Privacy Policy
Last updated: 7 October 2026
Access29 is a client access management service operated by Around29. It collects the account details agencies provide, the client records they create, and the platform permissions a client approves. Platform tokens are encrypted at rest, passwords are never collected from clients, and data is deleted when you delete it.
This policy covers the Access29 application at app.access29.online, the access-request links we generate on an agency’s behalf, and this website.
Who we are
Access29 is a product of Around29. For anything in this policy, including requests about your data, contact support@access29.online.
Two kinds of people use Access29, and the distinction matters throughout this policy. Agencies hold an account and create access requests. Clients do not need an account — they open a link an agency sent them and approve access to platforms they already own.
Information we collect
Agency account and workspace. Your name, email address, a hash of your password, and an avatar URL if you set one. Your notification preferences, the time you last signed in, and whether your email is verified. Your workspace name, URL slug, plan, stated primary use case, and your branding settings (company name, logo, favicon, brand colour, support email, custom domain, and the welcome and completion messages shown to clients).
Sign-in sessions. For each active session we store a hash of the session token, its expiry, and the browser user-agent string and IP address the session was created from. These let you review and end sessions, and let us detect abuse.
Client records you create. The company name, and optionally a contact name, email address, website, logo and free-text notes. These are supplied by you, the agency — not collected from your client directly. Keep out of the notes field anything you would not want stored.
Access requests and links. The request title, description, the reason shown to the client, button and message copy, the platforms and permission levels requested, expiry, and status. For each link: a hash of the token, the first few characters for display, how many times it was opened, and when it was last used.
Platform connections. When a client approves a request, the platform (Google or Meta) returns an authorisation. We store the connecting account’s identifier and email address at that platform, the exact permission scopes granted, the access and refresh tokens, and token expiry. We also store the accounts covered by the grant — ad accounts, pages, properties or stores — by their platform ID, name, type and, where the platform returns it, an email address.
Access profiles. The agency-side destination for access: the Google account email, Google Ads manager (MCC) ID, Meta business ID, the agency’s own refresh tokens, and any notes you add.
Activity records. An append-only log of what happened to each request and connection — who or what acted, the event type, a description, and a timestamp. This is what lets an agency show when access was granted, changed or revoked.
Email we send. The recipient address, subject, which template was used, the values merged into it, delivery status and any error.
Website usage. Only what your browser sends with each request, and the cookies described below.
Tokens and credentials
Access29 never asks for, receives or stores your client’s platform password. Access is granted through each platform’s own OAuth sign-in, which happens on Google’s or Meta’s domain, not ours.
Platform tokens, OAuth client secrets and stored API credentials are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt. Session, invite and access-link tokens are stored only as SHA-256 hashes, so the original value cannot be recovered from our database. Tokens are never rendered in the browser and are used only to perform the access a client approved.
The permissions we request are the ones needed to grant and verify access — for Google, scopes covering Ads, Analytics, Search Console, Tag Manager, Business Profile, YouTube and site verification; for Meta, scopes covering business and ad account management and page listing and metadata. The exact scopes granted for any connection are shown in the app and recorded against that connection.
How we use information
To operate the service: authenticate you, show your workspace, generate and deliver access-request links, carry out the grant a client approves, verify a connection still works, and keep the activity record that makes access auditable. To send transactional email — invitations, access requests, completion and revocation notices, and password resets. To keep the service secure, including rate limiting and abuse investigation. To respond when you contact us.
We do not use your data, or your clients’ data, to build advertising profiles or to train machine learning models.
What we do not do
We do not sell your data or your clients’ data. We do not share it for advertising. We do not collect platform passwords. We do not access a client’s platform beyond the scopes they approved, and we do not retain platform content — campaign data, analytics reports, page content — beyond the connection metadata described above.
Cookies
The Access29 application sets two first-party cookies and no others:
| Cookie | Purpose | Lifetime |
|---|---|---|
a29_session | Keeps you signed in | 14 days with “keep me signed in”, otherwise 24 hours |
a29_ws | Remembers which workspace you last had open | Matches the session |
Both are strictly necessary for the service to function. The application runs no analytics, advertising or third-party tracking scripts. This page sets no cookies at all.
Data sharing and third parties
We share data only with the providers needed to run the service:
| Provider | What they do |
|---|---|
| Namecheap | Application hosting and database, in Phoenix, Arizona, United States |
| Hostinger | Hosting for this website |
| SiteGround | Outbound email delivery |
| Google LLC | Only as a platform a client grants access to |
| Meta Platforms, Inc. | Only as a platform a client grants access to |
Data flows to Google and Meta when you or your client authorise a connection, and is then governed by their own privacy policies.
We may disclose information if required by law, or to protect the rights and safety of our users or the service. If Around29 is ever involved in a merger or acquisition, we will give notice before your data becomes subject to a different policy.
Data retention
We keep your data while your workspace is active. There is no automatic purge schedule — deletion is driven by you:
- Deleting your workspace in Settings removes the workspace and everything attached to it: members, invites, branding, clients, access profiles, requests, links, connections, stored tokens, activity records and notifications.
- Clients can be archived and then permanently deleted, which removes their requests and connections with them.
- Revoking a connection clears its stored tokens and records the revocation.
- Signing out deletes that session record. Expired links and sessions stop working at their expiry.
A client can also revoke access at any time from their own Google or Meta account settings, independently of us. That revocation takes effect at the platform immediately.
Data security
All traffic is served over HTTPS. Tokens and secrets are encrypted at rest with AES-256-GCM, passwords are hashed with bcrypt, and link, session and invite tokens are stored only as hashes. Access within a workspace is limited by role, and sensitive actions are rate limited and written to the activity record.
No service can promise perfect security. If we become aware of a breach affecting your data, we will notify you at your account email address.
Your rights and choices
Whatever your location, you can:
- See and correct your account and workspace data in Settings, and your clients, requests and connections in the app.
- Delete individual clients, revoke individual connections, or delete the entire workspace.
- Revoke a grant at the source, from your Google or Meta account, without going through us.
- End sessions by signing out, and change your password in Settings.
If you signed in with Facebook and want the data Access29 holds for you removed, use the data deletion page. For any other request about your data, including a copy of it, write to support@access29.online and we will respond within 30 days.
If you are a client whose data appears in an agency’s workspace, that agency controls those records. Contact them first; we will help them action your request, or contact us and we will put you in touch.
International data transfers
Access29 is operated from the United States and your data is stored on servers in Phoenix, Arizona. If you use the service from outside the United States, your data is transferred there. Email delivery and the platforms you connect may process data in other countries under their own terms.
Children’s privacy
Access29 is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has provided us information, write to support@access29.online and we will delete it.
Changes to this policy
When this policy changes we update the date at the top. For changes that materially affect how we handle your data, we will email the address on your account before they take effect. Continuing to use Access29 after a change takes effect means the updated policy applies.
Contact us
Access29 is operated by Around29. Questions, requests and complaints about this policy go to support@access29.online.