Privacy policy

adsboys is operated by StackBinary, located in India. You can reach us at contact@stackbinary.io.

We act in two different roles, and it matters which one applies to you.

• For the businesses that use adsboys, and for anyone who visits this website or asks us for a demo, we are the controller. We decide what is collected and why.
• For the people who comment on or message those businesses, we are a processor. The business you contacted decides why your message is handled and for how long. We handle it on their instructions. If you want your data removed, you may contact either that business or us directly, and the data deletion page explains how.

Access is granted asset by asset by the business, from their own Meta Business Manager. We only receive data for the ad accounts and Pages they explicitly assign.

The Meta-scoped user id is not your real identity. Meta issues a different id for every business you interact with, so it cannot be used to recognise you anywhere else.

We do not buy data, we do not scrape profiles, and we do not build a record of anyone who has not actually contacted a connected business.

This section applies to visitors to adsboys.com. It is separate from the above because that information reaches us through a business connecting its Meta assets, whereas this does not.

These analytics tools operate on the public website only. They are not present in the authenticated application, so no connected account, campaign or conversation data is recorded by them.

Enquiry details are used to respond to you and to correspond about adsboys. They are not sold, and are not disclosed beyond the providers listed below.

• To show a business its own advertising performance, and to generate reports, audits and creative analysis from it.
• To reply to comments and messages on that business's behalf, using rules and a business profile they configured.
• To pass a conversation to a human on that business's team when someone complains, asks for a person, or becomes a qualified enquiry.
• To keep an audit record of every change made through the platform, which is what lets a business answer why something happened on a given date.
• To email the business operational alerts about their own ad accounts.

We do not use message content for advertising targeting, we do not sell it, and we do not use it to train our own models.

We use a small number of service providers. Each one processes data only to provide its service to us.

These are enforced in code rather than left to configuration, so they hold regardless of how a business sets up its rules.

• A comment permits exactly one private message, sent within seven days of that comment. A message that would fall outside the window is not sent.
• Automated replies in an existing conversation stay inside the standard 24-hour window from your last message.
• There are daily caps on how many automated messages one person can receive.
• Replying STOP opts you out permanently for that business. The opt-out cannot be undone by us, by the business, or by contacting the account again.
• The first automated private message you receive tells you that you are talking to an automated assistant and how to reach a person.
• Generated replies pass a filter that blocks any link outside the business's approved list and any price not published in their own profile, before the message is sent.

• Each client runs as a dedicated deployment with its own database and its own Meta app. There is no shared multi-tenant datastore.
• Meta access tokens are encrypted at rest with AES-256-GCM using a key unique to that deployment, and are decrypted only inside the single module that calls Meta. Tokens are never written to logs.
• Database tables have row-level security enabled, which blocks anonymous and API-layer access.
• Incoming webhooks from Meta are verified by HMAC signature and rejected if the signature does not match.
• Access to the platform is invitation-only and limited by role.

We hold no security certifications today, and we would rather say so than imply otherwise. The security page describes the architecture in more detail.

Advertising data and conversation history are kept for as long as the business keeps its Meta assets connected, because the platform is a working record of their account rather than a temporary cache. There is no automatic expiry.

When a business disconnects a Meta connection, everything beneath it is deleted: businesses, ad accounts, campaigns, ads, insights, creative analysis, conversations, leads and audit records. That deletion is immediate and cannot be undone.

Enquiries submitted through this website are not held under a Meta connection and are therefore not covered by that deletion. They are retained for the duration of our correspondence and deleted on request.

Individual deletion requests are handled as described on the data deletion page.

• Stop automated messages from a business by replying STOP in that conversation.
• Ask for a human at any point and the conversation is flagged to that business's team.
• Request a copy of what we hold about you, or ask for it to be deleted, by emailing us.
• A business can revoke our access to their Meta assets at any time from their own Business Settings, without asking us.

Depending on where you live you may also have rights to correct data, object to processing, or complain to a data protection authority. Write to us and we will help.

If we change how data is handled, we update this page and the date at the top. Material changes are communicated to connected businesses directly rather than only being posted here.

Questions about any of this go to contact@stackbinary.io.