01In short
- Data from Meta is used for one thing: the features you see in ads.cab, within the permissions you granted in Meta’s dialog.
- We do not sell personal data, do not use it for ad targeting and keep each advertiser’s cab apart from every other.
- You can disconnect at any time and have everything received from Meta deleted; deletion is finished within 30 days.
02Who is responsible
ads.cab is run by ads.cab, legal entity details to be published, registered address: registered address to be published ("ads.cab", "we"). We decide how and why the personal data described here is processed and are its controller, except where section 9 says we act on your instructions.
Anything about this policy: [email protected].
03What this policy covers
It covers the website at ads.cab, the ads.cab deck (the signed-in application at /deck) and the data we receive from Meta Platforms, Inc. ("Meta") when you connect a Meta profile through Facebook Login for Business. ads.cab is made for businesses and the people who work for them; it is not offered to consumers.
A cab in this policy is your team’s account in ads.cab: the place that holds connections, people, settings and the plan.
04What you give us yourself
- Account: name, work email, a salted hash of your password (never the password itself), cab name, role and language.
- Crew: names and emails of the people you invite, teams and the access you grant them.
- Work in the deck: launch briefs, naming templates, tags, Watch rules, Comms moderation rules, replies you write, creative sets and the media files you send to your ad account, and customer lists you upload to build audiences (hashed in your browser before they leave it).
- Correspondence: what you write to us and our answers.
- Technical: IP address, browser user agent and time in security and access logs, and the session cookie that keeps you signed in.
We never ask for, receive or store Facebook passwords, Facebook cookies or browser sessions.
05What we receive from Meta
ads.cab receives Meta data only after you connect through Facebook Login for Business and approve the permissions in Meta’s dialog, where you also choose which business portfolios, ad accounts and Pages to share. Every permission below is used by a visible part of the deck.
| Permission | Data or action | Purpose |
|---|---|---|
public_profile | Your name and the app-scoped user ID Meta issues for ads.cab. | Identify the person who connects their Meta business assets to ads.cab (name and app-scoped ID). |
ads_management | Settings of campaigns, ad sets, ads and creatives: names, objectives, budgets, schedules, audiences, placements and delivery status. Images and videos you send to the ad account. Custom and lookalike audiences you build. | Create paused campaigns, ad sets and ads, upload creatives, and pause, activate or change budgets of ads the user manages. |
ads_read | Ad account properties (name, currency, time zone, status, spend limit, amount spent) and delivery metrics: impressions, reach, clicks, CTR, CPC, CPM, spend, results and cost per result. | Read campaign structure and performance insights to show reports and evaluate the user's automated rules. |
business_management | Names, IDs and verification status of your business portfolios, plus the ad accounts and Pages they own or can use. | List the business portfolios the user belongs to and the ad accounts and Pages owned by them. |
pages_show_list | Names, IDs and pictures of the Pages you manage, and which tasks your role allows on each of them. | Show the Pages the user manages so they can pick the Page that will run the ads. |
pages_read_engagement | Basic Page information and the posts your Pages publish, including posts behind your ads, with their engagement counts. | Read Page details and posts used as ad creatives, and engagement on those posts. |
pages_manage_ads | Permission for the selected Page to back the creatives and posts of the ads you create. | Create ads that run on behalf of the selected Page. |
pages_read_user_contentComms only | Comments under your ads and Page posts: text, ID, time, hidden flag, and the author name and ID as Facebook shows them. Removal of visitor comments you decide to delete. | Read comments people leave under the user's ads and Page posts so the team can moderate them, and delete visitor comments. |
pages_manage_engagementComms only | Hide and unhide actions on comments, and replies you publish as your Page. | Hide, unhide and reply to comments under the user's ads as the Page. |
pages_manage_metadataComms only | The webhook subscription of your Pages, so new comments reach ads.cab as they happen. No personal data beyond that. | Subscribe the user's Pages to webhooks so new comments arrive in real time. |
Meta also issues an access token that lets ads.cab act within those permissions. It is encrypted at rest with AES-256-GCM, shared with nobody and deleted when you disconnect.
People who comment on your ads. If you use Comms, we process comments other people leave under your ads and Page posts: the text, the time, and the author name and ID as Facebook shows them. We do this only to show them to your cab and to carry out the moderation you or your rules choose. We do not enrich or profile commenters and never contact them.
Audience estimates. When you build audiences in Crowds, Meta returns aggregate reach estimates. They contain no personal data.
Data received from Meta is used only to provide ads.cab to you, in line with the Meta Platform Terms, the Meta Developer Policies and applicable law.
06What we use it for
- Showing your business portfolios, ad accounts, Pages, campaigns, audiences and statistics.
- Creating and editing the campaigns, ad sets, ads, creatives and audiences you configure, and changing statuses and budgets when you or your rules ask.
- Running Preflight checks before a launch and your Watch rules afterwards, and recording each run.
- Showing comments in Comms and performing the hide, unhide, delete and reply actions you or your moderation rules choose.
- Keeping the service secure and working: sign-in, abuse prevention, the API call log, the cab audit log and support.
- Service emails such as security notices and changes to our documents. Marketing emails only with your consent.
07What we will not do
- We do not sell, rent, license or trade Meta Platform Data or any other personal data.
- We do not use data received from Meta for ad targeting or retargeting, on Meta or anywhere else.
- We do not build profiles of people and do not try to re-identify anyone.
- We do not combine one advertiser’s data with another’s; each cab is kept apart.
- We do not use your data or Meta data to train models for other customers.
- We do not hand tokens or user IDs to anyone except the providers that run ads.cab for us.
08Legal grounds
Where the GDPR or UK GDPR applies, we rely on our contract with you (to provide ads.cab), our legitimate interest in keeping the service secure and improving it (weighed against your rights), legal obligations (such as accounting) and, where we ask for it, your consent, which you can withdraw at any time.
09When we act on your instructions
For comments, customer lists and other personal data of people who interact with your business, you are the controller and ads.cab processes that data on your behalf and on your instructions. You are responsible for having a lawful basis to moderate your own comment sections and to upload customer lists to Meta.
10Who receives data
- Meta, when ads.cab sends your instructions to its APIs (for example, creating a campaign, building an audience or hiding a comment).
- Our subprocessors, which host and operate ads.cab under contracts requiring confidentiality, security and deletion. The list is on Subprocessors.
- Authorities, only when the law requires it and after we check the request; we disclose the minimum.
- A successor, if ads.cab is merged or sold, bound by this policy and with notice to you.
11Transfers abroad
Our providers may process data outside your country. When data leaves the UK or the EEA, we rely on adequacy decisions or the Standard Contractual Clauses (with the UK Addendum where relevant), plus measures such as encryption.
12How long we keep data
| What | For how long |
|---|---|
| Meta access tokens | Until you disconnect, or until Meta expires or revokes them |
| Business portfolios, ad accounts, Pages and the campaign tree | While the connection exists |
| Daily statistics | Up to 13 months |
| Comments under ads and Page posts | 90 days |
| Custom audience sources you upload | Hashed in your browser; the hashes are sent to Meta and not kept by us |
| Technical log of Meta API calls | Up to 90 days |
| Launch history, Preflight results, rule runs and the audit log | While the cab exists |
| Encrypted backups | Rotated; copies older than 30 days are destroyed |
| Your ads.cab account | Until you delete it |
| Billing records | For as long as accounting law requires |
Everything received from Meta is deleted within 30 days after you disconnect Meta or delete your ads.cab account.
13Security
Tokens are encrypted at rest (AES-256-GCM, key kept outside the database) and in transit (TLS 1.2+). Every Graph API call is signed with appsecret_proof. Production access is limited and logged. Details on Security.
14Deleting data and revoking access
You can ask us to delete the data we received from Meta at any time, in any of three ways:
- In ads.cab: Gate, then Disconnect and delete data on the connection.
- On Facebook: Settings & privacy, Settings, Business Integrations; remove ads.cab, then in the Removed tab open View details and press Send Request.
- By email to [email protected] with the subject "Data deletion".
You get a confirmation code and can follow it on the deletion status page. Deletion is complete within 30 days. The full instructions are on Data deletion.
Removing ads.cab in Business Integrations stops our access at once. Content already published on Facebook, such as a reply you posted as your Page, stays there until you delete it on Facebook.
15Your rights
Depending on where you live, you may access, correct, delete, restrict or object to processing of your personal data, receive it in a portable form and withdraw consent. Write to [email protected]; we answer within one month. You may also complain to your data protection authority.
California residents: we do not sell or share personal information for cross-context behavioral advertising and do not use sensitive personal information.
17Age
ads.cab is for people aged 18 and over acting for a business. We do not knowingly collect children’s data.
18Changes
Changes are posted here with a new revision date. For material changes we email cab owners at least 14 days before they take effect.
19Contact
ads.cab, legal entity details to be published, registered address: registered address to be published
Privacy: [email protected] · Support: [email protected]
ads.cab is not affiliated with, endorsed or sponsored by Meta Platforms, Inc.