Privacy policy for Facebook data
This page explains how AI stats review handles the data it receives from Meta through Facebook Login and the Facebook Marketing API: what it receives and why, who else gets it, how long it is kept and how you can revoke access or have it deleted. It complements the general privacy policy; for data received from Meta this page applies.
Last updated: 2026-09-29
1. What we receive from Meta and why
We ask only for the permissions below. You see each of them on the Facebook login screen and can decline any of them; without ads_read the service cannot show statistics.
| Permission | What we receive | What it is used for |
|---|---|---|
public_profile | Your Facebook user ID for this app and your name. | To create your account in the service and sign you in. |
email | The e-mail address of your Facebook profile, if you allow it. | Service messages only: replies to support requests and confirmation of deletion. No marketing e-mails. |
ads_read | The list of ad accounts you can access. For the accounts you select: account settings (name, currency, timezone, status); names, identifiers, statuses, budgets and creation dates of campaigns, ad sets, ads and creatives; daily statistics — spend, impressions, clicks, reach, conversions and conversion values by attribution window, and a breakdown by placement. | To show your statistics, compare periods, detect deviations and write text summaries about your numbers; and, only with your consent, to share the statistics of selected accounts with an organization (section 3). |
business_management | The list of business portfolios you belong to. For a portfolio you administer, an access token of a system user for this app. | To keep collecting the statistics of that portfolio's ad accounts when your personal login session expires. Apart from requesting this token, the service makes no changes in your business portfolio. |
Access tokens. The tokens Facebook issues to the service are stored encrypted (AES-256-GCM) and are used only to read the data listed above on a schedule.
What we never receive or do. The access is read-only: the service cannot create, edit, pause or delete ads, budgets, pages or posts, and it does not read data about the people who saw or clicked your ads, lead-form submissions, audiences, messages or page content.
2. How we do not use Facebook data
- We do not sell, license or buy data received from Meta, and we do not pass it to data brokers, advertising networks or other data resellers.
- We do not use it for advertising, for building profiles of people, for decisions about anyone's eligibility for credit, housing, employment or insurance, or for surveillance.
- We do not combine it with data from other sources to identify people, and we use it only to provide the service to you.
3. Who else receives it
- Organizations you choose. If you connect an account through an organization's link or accept its request, the daily statistics of the selected accounts (spend, impressions, clicks, reach, conversions, and the names and identifiers of campaigns, ads and creatives) are delivered to that organization's system. This happens only after a consent screen that names the organization. Every active sharing is listed under Settings → Sharing, where you can stop it at any time; data delivered earlier remains with the organization under its own policies. Organizations never receive your tokens or access to your Facebook account.
- AI model provider. To write summaries, explanations and answers we send aggregated statistics and the names of your campaigns, ad sets and ads to OpenRouter, which passes the request to the developer of the selected model. Your name, e-mail, Facebook IDs and tokens are never sent.
- Infrastructure. The data is stored on the servers that run the service and, when e-mail notifications are enabled, the e-mail delivery provider receives your address and the message text.
- Legal requirements. We disclose data only when the law requires it.
4. How long we keep it
- Statistics are kept while the ad account stays connected. After you disconnect an account they are no longer collected and are removed in the ordinary course of operation.
- Tokens are kept until they expire, until you disconnect or remove the app in Facebook, or until your account is deleted.
- Server and access logs are kept for 90 days.
- When you request deletion, your profile, tokens and all collected statistics are deleted within 24 hours.
5. Revoking access and deleting your data
- Stop collection for one account: account settings → "Disconnect account".
- Revoke the app's access in Facebook: Facebook Settings → Business integrations (or Apps and websites) → remove AI stats review. Facebook notifies us, and the service stops using your tokens at once.
- Delete everything: Profile → "Delete account"; or remove the app in Facebook and choose to send a deletion request; or follow the data deletion page. Every request gets a confirmation code and a link to a page that shows its status.
6. Security
Data is transmitted over HTTPS and stored on servers with restricted access. Tokens are encrypted at rest. Access to the operator panel is limited to named operators, and their actions are logged.
7. Changes and contact
We may update this page; the current version is always available at this address and carries the date of the last change. Questions about your data can be sent through the support form.