Meta App Privacy & Data Retention Policy

For AdLift Media Meta Marketing API Application

Last Updated: February 12, 2026

Introduction

AdLift Media ("we", "our", "us") provides this Privacy & Data Retention Policy to describe how advertising data accessed through Meta's Marketing API is collected, used, stored, and retained by the AdLift Media Meta Marketing API application.

This internal application retrieves advertising creative content and campaign metadata from our Meta advertising accounts. It is not consumer-facing and does not collect personal information from end users.

This policy applies exclusively to the AdLift Media Meta Marketing API application and is separate from any other privacy policies governing AdLift Media's websites or services.

1. Purpose of the Application

The AdLift Media Meta Marketing API application is used solely by authorized personnel to retrieve, store, and manage advertising creative content and campaign metadata from Meta. This tool supports compliance, auditing, historical reference, and related operational requirements for our advertising operations.

The application does not interact with end users.

2. Meta Permissions Used

Our application requests specific permissions to facilitate business operations. These permissions are used strictly for the purposes described below:

  • ads_management & ads_read: Used to access advertising accounts, creative content, campaign metadata, and performance insights required for automation, compliance, and reporting.
  • business_management: Used to read the Business Manager hierarchy to identify ad accounts and Pages managed by the business for organizational purposes.
  • pages_manage_ads & pages_read_engagement: Used to retrieve Page posts for ad creation and read engagement metrics (likes, comments) for performance analysis.
  • pages_show_list: Used to display a list of Pages the user manages for selection within the app.
  • catalog_management: Used to read product catalogs for syncing ad inventory.
  • email & public_profile: Used solely to verify the identity of the authorized user logging into the application via Facebook Login.

3. Information Collected Through the Meta API

User Account Information — Name, email address, and profile picture provided by Facebook Login (used strictly for authentication and identity verification).

Advertising Creative Content — Primary text, headlines, descriptions, image URLs, video URLs, call-to-action types, dynamic creative variations.

Campaign & Ad Set Metadata — Campaign and ad set names, objectives and optimization goals, budgets and billing events, delivery status and timestamps, scheduling information.

Page & Engagement Data — Public Page posts, follower counts, and aggregated engagement metrics (likes, comments, shares).

Performance Insights — Spend, impressions, clicks, high-level performance analytics.

4. Use of Advertising Data

Advertising data accessed through the Meta API is used to:

  • Retrieve and store current and historical ad creative content
  • Maintain compliance with platform and advertising requirements
  • Support auditing and historical reference needs
  • Maintain accurate records of advertising creative used on our properties

Advertising data is not used for targeting, profiling, or advertising purposes outside the stated functions. Use of this data is subject to and governed by the Meta Platform Terms and Developer Policies.

5. Data Sharing

We do not sell Meta advertising data or user data. We share data only when required by law, regulation, or legal process; with secure infrastructure or service providers supporting the storage and operation of this application; or when required for compliance or security purposes. All service providers are bound by confidentiality and security obligations.

6. Data Retention

Active Ads — Retained for as long as the ad remains active (ACTIVE, PAUSED, PENDING_REVIEW). Creative content refreshed as needed.

Inactive Ads — Retained for 90 days after an ad becomes inactive (ARCHIVED, DELETED, DISAPPROVED). The 90-day retention period begins when the ad status is recorded as moving into any of these inactive states.

Performance Insights — Retained for 90 days from collection.

Backups — Retained for 30 days, following the same deletion protocols.

Deletion — Automated deletion for data exceeding retention windows; manual deletion requests processed within 30 days; deletions logged for audit purposes. Data may be retained longer if subject to legal obligation.

7. Security and Access Controls

We employ technical and organizational measures to protect advertising data, including encryption in transit and at rest, role-based access control, logging and monitoring, and restricted access to authorized personnel only. Access is limited to authorized personnel; external contractors are not granted access unless explicitly authorized and bound to confidentiality.

8. Definitions

Advertising Data — Creative assets, campaign metadata, and performance insights retrieved from Meta's API.

Active Ads — Ads with ACTIVE, PAUSED, or PENDING_REVIEW status.

Inactive Ads — Ads with ARCHIVED, DELETED, or DISAPPROVED status.

Performance Insights — Aggregated analytics describing advertising performance.

9. Regulatory Compliance (PIPEDA, GDPR, CCPA)

As a Canadian company based in Ontario, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). We also maintain privacy, retention, and data governance practices consistent with GDPR (Europe) and CCPA (California) expectations where applicable.

This Meta Marketing API application retrieves only advertising creative content, campaign metadata, and aggregated performance insights. It does not collect or process personal data from end users. A separate Data Processing Agreement is not required for this application because it does not process personal data.

10. Data Deletion Requests

We are committed to giving users control over their data. Although this application is for internal use, authorized users may revoke access or request data deletion at any time:

  • Automated Revocation: Users can remove the app and revoke all permissions by going to their Facebook Settings > Apps and Websites > AdLift Media > Remove.
  • Manual Deletion Request: To request the permanent deletion of your user profile data from our system, please email support@adliftmedia.com. We will process this request and permanently delete your user record within 30 days.

11. Policy Updates

This policy may be updated to reflect changes to legal requirements, Meta platform rules, or internal practices. The "Last Updated" date will be updated accordingly.

12. Contact Information

For questions about this policy, please contact us at support@adliftmedia.com.