Privacy Policy

tovtpk.digital (“we”, “the platform”, “the service”) is a tool for automating the launch of advertising campaigns on Facebook Ads, available at tovtpk.digital. This policy describes what data we collect, why it is needed, how it is stored and how you can manage it. By using the service, you agree to this policy.

Platform account data. When you register, we store your email, name and a hash of your password (we do not store the password itself and cannot recover it).

Data of connected Facebook accounts. You can connect one or several Facebook accounts to your platform account. For each connection we receive and store:

• public profile: identifier, name, photo;
• access token for the Facebook Marketing API (in encrypted form, see the “Security” section);
• the list of ad accounts: names, identifiers, statuses, currency, time zone;
• the list of Facebook pages and linked Instagram accounts;
• the list of pixels and custom audiences (names and identifiers only);
• advertising campaign statistics: spend, impressions, clicks, conversions.

Uploaded materials. Images and videos that you upload to the media library for use in ads.

Technical data. Request logs (IP address, time, action) — to protect against abuse and diagnose errors.

• ads_management, ads_read — creating and managing campaigns, reading statistics for your team;
• business_management — showing which business portfolios ad accounts belong to;
• pages_show_list, pages_read_engagement, pages_manage_ads — choosing the page on whose behalf ads are published;
• public_profile — name and photo to display the connection in the interface.

We request only the permissions necessary for the service to work and use them solely for actions that you initiate.

• creating and managing advertising campaigns on your command;
• displaying statistics and the state of your ad accounts;
• notifications about important events (access expiration, launch errors);
• ensuring the operation and security of the service and diagnosing failures.

We do not use your data for third-party advertising, do not sell it and do not train third-party models on it.

We do not sell or share your personal data with third parties. Data is shared only:

• with Meta Platforms — to the extent necessary to carry out your commands via the Marketing API (creating campaigns, reading statistics);
• as required by law — if this is required by applicable law or a court order.

• Facebook access tokens are encrypted with AES-256-GCM before being written to the database; the encryption key is stored separately from the database;
• tokens are never sent to the browser or to third parties;
• passwords are stored only as a hash (bcrypt);
• the connection to the service is protected by TLS (HTTPS);
• access to the servers is restricted and logged.

• account and connection data — for as long as you use the service;
• technical request logs — up to 14 days;
• video files in the media library — a file is deleted from our servers 14 days after its last use (copies uploaded to Facebook remain in your ad accounts);
• campaign statistics — while the connection is active.

You may at any time:

• obtain information about what data about you is stored;
• disconnect any connected Facebook account — its data is deleted immediately;
• delete your platform account together with all data;
• contact us with any question about data processing (see “Contact”).

There are three ways to delete data:

• In the platform settings — the “Delete account and all data” button deletes the account, all connections, the media library, presets and launch history;
• By disconnecting a Facebook account on the “Connections” page — the data of the specific connection is deleted;
• Via Facebook — remove the app in your Facebook settings (Settings → Apps and Websites). We will receive a signal and automatically delete the data of that connection. You can check the status on the /data-deletion page.

Deleting data from the platform does not affect your campaigns and materials inside Facebook.

We use only technically necessary cookies: to maintain the login session (httpOnly, inaccessible to scripts) and to protect against CSRF when connecting Facebook. There are no advertising or tracking cookies on the platform.

In case of material changes, we will update the date at the top of the document and notify you in the platform interface. Continued use of the service after changes means acceptance of the new version.

For questions about data processing, write to [email protected].

Address: 03022, Ukraine, Kyiv, Vasylkivska Street, building 100a