Privacy Policy

1. Who we are

The operator of autofb.media and controller of personal data is FOP Pivovarova Nadiia (EDR record No. 2010350000000547736 of 25.04.2024), address: Ukraine, 02160, Kyiv, vul. Kharkivske shose, bud. 4/1, kv. 62. For any privacy matter you can contact us at privacy@autofb.media or our data protection contact at dpo@autofb.media.

2. Data we collect

We collect three categories of data:

• Account data you provide: name, work email, company name, password hash, role and workspace membership.
• Facebook and Instagram advertising data retrieved with your authorisation: ad account identifiers and names, campaign, ad set and ad structures, creative metadata, budgets, delivery and spend figures, performance insights, business and asset assignments, and Page engagement metrics for Pages you connect.
• Technical data generated by use of the Platform: IP address, device and browser type, session identifiers, audit log of actions taken inside the workspace.

3. Facebook Login and permissions

We access advertising data only after you connect a Meta Business account through Facebook Login and select the assets you want to manage. We request the following permissions, and use them strictly for the purposes stated:

• ads_management — create, edit, pause and resume campaigns, ad sets and ads on your behalf, and manage budgets from the Platform.
• ads_read — read campaign structures, spend and performance metrics for the dashboards and reports you request.
• business_management — list the Business Manager assets and ad accounts assigned to you so the correct accounts can be linked to your workspace.
• pages_read_engagement — read engagement metrics for Pages linked to your advertising so that organic and paid results can be reported together.
• read_insights — retrieve aggregated insight metrics used for analytics, benchmarks and exports.
• catalog_management — read and update product catalogues used by catalogue and dynamic ad campaigns you run through the Platform.

4. How we use data

Advertising data is used only to provide the features you use: displaying accounts and campaigns, launching and editing campaigns you configure, computing analytics and reports, running automation rules you define, sending alerts, and producing audit records. We do not sell data, we do not use Meta platform data for advertising of our own, and we do not combine it with data from other customers except as fully aggregated, non-identifying usage statistics.

5. Legal bases

Where the GDPR applies, we process account and technical data to perform our contract with you and on the basis of our legitimate interest in securing the service; we process Meta platform data on the basis of your consent given through Facebook Login and the contract with your organisation. You can withdraw that consent at any time by disconnecting the integration.

6. Sharing and sub-processors

We share data only with service providers acting on our instructions: cloud hosting and database providers, error monitoring, transactional email, and payment processing. Each is bound by a data processing agreement. A current list of sub-processors is available on request at privacy@autofb.media. We disclose data to authorities only where legally required.

7. Retention

Advertising data cached for reporting is retained for as long as the workspace is active and for up to 30 days after the integration is disconnected, after which it is deleted or irreversibly aggregated. Account data is retained while your account exists and for up to 90 days after deletion in encrypted backups. Audit logs are retained for 12 months.

8. Security

Data is encrypted in transit with TLS 1.2 or higher and at rest. Access tokens are stored encrypted and are never exposed in the interface or in logs. Access to production systems is limited to named engineers with multi-factor authentication, and all administrative access is logged.

9. International transfers

Data may be processed in the European Union. Where data leaves the EEA or the United Kingdom, transfers are covered by the European Commission Standard Contractual Clauses together with supplementary technical measures.

10. Your rights

Subject to applicable law you may request access to your data, correction, deletion, restriction of processing, portability, or object to processing. Requests can be sent to dpo@autofb.media and are answered within 30 days. You also have the right to lodge a complaint with your supervisory authority.

11. Deleting your data

You can disconnect the Meta integration or delete your workspace at any time; both actions trigger deletion of the associated advertising data. Full instructions, including deletion requested from Facebook settings, are on the Data Deletion page.

12. Children

The Platform is a business tool and is not directed to anyone under 18. We do not knowingly collect data from children.

13. Changes to this policy

We publish material changes on this page and notify workspace administrators by email at least 14 days before they take effect. The version and date at the top of this page always reflect the current text.