Data Safety & DPA

The short version

• We connect to Meta through Facebook Login. We never ask for, see or store your Facebook password.
• Your Facebook access token is encrypted before it’s stored and is never sent to your browser.
• Your creatives, copy and results are used only to do what you ask: create ads, show you analytics and send the alerts you turn on.
• We don’t sell your data, show it to other customers, or use it to advertise.
• We don’t send your creatives or ad data to AI models, and we don’t train AI on anything you give us.
• Disconnecting Facebook deletes the access token straight away. You can ask us to delete your whole account at any time.

What we store

• Your account: name, email address and, if you use Google sign-in, your Google profile picture. Workspace names, team members and their roles.
• Facebook connection: an encrypted access token, the Facebook name and user ID of the person who connected, the permissions they granted, and the list of ad accounts, Pages and Instagram accounts they manage.
• What you launch: uploaded images and videos, ad copy, links, copy templates, naming settings, drafts, and a record of every launch (which ads were created, their Meta IDs and any errors).
• Results: daily campaign, ad set and ad results from Meta (spend, impressions, clicks, purchases, leads, revenue), cached for up to an hour. These are totals; Meta doesn’t give us information about the individual people who saw your ads.
• Client review links: the name a reviewer types in and their comments.
• Integrations: your Slack webhook link (encrypted) and the access keys you create for AI assistants (we keep only a scrambled fingerprint of each key, not the key itself).
• Billing: your plan and Stripe customer ID. Card details are handled entirely by Stripe.

We don’t read or download the leads people submit through your lead forms. We only list the forms so you can attach one to an ad.

How we protect it

• Encryption in transit: the app and every connection to Meta, Stripe and our other providers use HTTPS.
• Encryption at rest: Facebook access tokens and Slack webhook links are encrypted with AES-256-GCM using a key kept outside the database. The database and file storage are also encrypted at rest by our providers.
• Access control: everything belongs to a workspace and only its members can see it. Connecting Facebook, changing billing, applying budget changes and managing the team need an owner or admin.
• Review links: each one uses a long random address, shows only the ads in that draft, stops working when you delete the draft, and limits how often comments can be posted.
• File imports: links are only downloaded from public internet addresses, with size and time limits, so they can’t be used to reach private systems.
• Sign-in: passwordless email links or Google. Sign-in links expire after 24 hours and are rate limited.
• Least privilege with Meta: we ask only for the Meta permissions needed to list your assets, create ads and read results.

No system is perfectly secure, and we don’t currently offer an uptime guarantee, a set backup schedule or third-party security certification of our own. If you need any of these in writing, contact us before you sign up.

AI

Launcher doesn’t run AI models on your content. Recommendations on the Analytics page come from fixed rules (for example, “cost per result is far above the account average”), not from an AI model.

If you connect Claude, ChatGPT or another AI assistant using a personal access key, that assistant sends us instructions and receives the results of those actions, such as ad set names or launch status. What the assistant does with that information is covered by your agreement with its provider, not by us. You can see and revoke your keys at any time on the Integrations page.

Subprocessors

These providers process personal data for us so we can run Launcher. Our data is stored in the United States.

Services you connect

These services receive data only when you connect them and ask us to use them. Your own agreement with each of them also applies.

• Meta (Facebook and Instagram): Creates and reads ads, campaigns, ad sets, Pages, posts, forms and results in the ad accounts you connect.
• Google Drive and Dropbox: Downloads only the files you pick, so they can be sent to Meta.
• Slack: Receives alerts and daily summaries at the webhook you provide.
• Claude, ChatGPT and other AI assistants: Receive results of the actions you ask them to take through your personal access key.

We’ll update this page before we start using a new subprocessor that handles customer personal data. Customers with a signed DPA get notice by email and can object.

Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the agreement between Actwithmeraki (“we”) and the customer that uses Launcher (“you”) whenever we process personal data on your behalf. It covers only that processing. If you’ve signed a separate DPA with us, that one applies instead.

1. Roles

For personal data in the content you give us or that we fetch from your connected accounts (“Customer Personal Data”), you are the controller and we are your processor (or “service provider” under US state privacy laws). For our own account, billing, security and support records, we are the controller, as described in our Privacy Policy.

2. Instructions

We process Customer Personal Data only to provide and support Launcher, to follow your instructions, to keep the service secure and to comply with the law. Your agreement with us, the way you set up and use Launcher, and your written requests are your instructions. We’ll tell you if we think an instruction breaks data-protection law. We won’t sell Customer Personal Data or use it for any other purpose.

3. Confidentiality and security

Anyone we allow to access Customer Personal Data is bound by confidentiality. We maintain the security measures described on this page and will keep them at least as protective as they are today.

4. Subprocessors

You authorize us to use the subprocessors listed above. We hold each to data-protection obligations suited to its service and remain responsible for them.

5. Helping you

We’ll help you, within reason, to answer requests from individuals (for example, to see or delete their data), to complete data-protection impact assessments, and to deal with regulators. Most of this you can do directly in the app; for the rest, email us.

6. Security incidents

If we confirm a breach affecting Customer Personal Data, we’ll tell you without undue delay and share what we know so you can meet your own notification duties. Telling you isn’t an admission of fault.

7. Deleting and returning data

When you ask us to, or when your account ends, we’ll delete Customer Personal Data (or give you a copy first if you ask) within 30 days, unless the law requires us to keep it. Copies in backups are deleted as the backups expire.

8. International transfers

Data is stored in the United States. If the law requires a transfer mechanism (for example, for data from the UK or EU), we’ll rely on the Standard Contractual Clauses or another valid mechanism. If you need signed clauses, contact us before you upload regulated data.

9. Audits

On reasonable request we’ll give you the information you need to check that we meet this DPA. If the law requires more, you may audit us once a year with reasonable notice, at your cost, without disrupting the service, and subject to confidentiality. We’ll start with documents and calls before any on-site visit.

10. Details of the processing

• What: creating and managing Meta ads, showing results and sending alerts, as you direct.
• How long: while you use Launcher, plus the deletion period above.
• Whose data: your team members, your clients who review drafts, and people who appear in or are named in your creatives and copy.
• What kind: names, email addresses, Facebook names and IDs, creative content, comments, and ad account data.
• Sensitive data: Launcher isn’t built for health, financial-account, government ID or other special-category data. Please don’t upload it.

11. Order of priority and contact

If this DPA and our Terms of Service disagree about personal data, this DPA wins. To ask for a signed copy, email [email protected].