Privacy policy
Last updated: 19 October 2026
1. Who processes your data
The controller is Libelinha Lilaz, Lda., Portuguese company no. 519531400, registered at Praça Capitão José Santos Leite, loja 4, A, 2615-164 Alverca do Ribatejo, Portugal, which operates Sextantly under the Bigorna brand. Contact: hello@sextantly.com.
When a company uses Sextantly to read a brand's ad accounts and channels, the data from those accounts is processed on behalf of, and according to the instructions of, that company.
2. What data we process
- Account data: name, email, company, language, report preferences and the recipient addresses you provide.
- Data from the accounts you connect, read-only: campaign, ad set and ad metrics and settings (Meta Ads and Google Ads), traffic and event metrics (Google Analytics 4), search performance (Google Search Console), and reach, engagement and followers of Facebook Pages and Instagram. This is aggregated performance data; we do not collect personal data about the people who see your ads.
- Access credentials: the OAuth tokens issued by Google and Meta, stored encrypted. We never see or store your passwords.
- Billing data, processed by Stripe. We do not store card data.
- Technical logs (IP address, date and time, errors), for security and operation of the service.
3. What we use the data for
- To provide the service: read data from connected accounts, compute comparisons, generate and send reports and show trends in the app.
- To generate the analysis with suggestions, when you request it. The analysis is produced by an artificial intelligence model (Anthropic) using the aggregated report data.
- To invoice, provide support and meet legal obligations.
We do not sell data, we do not use it for advertising and we do not use it to train artificial intelligence models.
4. Data from Google APIs
Sextantly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We request only the access the service needs: Google Ads (reading metrics and settings), Google Analytics (read-only) and Search Console (read-only), plus your name and email for sign-in.
- Google Ads access is technically read and write, because Google does not offer a read-only scope. Sextantly only makes read requests and never changes your accounts.
- Data from Google APIs is used only to provide and improve user-facing features of Sextantly. It is not transferred to third parties except as necessary to provide the service, to comply with the law, or as part of a merger or acquisition with prior notice.
- It is not used for advertising, to determine creditworthiness, or to train generalised artificial intelligence models.
- No one on our team reads this data, except with your explicit consent for a specific case, where necessary for security, or to comply with the law.
5. Legal basis
Performance of the contract (providing the service you signed up for), consent (connecting each account, which you can withdraw at any time), legitimate interest (security and abuse prevention) and legal obligation (invoicing).
6. Who we share data with
With processors that help us provide the service, bound by contract: Supabase (database and authentication, servers in the European Union), Cloudflare (hosting and delivery), Lettermint (email delivery), Stripe (payments), Google Cloud (infrastructure) and Anthropic (artificial intelligence analysis).
7. International transfers
Some processors may process data outside the European Economic Area, namely in the United States. In those cases, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
8. How long we keep data
- Account data: while the account is active and up to 30 days after you close it.
- Data from connected accounts and tokens: while the connection is active. When you disconnect an account, the token is revoked and deleted immediately and that account's data is deleted within 30 days.
- Billing data: for the period required by tax law (10 years).
- Technical logs: up to 90 days.
9. Your rights
You can request access, rectification, erasure, restriction and portability, and object to processing, by writing to hello@sextantly.com. You can revoke Sextantly's access to your accounts at any time, in the app or directly at Google (myaccount.google.com/permissions) and Meta. You also have the right to lodge a complaint with the Portuguese data protection authority, CNPD (www.cnpd.pt), or with the authority in your country.
10. Cookies
This website does not use cookies. The app uses only strictly necessary cookies to keep you signed in.
11. Changes
If we change this policy in a meaningful way, we will notify you by email before the change takes effect.