Privacy Policy

When you sign up, we collect your name and email address through Clerk, our authentication provider. Clerk manages your login credentials and identity securely on our behalf.

To generate ads tailored to your business, you provide us with:

• Business name, industry, and description
• Target audience profile and customer age range
• Business address, phone number, website URL, and opening hours
• Facebook Page URL and current promotions or offers
• Location (county or city in Ireland)
• Photos uploaded for use in ads

Subscription payments are processed securely by Stripe. We do not store your card number, CVC, or full billing details on our servers. We receive only non-sensitive metadata from Stripe such as your subscription plan, status, and billing period dates.

When you connect your Facebook account to SiteSorted, we receive and store the following data from the Facebook Marketing API:

• Facebook Page access tokens (used to post ads on your behalf)
• Facebook Page ID and Page name
• Facebook Ad Account ID (used to create and manage ad campaigns)
• Token expiry dates

This data is collected only when you explicitly choose to connect your Facebook account and is used solely to create and manage ads on your behalf. See Section 4 for full details on how we handle Facebook data.

We automatically collect limited technical and usage data including:

• Ad performance metrics returned by the Facebook Marketing API (impressions, clicks, CTR, spend)
• Timestamps of ad generation, scheduling, and posting activity
• Browser and device type, IP address, and pages visited within the platform
• Error and diagnostic logs for platform stability

When you connect your Facebook account via OAuth, SiteSorted receives:

• Page Access Tokens — short and long-lived tokens that authorise us to manage ads on your Facebook Page
• Facebook Page ID — identifies which Page your ads are posted to
• Facebook Ad Account ID — the ad account used to create and fund campaigns
• Page name — displayed in your SiteSorted dashboard for identification

Facebook data is used solely and exclusively for the following purposes:

• Creating ad campaigns, ad sets, and ads via the Facebook Marketing API on your behalf
• Retrieving ad performance metrics (impressions, clicks, spend, CTR) from the Facebook Insights API
• Displaying your connected Page name in your dashboard

We do not use Facebook data for any other purpose. We do not analyse, sell, license, or share Facebook data with any third parties other than what is strictly required to operate the Marketing API on your behalf.

Facebook data is not shared with any third parties. It is stored securely in our database (Supabase, EU region) and accessed only by the automated systems that post ads on your behalf.

You can disconnect your Facebook account from SiteSorted at any time from the dashboard Settings panel. When you disconnect:

• All stored Facebook Page access tokens are immediately deleted from our database
• Your Facebook Page ID and Ad Account ID are immediately cleared
• No further API calls will be made to Facebook on your behalf
• Existing ad records (headlines, body text, images) are retained in your account but are no longer connected to Facebook

Facebook access tokens and related credentials are stored only for as long as your Facebook account is connected to SiteSorted. They are permanently deleted when you disconnect your Facebook account or delete your SiteSorted account.

Facebook access tokens are stored encrypted in our database. They are never exposed in client-side code, logged in plain text, or transmitted outside of server-side API calls to the Facebook Marketing API.

When you connect Facebook, SiteSorted requests the following permissions:

• ads_management — to create and manage ad campaigns
• ads_read — to retrieve ad performance data
• pages_manage_ads — to manage ads on your Facebook Page
• pages_read_engagement — to read basic Page engagement data
• pages_show_list — to list Pages you manage so you can select the correct one

We request only the minimum permissions necessary to perform ad management on your behalf.

Your data is stored in Supabase, a managed PostgreSQL database hosted on AWS infrastructure in the EU (Ireland region). As an Irish company processing Irish customers' data, we maintain EU data residency by default.

We implement the following security measures to protect your data:

• Encryption in transit via TLS 1.2+ for all data transfers
• Encryption at rest for all database storage
• Row-level security policies enforcing that users can only access their own data
• Service role keys never exposed to client-side code
• Regular security reviews and dependency updates

We are a company based in Ireland and are fully subject to the GDPR and the Irish Data Protection Act 2018. We maintain a lawful basis for all data processing activities as described in Section 3.

• Account and business data: retained for the duration of your subscription plus 2 years after cancellation (to comply with Irish accounting obligations)
• Ad content and performance data: retained for the duration of your subscription plus 1 year
• Facebook tokens and credentials: deleted immediately upon disconnection or account deletion
• Payment records: 7 years (Irish tax law requirement)
• Server logs: up to 90 days

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Irish Data Protection Commission within 72 hours and affected individuals without undue delay, as required by GDPR Article 33.