01 Who we are and when this applies
The service operator identified above provides this advertising workflow service (the Service). This policy covers the Service, its management interface, integrations, and support. It does not replace the policies of Meta, your landing pages, or other services you connect.
The operator determines how account administration, service security, and support information are used. For advertising and customer information supplied by a business, the operator processes it to provide the requested service under that business’s instructions and any applicable data processing agreement. Advertisers remain responsible for the notices and permissions required for their own audiences and customers.
02 Information we process and its sources
Information you supply: business and contact details you provide; product Offer names, purchase URLs, affiliate information and commission settings; destination URLs; images, videos, thumbnails, file names, file paths and content fingerprints; advertising copy; budgets, targeting, schedules, and workflow rules. A submitted product URL may be fetched to extract product information for analysis and copy generation.
Connected platform information: access tokens and authorization metadata; the IDs, names, ownership relationships and permissions of accessible business portfolios, advertising accounts, Facebook Pages and Datasets / Pixels; campaign, ad set, ad and creative settings, status, and performance metrics returned by the platform. Access depends on the permissions you grant and the assets actually available to the connection.
Service records: configuration versions, launch confirmations, execution and error records, model inputs and outputs, usage and cost records, support correspondence, and technical logs needed to operate and secure the Service. The hosting environment may process network information such as IP addresses and request timestamps.
Optional conversion reporting: if separately configured and authorized, the Service processes event names, IDs and times, purchase values and currencies, source URLs, browser user-agent information, consent evidence, and hashed customer identifiers such as email, phone or external IDs. Hashing does not make these identifiers anonymous. This integration is not enabled merely by visiting a policy page.
Email sign-in: we process your email address, account identifier, administrator or member role, verification attempts and session records. Verification codes and session tokens are stored as protected digests. Request timestamps and a keyed digest of the connecting IP address are used to limit login abuse.
03 Why we use information
We use information to provide account connections and asset selection, prepare and review advertising plans, generate or review copy when configured, execute confirmed workflows, collect metrics, apply configured optimization and stop conditions, reconcile platform results, troubleshoot failures, and respond to support or privacy requests.
Where a legal basis is required, processing is based on performing our agreement with you, your instructions or consent where applicable, compliance with legal obligations, or legitimate interests in operating, securing and improving the reliability of the Service where those interests are not overridden by individual rights. Consent-dependent integrations can be withdrawn; withdrawal does not invalidate earlier lawful processing.
We do not sell personal information or use connected advertising information for our own cross-customer advertising targeting. The Service does not require access to your personal Facebook password. Withholding required connection permissions or campaign inputs may prevent the corresponding feature from working.
04 AI and workflow automation
When AI features are configured and used, relevant product text, advertising copy, images or video thumbnails, campaign context, performance snapshots, and your instructions may be sent to the configured model provider or API gateway. Some copy-generation tasks begin when materials are imported. Inputs, outputs, adopted versions, and usage records may be retained to support reuse, review and troubleshooting. Platform access tokens are not intended as model inputs.
Model providers and intermediaries may process requests in other locations under their own service terms. We do not make a blanket promise that every configurable provider has zero retention or does not train on inputs. The operator must confirm the provider, processing location, retention and contractual settings before using it with customer data; contact us for the arrangement applicable to your workspace.
Workflow decisions evaluate advertising performance, configured rules, and, if selected, model conclusions. Once you confirm a workflow, supported budget changes, expansion and pauses can occur automatically within the authorized scope. These are advertising operations, not decisions about an individual’s eligibility for employment, credit or other essential services. AI output may be inaccurate and requires appropriate human oversight.
06 Retention and deletion
Retention depends on the category of data, an active service or authorized workflow, troubleshooting and reconciliation needs, applicable legal duties, and a verified deletion request. We retain data only while those purposes justify it. There is no single automatic deletion period for all records; ask the operator for the retention schedule applicable to your deployment.
Deleting an Offer or workflow from the interface is a logical deletion. Configuration versions, material references, platform identities, metrics and execution evidence remain for consistency and traceability. Disabling a connection does not erase stored credentials or history. Neither action is a complete personal-data erasure request.
You may request access, correction, export or erasure using the Data Deletion Instructions page. We assess data across active storage, credentials, caches, files, provider copies and backups as applicable. Where limited records must be retained, we explain the reason and restrict their use. Backup deletion follows the applicable backup lifecycle, and completed erasure instructions must be reapplied if a backup is restored. We do not represent logical deletion or revoking a token as complete erasure.
07 Security and processing locations
The Service uses access controls, encrypted storage for platform credentials, scoped authorization checks, and execution records. Operators must protect deployment keys, restrict administrative access, and use HTTPS for public access. These measures reduce risk but do not guarantee absolute security.
Processing locations depend on the operator’s hosting and backup arrangements and on Meta, model providers, and other enabled integrations. We do not promise data will remain in a particular country unless that arrangement is expressly agreed and implemented. Where cross-border transfer rules apply, the operator must establish the required transfer basis and safeguards; you may request information about the applicable locations and safeguards.
08 Browser storage and policy pages
The management interface uses browser storage for functional preferences such as the width of workflow panels. The public policy pages do not include advertising pixels, analytics scripts, cookie banners, or third-party fonts, and reading them does not connect your Meta account or authorize a campaign.
Your browser may retain authentication state, and the hosting or proxy environment may keep security logs. Clearing browser storage affects local preferences but does not delete records held by the Service or Meta.
Email sign-in uses an essential HttpOnly session cookie. Remembering your login is selected by default for seven days, unless the administrator configures a different duration. If you uncheck it, the browser uses a session cookie with a server-side lifetime of 24 hours. Signing out revokes the current session; it does not erase your account or business history.
09 Your choices and rights
Subject to applicable law, you may request access, correction, deletion, portability, restriction, or object to processing. You may withdraw consent where it is the basis for processing and complain to the competent data protection authority. Contact the operator using the address below; we may request proportionate information to verify identity and authority, but never your platform password or access token.
To stop new platform access, disable the relevant connection and revoke its authorization in Meta’s business settings or the relevant integration settings. Revocation does not necessarily pause ads already running on Meta. To stop delivery, use the workflow stop controls and verify the result in Meta Ads Manager; if access is unavailable, stop the ads directly in Meta. A privacy request does not require you to delete every workflow first.
If your information was supplied by an advertiser, contacting that advertiser may help identify the relevant records. We will assist within our role and applicable obligations. This business service is not directed to children; do not submit children’s data or sensitive personal data that is unnecessary for the requested advertising operation.
10 Changes to this policy
We identify the effective date and document version at the top of this page. Material changes to data use will be communicated through an appropriate service notice or direct contact before they take effect where required; additional consent will be obtained where required. A change to this policy does not itself expand a platform permission or a workflow’s execution authorization.
Contact & privacy requests
Contact the operator for support, privacy questions, or a data rights request. Include your workspace or account reference and the scope of your request. Do not send passwords, access tokens, or payment card information.