Privacy Policy

eXpand AD LLC ("we," "our," "us," or "Company"), a digital marketing agency based in Watertown, South Dakota, United States, is committed to protecting your privacy and ensuring you have a positive experience on our website and when interacting with our services. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you visit our website, use our services, or interact with our digital marketing campaigns, including social media retargeting activities.

This Privacy Policy applies to all users, customers, and visitors worldwide, with specific compliance provisions for residents of the European Union (GDPR), the State of California (CCPA/CPRA), the State of Texas (TDPSA), and Canada (PIPEDA).

By using our website or services, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access our website or use our services.

As a digital marketing agency, eXpand AD LLC operates subject to the following compliance frameworks:

• ISO/IEC 27001:2022 Information Security Management System certification
• SOC 2 Type II compliance with controls for security, availability, and confidentiality
• General Data Protection Regulation (GDPR) for data subjects in the EU and EEA
• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• Texas Data Privacy and Security Act (TDPSA)
• Personal Information Protection and Electronic Documents Act (PIPEDA) for Canadian data subjects

3.1 Information Provided Directly by You

When you use our services or interact with our website, you may provide us with the following information:

• Contact Information: name, email address, phone number, mailing address, company name, and job title
• Account Information: username, password (encrypted), account preferences, billing details, and payment information
• Campaign Data: advertising preferences, targeting parameters, audience segments, and marketing objectives
• Communications: messages, inquiries, feedback, support tickets, and any information you voluntarily provide via email or contact forms

3.2 Automatically Collected Information

When you visit our website or use our services, we automatically collect:

• Usage Data: pages visited, time spent on site, clicks, referral sources, and navigation patterns
• Device Information: IP address, browser type and version, operating system, device identifiers, and mobile device information
• Location Data: approximate geographic location (city, state, country) derived from IP address
• Cookies and Similar Technologies: persistent and session-based cookies, web beacons, pixels, and local storage identifiers
• Analytics Data: user behavior metrics, conversion tracking, and engagement statistics

3.3 Social Media Platform Data

As a digital marketing agency specializing in social media campaigns and retargeting, we collect and process data through:

• Meta (Facebook, Instagram): user identifiers, engagement metrics, conversion events, pixel data, and audience segment information
• Google Platforms (Google Ads, Google Analytics, YouTube): conversion tracking, audience segments, remarketing lists, and interaction data
• LinkedIn: professional profile data, engagement metrics, and B2B audience segments
• TikTok: user engagement data, audience analytics, and campaign performance metrics
• Twitter/X: engagement data, audience insights, and advertising metrics
• Pinterest: user engagement, audience interests, and conversion tracking
• Snapchat: audience segments, engagement metrics, and advertising conversion data

3.4 Third-Party Data Sources

We may receive data from third-party sources, including:

• Data Brokers: aggregated audience segments, interest categories, and demographic information
• Client Partners: customer lists, prospect databases, and engagement history for campaign purposes
• Analytics Providers: aggregated insights from web analytics and attribution platforms
• Service Providers: information shared through integrated tools and platforms

We collect information through the following methods:

• Direct collection: When you fill out a contact form, request a strategy call, sign a contract, or communicate with our team.
• Account and portal registration: When you create or access your client portal account.
• Automated collection: Through cookies, web beacons, pixels, and similar tracking technologies on our website.
• Third-party platforms: From advertising platforms (Google, Meta, TikTok, LinkedIn) and analytics tools in the course of managing your campaigns.
• Referrals: From partners, affiliates, or referral sources who introduce you to our services.

We use the information we collect for the following purposes:

• Delivering, managing, and improving the marketing services described in your SOW/MSA
• Processing payments and managing your account and billing
• Communicating with you about your account, campaigns, and service updates
• Sending performance reports, strategy recommendations, and service-related notifications
• Analyzing and optimizing advertising campaign performance
• Providing customer support and resolving disputes
• Complying with legal obligations, enforcing our Terms of Service, and protecting against fraud
• Conducting internal analytics, service improvement, and business development activities
• With your consent, featuring your results in case studies or portfolio materials

We will not sell, trade, or rent your personal information to third parties for their own marketing purposes without your explicit consent.

If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using your personal information depends on the specific information concerned and the context in which we collect it. We process your data under the following legal bases:

• Contract performance: Processing necessary to fulfill the services outlined in your MSA/SOW.
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving services, preventing fraud, and maintaining security, where those interests are not overridden by your rights.
• Legal obligation: Processing required to comply with applicable laws and regulations.
• Consent: Where we have asked for and received your consent (e.g., for marketing communications or case study features). You may withdraw consent at any time.

We do not sell your personal information. We may share your information in the following limited circumstances:

7.1 Service Providers

We engage trusted third-party vendors (payment processors, email platforms, analytics providers, cloud infrastructure) who access data only to the extent necessary to perform services on our behalf and are bound by confidentiality obligations.

7.2 Advertising Platforms

In delivering your campaigns, we access and operate within advertising platforms (Google, Meta, TikTok, LinkedIn). Data shared with these platforms is governed by their respective privacy policies and your account agreements with them.

7.3 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or regulatory authority, or if we believe disclosure is necessary to protect the rights, property, or safety of eXpand AD LLC, our clients, or the public.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

Our services involve the use of third-party platforms and tools. The following providers may process your data or your clients' data as part of our service delivery:

• Google (Ads, Analytics, Tag Manager, Search Console): Google Privacy Policy
• Meta (Facebook Ads, Instagram): Meta Privacy Policy
• TikTok For Business: TikTok Privacy Policy
• LinkedIn Marketing Solutions: LinkedIn Privacy Policy
• Stripe (payment processing): Stripe Privacy Policy

We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies.

We use cookies and similar tracking technologies to collect and track information about your use of our website and to improve user experience. Cookies are small data files placed on your device.

We use the following categories of cookies:

• Strictly necessary: Essential for the website to function properly (session management, security).
• Analytics and performance: Help us understand how visitors interact with our website (Google Analytics).
• Marketing and advertising: Track visitors across websites to display relevant advertisements (Google Ads, Meta Pixel).
• Functional: Remember your preferences (language, theme, consent choices).

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, some portions of our website may not function properly. You may also opt out of analytics tracking by visiting Google Analytics Opt-out.

If you are a resident of Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) provides you with specific rights and protections regarding your personal information. PIPEDA applies to eXpand AD LLC's collection, use, and disclosure of personal information in the course of commercial activities.

10.1 Accountability and Privacy Officer

eXpand AD LLC designates a Privacy Officer responsible for ensuring compliance with PIPEDA and this Privacy Policy, including receipt and response to privacy complaints, and communication with the Office of the Privacy Commissioner of Canada. Inquiries regarding PIPEDA compliance should be directed to our Privacy Officer at admin@expandad.com.

10.2 Purposes and Identifying Purposes

We collect personal information only for identified, specific, and legitimate purposes disclosed to you before or at the time of collection. Specific purposes include:

• Delivering our marketing and advertising services
• Executing campaigns and optimizing performance
• Processing payments and billing
• Maintaining account security and fraud prevention
• Analyzing usage and improving our services
• Complying with legal obligations

We do not use or disclose personal information for any purpose other than those identified unless we obtain your explicit consent or are required by law.

10.3 Consent

We obtain meaningful consent from you before collecting, using, or disclosing personal information, except where PIPEDA permits implied consent or where collection is necessary for the services you have requested. You may withdraw consent at any time, subject to legal or contractual restrictions. If you withdraw consent for essential processing (e.g., billing information), we may be unable to continue providing our services, and you will be notified of the consequences.

10.4 Limiting Collection

We collect only the personal information that is necessary and appropriate for the identified purposes. We do not collect information indiscriminately or in excess of what is required to deliver our services or comply with legal obligations.

10.5 Limiting Use, Disclosure, and Retention

We limit the use of personal information to the purposes for which it was collected, unless you consent otherwise or we are required by law. We disclose personal information only to service providers, partners, and third parties who are bound by confidentiality and data processing agreements. Once personal information is no longer required, we securely destroy or anonymize it, unless retention is required by law or contract.

10.6 Accuracy

We maintain personal information in an accurate, complete, and up-to-date form. You are responsible for providing accurate information and notifying us of any changes. We will make reasonable efforts to correct inaccurate information upon your request.

10.7 Safeguards

We implement comprehensive safeguards to protect personal information from loss, theft, unauthorized access, modification, and disclosure. Safeguards include encryption, access controls, multi-factor authentication, vulnerability management, employee training, and incident response procedures.

10.8 Openness

We are open and transparent about our privacy practices and policies. This Privacy Policy clearly describes our policies and practices regarding the handling of personal information in a simple, understandable format. You can access this information at any time, and we respond to inquiries about our privacy practices within 30 days.

10.9 Individual Access

Upon request, we will provide you with access to personal information we hold about you, including the purposes for which it was collected and the third parties to whom it may have been disclosed. To request access, submit a written request to admin@expandad.com with "PIPEDA Access Request" in the subject line. We will respond within 30 days.

10.10 Challenging Compliance

If you believe eXpand AD LLC is not complying with PIPEDA, you have the right to challenge our compliance. Submit a written complaint to admin@expandad.com with "Privacy Complaint" in the subject line. We will acknowledge receipt within 5 business days and investigate within 30 days. If unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada to file a formal complaint.

10.11 Cross-Border Data Transfers

eXpand AD LLC is based in the United States and may transfer Canadian personal information to the United States for processing. We ensure personal information transferred outside Canada is protected by appropriate safeguards, including Standard Contractual Clauses and Data Processing Agreements that comply with PIPEDA requirements.

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Client account data: Retained for the duration of the engagement plus 7 years for legal and tax compliance purposes.
• Campaign performance data: Retained for 5 years post-engagement to fulfill audit and reporting obligations.
• Contact and inquiry data: Retained for 3 years from last contact.
• Website analytics data: Retained for up to 26 months per Google Analytics default settings.
• Communications and support records: Retained for 5 years.

When retention periods expire, we securely delete or anonymize personal information so it can no longer be associated with you.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability: Request that we provide your personal information in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing purposes.
• Restriction: Request that we restrict processing of your information in certain circumstances.
• Withdrawal of consent: Where processing is based on consent, withdraw it at any time without affecting lawfulness of prior processing.

To exercise any of these rights, please contact us at admin@expandad.com. We will respond within 30 days. We may need to verify your identity before processing requests.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you over the past 12 months.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out: You have the right to opt out of the sale or sharing of your personal information. We do not sell personal information as defined under CCPA/CPRA.
• Right to Limit Use of Sensitive PI: You may direct us to limit our use of sensitive personal information to only what is necessary to perform services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To submit a verifiable consumer request, contact us at admin@expandad.com. We will acknowledge your request within 10 days and respond within 45 days.

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information as quickly as possible.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at admin@expandad.com.

eXpand AD LLC is headquartered in Watertown, South Dakota, USA. If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where our servers are located and our central database is operated.

For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards including Standard Contractual Clauses approved by the European Commission, or other legal transfer mechanisms as applicable.

By using our services, you consent to the transfer of your information to the United States and its processing in accordance with this Privacy Policy.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our systems
• Encrypted storage for sensitive data at rest
• Role-based access controls limiting data access to authorized personnel
• Regular security assessments and vulnerability testing
• Multi-factor authentication for internal systems and client portal access
• Regular security training for all staff with access to client data

Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. In the event of a data breach that affects your rights or freedoms, we will notify you and the relevant supervisory authorities as required by applicable law within 72 hours of becoming aware of the breach.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

eXpand AD LLC — Privacy Team

Email: admin@expandad.com

Address: Watertown, South Dakota, United States

Response Timeframe: Within 30 days of receipt

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the revised policy on our website with an updated effective date. For material changes, we will notify active clients by email with at least 14 days advance notice.

Last Updated: June 4, 2026

©2026 eXpand AD LLC. All rights reserved.
Watertown, South Dakota, USA

eXpand AD LLC is headquartered in Watertown, South Dakota, USA. Please be advised that in the course of providing our services, we may process, store, and transfer your information within the United States and internationally.

We are committed to maintaining the highest standards of data privacy and compliance. If you have any questions, or if you believe there is a compliance concern regarding how your data is handled, please feel free to reach out to us. We will make every effort to address and resolve your inquiry promptly.

eXpand AD LLC — Data Privacy Team

Email: admin@expandad.com

Address: Watertown, South Dakota, United States