective date: 14 September 2026 · Mandala (runmandala.com)

Who we are

Mandala is a marketing analytics application operated at runmandala.com ("Mandala", "we"). It lets businesses view the performance of their own advertising by connecting the ad accounts they already manage — on Meta and on Google Ads. Each account is connected independently, and each is used only to show that business its own reporting. Contact: anirudh.dev@runmandala.com.

Meta (Facebook) data we access

When you log in with Facebook and grant the requested permissions, Mandala accesses, through Meta's APIs:

• Your name and Facebook user ID (basic profile).
• The list of businesses you manage and their verification status (business_management permission).
• The list of ad accounts you can access, and their advertising performance metrics — spend, impressions, clicks, reach, CTR, CPM and conversion metrics (ads_read permission).

Google user data we access

When you connect a Google Ads account, Mandala requests the read-only Google Ads reporting scope (https://www.googleapis.com/auth/adwords) and accesses, through the Google Ads API:

• The Google Ads accounts your Google login can access, and their names and IDs.
• Campaign reporting data — clicks, cost, impressions, conversions and all_conversions, at campaign level, over the date range you choose.

Mandala requests no other Google scopes. It does not read your Google profile beyond what is needed to establish the connection, does not access Gmail, Drive, Google Analytics or any other Google service, and never creates, edits or manages your campaigns — the connection is read-only.

Google API Services Limited Use

Mandala's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as necessary to provide or improve the reporting feature you requested (or as required by law), and do not allow humans to read it except with your consent, for security, to comply with law, or where the data is aggregated and anonymized.

How we use it

Solely to display your own advertising analytics back to you inside Mandala. Data from each connected account is kept isolated to the business it belongs to. We do not sell data, share it with third parties, use it for advertising or model training, or use it for any purpose other than showing you your own dashboard.

Storage and retention

Mandala keeps no server-side database of your advertising data. Performance data is fetched live from the provider's API each time you open the dashboard and is not retained after the response is rendered. Access credentials (OAuth tokens) are stored securely and only as needed to maintain your connection, and are removed the moment you disconnect. Meta access tokens are held in an encrypted session cookie in your own browser and expire with the session.

How we protect your data

Mandala applies the following measures to protect the data it accesses, including Google user data and Meta user data:

• Encryption in transit. Mandala is served only over HTTPS, and every request to the Meta and Google APIs is made over TLS-encrypted HTTPS connections.
• Encrypted credentials. OAuth access tokens are held only inside a signed, encrypted session cookie in your own browser and are never written to a server-side database. Application secrets (such as the OAuth client secret) are stored in a managed secret store (Google Secret Manager), not in code or configuration files.
• Data minimization and no server-side storage. Advertising performance data is fetched live from the provider's API on each page view and is not persisted after the response is rendered, which keeps the amount of data at rest to a minimum.
• Least-privilege access. Mandala requests only read-only reporting scopes and performs no writes; each user can access only their own accounts' data; and access to the application's infrastructure and secrets is restricted to the operator.
• Secure authentication. OAuth flows use CSRF state protection, Meta API calls are signed with appsecret_proof, and your tokens are revoked immediately when you disconnect.

If we become aware of a security incident affecting your data, we will act promptly to investigate and remediate it and will notify affected users as required by applicable law.

Data deletion and revoking access

Because no advertising data is stored server-side, deletion is immediate. You can revoke access at any time:

• In Mandala: click Disconnect in the dashboard — this revokes the permissions you granted and clears the connection and session.
• From Meta: remove Mandala at Settings & Privacy → Settings → Apps and Websites and send a data deletion request. Our deletion callback confirms it and issues a confirmation code you can check at runmandala.com/deletion-status.
• From Google: remove Mandala's access at myaccount.google.com/permissions, which invalidates the token Mandala holds for your Google Ads account.
• By email: write to anirudh.dev@runmandala.com and we will delete any data associated with your account.

Requests from public authorities

If a public authority requests personal data about Mandala users, our policy is to: (1) review the legality of the request before responding, and seek legal counsel where appropriate; (2) challenge requests we consider unlawful; (3) disclose only the minimum information necessary to comply with a valid request; and (4) document each request, our response, the legal basis, and the parties involved. Note that Mandala stores no advertising data at rest — it is fetched live from the connected providers' APIs and not retained — which inherently limits what could be produced in response to any request.

Cookies

Mandala uses a single first-party session cookie, required for login. No analytics or tracking cookies are set.

Changes

If this policy changes, the effective date above is updated and the current version is always available at this URL.