Privacy Policy

What Brand Ads receives from Meta (Facebook and Instagram)

When a brand connects Meta, Brand Ads receives access to what the person approves on the Facebook screen: the Facebook Pages and the Instagram business accounts linked to them, and the ad accounts and product catalogs of the business.

Pages and Instagram: the name, the followers count and the brand’s own posts with their likes, comments and reach, used to show the brand which posts and formats its audience reacts to and to suggest better ads. When the brand asks for it, Brand Ads publishes a post, a photo, a carousel or a video (Reel) that the brand made in Brand Ads, on the Page or the Instagram account, now or at the time the brand chooses. Each post is sent only after someone presses Post or Schedule.

Ads: the ad accounts the brand approves are used to create the campaigns the brand asks for (always paused until the brand starts them) and to read their results (spend, reach, clicks, purchases), shown back to the brand.

Catalogs: the product catalogs the brand approves are used to add the links for each country to its products, when the brand asks for it.

Some connections go through Composio (composio.dev), which keeps the access tokens for Brand Ads and runs the requests it sends. Brand Ads does not read private messages, comments of other people beyond their count, or personal data of the people who follow the brand.

What Brand Ads receives from Google and from shops

Google Analytics and Search Console (read only): totals of the last 90 days, such as visits, purchases, countries, devices and the searches that bring people to the site. Shopify and WooCommerce (read only): totals of orders, best sellers, stock and discounts. No customer names, emails or addresses are read.

These Google totals are shown to the brand and given, only for that brand, to the AI models that write the brand’s ads and marketing advice. Brand Ads does not use them to train AI models or for anything else.

Brand Ads’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

What Brand Ads receives from TikTok

TikTok profile: the display name, the avatar and an identifier of the profile, the permission to upload videos to the profile’s TikTok inbox as drafts and, when granted, the permission to post videos to the profile, each post being confirmed with its caption and who can see it. Brand Ads does not read the profile’s videos, followers, messages or any other data.

TikTok Ads: access to the ad accounts the brand approves, used to upload the brand’s videos and to create the campaigns its marketing team asks for.

How the data is used

Only to make and publish the brand’s own ads and posts on the brand’s own accounts, when the brand or its marketing team asks for it, and to show the brand how they perform. Drafts sent to the TikTok inbox are posted by the brand itself, from the TikTok app; direct posts on TikTok, Facebook and Instagram are sent only after someone confirms each one (now or at the time they chose).

Brand Ads does not sell this data, share it with third parties or use it for advertising or profiling.

Storage and security

Access tokens are stored encrypted (AES-256-GCM) in private storage and are used only by the Brand Ads servers. The videos are stored so that they can be delivered.

Disconnecting and deletion

A brand can be disconnected at any time in Brand Ads (Settings, or Disconnect on each account); its tokens are then deleted. The access can also be withdrawn from the platform itself: on Facebook in Settings → Business Integrations, on Instagram in Settings → Apps and websites, on TikTok in the account’s Security settings.

To have all the data of a brand deleted (its connections, the facts read from its accounts and the ads and posts made in Brand Ads), write to the contact below from the email of your Brand Ads account, with the brand’s website. It is deleted within 30 days and you get a confirmation.

Using the app: errors and support

When you are signed in, Brand Ads records how the app is used (the pages, the clicks, the errors) and a replay of the session, linked to the email of your account, so that the admin can see what went wrong when something does not work for you. This is done with PostHog, hosted in the United States; the transfer is covered by PostHog’s data processing agreement (the EU Standard Contractual Clauses). Everything typed into fields is masked in the replays and the Settings page is not recorded. The recordings are kept for 30 days and are not used for advertising.

Changes

If this policy changes, the date above changes with it.

Contact

Questions about this document or your data: contact the team that works with your brand.