Privacy policy

WhyItWon is a creative intelligence platform for advertising teams. It reads a brand's advertising data, decodes what makes ads work, and produces analysis, briefs, and creative direction. The service is operated by Yehonatan Tav (עוסק מורשה 313201469), Tel Aviv, Israel. This policy explains what we collect, how we use it, who we share it with, and how you can delete it.

We collect only what the service needs to work:

• Account information: the email address and profile details you use to sign in.
• Meta advertising data you authorize: when you connect your Facebook or Instagram business account, we read, on your behalf and with your permission, your ad accounts, campaigns, ads, ad creative (images, video, text), performance metrics, and the public comments on your ads. We request read-only access. We do not create, edit, pause, or spend on your campaigns.
• TikTok advertising data you authorize: when you connect your TikTok Ads account through TikTok's Marketing API, we read, on your behalf and with your permission, your selected advertiser account, campaigns, ad groups, ads, creative videos and images, and performance reports. Depending on the features you use and your access, this includes audience configuration and aggregate sizes, change history, creative insights, authorized identities and Spark posts, blocked phrases, and authorized Shop products and performance. Paid-ad comments and replies may include text, public display names and identifiers, timestamps, engagement counts, visibility and links to the ad or post. We do not collect audience-member lists or Shop customer order details through this integration.
• Google Ads and Google Analytics data you authorize: when you connect Google, we read, on your behalf and with your permission, Google Ads accounts you select (including YouTube ads performance and creative metadata) and, if you choose, Google Analytics 4 property summaries for enrichment. We request read-only access to Ads and Analytics. We do not create, edit, pause, delete, or spend on your campaigns, and we do not modify your Analytics configuration.
• Shopify store data you authorize: when you install WhyItWon on a Shopify store, we read, on your behalf and with your permission, order and product data needed for true revenue and ROAS (order totals, refunds, line items, and product identifiers). We request read-only Admin API access. We do not create or edit products, orders, or store settings.
• Pinterest boards and Pins you authorize: when you connect your Pinterest account in Characters, we read, on your behalf and with your permission, your Pinterest profile name and picture, your boards, and your Pins, and we search your own Pins, so you can browse them in WhyItWon. We request read-only access. We do not create, save, edit, or delete Pins or boards, and we do not search other people's Pins.
• Usage information: basic logs of how you use the dashboard, so we can operate and improve it.

We use the data to:

• analyze your ad creative and explain why it wins or loses;
• generate insights, creative briefs, and creative direction for your next ads;
• display your performance in your private dashboard;
• operate, secure, and improve the service.

We do not sell your data. We do not use your Meta, TikTok, Google, Shopify, or Pinterest data for advertising to you or to anyone else. We use it only to provide the analysis you asked for.

Our use of data obtained through Meta's APIs follows the Meta Platform Terms and Developer Policies. Access is limited to the permissions you grant during connection, and used solely to provide the features described above. You can disconnect your Meta account at any time, which stops all further access.

We use TikTok Marketing API data only for the advertiser account you authorize and select in your workspace. Access and refresh tokens are encrypted at rest. We use the data for reporting, creative analysis and the features you request. Authorized Spark posts are not unrestricted access to public TikTok content.

TikTok has approved additional management permissions for WhyItWon. Availability varies by feature and account. Connecting an account does not approve an ad, budget change, public reply, moderation action or creator authorization. Where a management feature is available, it requires review and approval of the specific action. Drafts and recommendations do not execute themselves.

Disconnecting TikTok in Data sources removes the saved credentials and stops new imports using that connection. Requests already sent to TikTok may finish; expired import authorizations cannot save new source data. Disconnecting does not immediately erase previously imported reports, comments or derived work. Email Hello@whyitwon.comto request removal of TikTok-derived data; we confirm the scope and processing status of the request. You can separately revoke WhyItWon in TikTok Business Center or Ads Manager authorization settings to withdraw provider access.

Our use of data obtained through Google APIs follows Google's API Services User Data Policy, including the Limited Use requirements. We access only the Google Ads and Google Analytics data you authorize, store access and refresh tokens encrypted at rest, and keep that data only while your account is active or as needed to provide the service. We do not use Google user data to serve ads, sell personal information, or train generalized AI / ML models. You can disconnect Google at any time in WhyItWon Settings → Data sources, or revoke WhyItWon in your Google Account security settings (Google Account connections), which stops further access. Email Hello@whyitwon.com to request deletion of Google-derived data associated with your connection.

Our use of data obtained through Pinterest's API follows the Pinterest Developer and API Terms and Developer Guidelines. We store only your Pinterest access and refresh tokens, encrypted at rest, for your own account in the workspace where you connected it; nobody else in the workspace can browse your Pinterest. Your boards and Pins are read from Pinterest each time you view them and are not stored. Every Pin links back to Pinterest. We do not keep copies of your Pins, send them to AI models, or use them to create new content. You can disconnect Pinterest at any time in WhyItWon Characters → Pinterest, which deletes the saved tokens, or remove WhyItWon from the apps in your Pinterest settings. Email Hello@whyitwon.com with any question about Pinterest data.

Our use of data obtained through Shopify's Admin API follows Shopify's Partner and API terms, including Protected Customer Data rules. We access only the order and product data you authorize, store access and refresh tokens encrypted at rest, and keep that data only while your account is active or as needed to provide the service. We respond to Shopify's mandatory privacy webhooks (customer data request, customer redact, shop redact). You can disconnect Shopify at any time in WhyItWon Settings → Data sources, or uninstall the WhyItWon app in Shopify Admin, which stops further access. Email Hello@whyitwon.com to request deletion of Shopify-derived data associated with your connection.

We share data only with the service providers that help us run the platform, and only so they can perform that work for us:

• Supabase: database and storage hosting.
• Vercel: application hosting.
• Anthropic and Google: AI models that analyze your creative to produce insights. Content sent for analysis is not used to train their models.

We may also disclose information if required by law, or to protect the rights, safety, and security of our users and the service.

Access tokens for your connected accounts are encrypted at rest. Access to production data is restricted to the people who operate the service. We keep your data only as long as your account is active or as needed to provide the service.

You can request deletion of your data at any time in two ways:

• Email us at Hello@whyitwon.com and we will delete your account data and disconnect any linked Meta, TikTok, Google, or Shopify accounts.
• Remove the app from your Facebook settings (Settings and privacy → Settings → Business integrations). Facebook then notifies us automatically and we delete the data associated with your connection and provide a confirmation code you can track.
• Disconnect TikTok in WhyItWon to remove the stored connection credentials, and revoke WhyItWon in TikTok Business Center or Ads Manager to withdraw provider access. To remove previously imported TikTok data and derived work, email Hello@whyitwon.comwith the workspace name. We confirm the request and its processing status; disconnecting alone is not a deletion receipt.
• Revoke WhyItWon under Google Account → Connections, or disconnect Google inside WhyItWon. We then stop further access and delete the Google Ads / Analytics data and tokens associated with that connection.
• Uninstall WhyItWon in Shopify Admin, or disconnect Shopify inside WhyItWon. We then stop further access and delete the Shopify tokens and derived store data associated with that connection.

You can request access to, correction of, or deletion of your personal data, and you can withdraw your consent to connect your Meta, TikTok, Google, or Shopify account at any time. To exercise any of these, contact us at Hello@whyitwon.com.

We may update this policy as the service evolves. When we do, we will change the "last updated" date above. Material changes will be communicated through the service.

Questions about this policy or your data? Email Hello@whyitwon.com.