App privacy policy.

1. Who operates the app

Palmer Edge Marketing FZCO, Dubai, United Arab Emirates, operates Palmer Edge Console, also described as our AI Campaign Manager app. “We”, “us” and “our” refer to Palmer Edge Marketing FZCO.

This policy explains how information is handled when authorised users connect Meta business assets and use AI-assisted tools to analyse, prepare and manage advertising. It applies to this app and its connected workflows. Our general website privacy policy separately covers our agency website, enquiries and bookings.

Contact: [email protected]. Please use the subject “AI Campaign Manager privacy request”.

2. Authorised users and client information

The app is intended for adults authorised to act for their own business or a client business. Connecting an account does not give us access to assets or permissions that Meta has not granted.

For our own account administration, security and business records, we determine the purposes of processing. Where we handle a client’s advertising or lead information on that client’s instructions, the client normally determines the purpose and we act as its service provider or processor under the relevant agreement. This policy does not replace the client’s privacy notice to its customers.

3. Information the app accesses

The information available depends on the permissions granted, assets shared and tools used. It may include:

• Account and business details: Meta user or business identifiers, business portfolio names, ad account IDs, account names, currency, time zone, account status, assigned roles and available permissions.
• Page and Instagram details: connected Page and Instagram account identifiers, names, authorised content and engagement information needed to identify advertising assets or work with existing posts.
• Advertising settings and assets: campaigns, ad sets, ads, targeting and location settings, budgets, schedules, bids, creative files, images, videos, copy, destination URLs, tracking parameters and previews.
• Performance and measurement: spend, impressions, clicks, conversions, campaign results, activity logs and authorised pixel or dataset diagnostics. Reports may contain aggregated information and platform identifiers.
• Lead or audience information, where separately enabled: instant-form responses and contact details, or audience records supplied or retrieved for an authorised task. These functions require the relevant permissions and are not enabled merely by reading this policy.
• Connection and operational information: access tokens or other authentication credentials used by configured clients, permission records, instructions, tool requests and responses, errors and activity records. Credentials may be held by the connected client or locally configured integration rather than by a separate app database.

Do not submit passwords, payment card details, medical records or other sensitive personal information in prompts, creatives or uploads unless a separately agreed lawful workflow requires it. We do not require your Facebook password; Facebook authentication is handled by Meta.

4. Meta permissions and account access

The app may request the following permissions when needed for the authorised workflow:

• ads_mcp_management: access Meta’s Ads MCP tools.
• ads_management and ads_read: create or manage advertising and retrieve advertising settings and reports.
• business_management: discover and access authorised business assets.
• pages_show_list, pages_manage_ads and pages_read_engagement: identify Pages, manage Page advertising and read relevant Page content or engagement.
• instagram_basic: identify connected Instagram accounts and access permitted basic information.
• Optional permissions: leads_retrieval for instant-form leads; catalog_management for product catalogues; and applicable branded-content permissions for partnership advertising, if these features are requested and approved.

Requesting a permission does not mean it has been approved or that every related feature is available. Meta permissions, business asset assignments and account-level restrictions continue to apply. Messaging, WhatsApp and unrelated social account functions are outside the advertising workflow described here unless separately introduced with appropriate notice and authorisation.

5. How information is used

• Connect and identify the accounts, Pages and other assets you authorise.
• Retrieve performance reports, investigate errors and evaluate advertising results.
• Upload approved media, prepare creatives and create or edit campaigns, ad sets and ads according to authorised instructions.
• Manage budgets, targeting, schedules, delivery or other settings only within the authority given for the task and the permissions enforced by Meta.
• Retrieve leads or manage audiences and catalogues where separately authorised and enabled.
• Maintain necessary operational records, troubleshoot connections, protect systems and comply with applicable legal obligations.

Permission to connect an account is not, by itself, an instruction to launch advertising or increase spending. Actions depend on the instructions and approvals provided through the relevant workflow.

6. AI assistants and third-party processing

Authorised workflows may use OpenAI tools, including Codex or ChatGPT, and Anthropic Claude, together with Meta’s Ads MCP server or Marketing API. Relevant instructions, creative materials, account settings and tool results may be transmitted to the selected AI provider so it can interpret requests, analyse information and prepare or perform the authorised task.

The information sent depends on the task and the connected client. Avoid including unnecessary personal data in prompts or tool results. AI outputs can be inaccurate and require appropriate review before use.

AI providers process information under the terms, privacy policies and data controls of the account or service being used. Retention and model-improvement settings can differ by provider, product and plan. This policy does not promise that every AI service has training disabled or zero retention. Any client restrictions on AI processing must be agreed before that client’s data is used in an AI workflow.

Our purpose in processing Meta data is to deliver the authorised advertising service, not to develop a general-purpose AI model. The app is not intended to make decisions about an individual’s eligibility for employment, credit, insurance, healthcare or other similarly significant matters.

7. Who receives information

Information may be disclosed as needed to:

• Meta: to authenticate connections, retrieve platform information and execute approved advertising operations.
• The selected AI provider: OpenAI or Anthropic, as described above.
• Authorised personnel and service providers: people and technical providers supporting the engagement, hosting, storage, security or operations, where relevant to their role.
• The client or asset owner: for reporting, approval, account administration and fulfilment of the service.
• Advisers, authorities or a business successor: where reasonably necessary for legal obligations, protection of rights, professional advice or a business reorganisation, subject to applicable safeguards.

We do not sell Meta platform data or use it for unrelated third-party advertising. Disclosure must remain consistent with the applicable client instructions, platform terms and law. Meta and other providers may also process information independently under their own policies.

8. Grounds for processing

Depending on applicable law and the activity, processing may be necessary to perform a service agreement or take steps you request before entering one, comply with legal obligations, or pursue legitimate interests where that ground is available and appropriate. Where consent is required, it must be obtained.

A Meta permission grant authorises platform access; it does not replace any separate legal basis, customer notice or consent required for the underlying use of personal information. Clients remain responsible for having appropriate authority to provide data and instruct advertising, audience or lead-processing activities.

9. Storage, retention and security

Data can be processed in Meta, the selected AI client or provider, local working files and authorised service-provider systems. The app does not imply that all information is held in one central database.

We retain account information, creative materials and operational records only for as long as reasonably needed for the authorised service, security, troubleshooting, applicable record-keeping requirements or legal claims. The period depends on the data, the engagement and any applicable client agreement. When information is no longer needed, it should be deleted or anonymised. Backup copies and provider-held records may remain for their normal recovery or legally required retention periods.

Access credentials should be treated as confidential, limited to authorised systems and revoked or replaced when no longer needed or compromised. We use reasonable organisational and technical safeguards appropriate to the processing. No system can guarantee absolute security.

Revoking an integration does not automatically delete existing ads, media or reporting records from Meta, nor does it automatically erase information already stored by a connected AI provider. Those records are subject to the relevant deletion process and provider controls.

10. International processing

We operate from the UAE. Meta, AI providers and other suppliers may process or store information in other countries, including countries whose privacy laws differ from those where you live. Where applicable law requires safeguards for an international transfer, an appropriate lawful mechanism and required protections must be used. Contact us for information relevant to your engagement.

11. Disconnecting the app and requesting deletion

You can review or revoke the app’s access in your Meta account’s Settings → Business Integrations by locating Palmer Edge Console and removing it. Meta’s interface labels may change. You can also disconnect the relevant connector in Claude, Codex or ChatGPT, and revoke or replace any manually configured token. Disconnecting one client may not revoke every separately issued token.

To request deletion of information held by us, email [email protected] with the subject “AI Campaign Manager data deletion”. Include your name, business name, the relevant account or business ID if known, and the information you want deleted. Do not send passwords or access tokens.

We may request proportionate evidence that you are the data subject or an authorised representative. We will assess the request, delete or anonymise information we control where required, and respond within the period required by applicable law. We will explain any necessary legal retention or other applicable exception. Where we act on a client’s instructions, we may refer or coordinate the request with that client.

Deleting our records does not itself delete campaigns, uploaded assets or other records held by Meta or an AI provider. Tell us if your request concerns those systems so we can identify the appropriate process and authority. Removing ads or business assets is a separate action requiring the asset owner’s authority.

12. Your privacy rights

Depending on applicable law, you may have rights to access your personal information, correct it, request deletion or restriction, object to certain processing, withdraw consent, obtain a portable copy, or complain to a competent authority. Rights and exceptions depend on the circumstances. Withdrawal of consent does not affect earlier lawful processing.

Send requests to [email protected]. Where a request concerns a client’s customer data, the client may be the appropriate contact as controller. We will assist within our role and obligations.

13. Children and policy updates

The app is intended for adults managing business advertising and is not directed to children. If you believe a child’s information has been provided improperly, contact us so we can investigate.

We may update this policy when the app, connected tools or processing practices change. The effective date identifies the current version. Where required, material changes will be notified separately or fresh consent obtained.