AI Ads Studio Privacy Policy
AI Ads Studio is an internal advertising tool operated by Hvalby Digital, Norway ("we", "us"). It connects to the Meta Marketing API to create advertisements and read advertising performance for businesses that have authorized us to manage their Meta ad accounts, and to the TikTok Content Posting API to publish videos to TikTok accounts whose owners have authorized it. It is not a consumer app, and it does not collect information from the people who see those advertisements.
What information we access
- Advertising data of authorized ad accounts: campaign, ad set and ad settings, ad creatives and their text, and performance statistics such as spend, impressions, clicks, conversions and conversion values. These statistics are aggregated by Meta and do not identify individual people.
- Business asset identifiers: the IDs of the ad accounts, Facebook Pages, Instagram accounts and Meta pixels we are authorized to use.
- Basic profile of the authorizing person: the name and Meta user ID of the person who grants access, and the access token Meta issues for that authorization.
- TikTok: for a TikTok account whose owner authorizes AI Ads Studio, its basic profile (open ID, display name and avatar), the posting options TikTok returns for it (such as the allowed privacy levels and the maximum video length), the access and refresh tokens TikTok issues, and the status and IDs of the videos we publish to it.
We do not access personal messages, friend lists, followers, comments, or information about the individual people reached by advertisements or posts.
How we use it
Only to provide the advertising services the business has asked for: preparing and uploading ads, creating ads and ad sets (always paused until the business approves them going live), and analysing which creative performs better so that future ads improve. On TikTok, we upload and publish only videos the account owner has approved, with the caption and privacy setting they chose.
Storage and security
Advertising data is stored in our private work files and private repository. Access tokens are stored in the operating system's encrypted credential store and are never shared or published. We do not sell, rent or share this information with third parties, except where required by law.
We use these service providers, which process data only on our behalf:
- Cloudflare, Inc. (United States) hosts our connection page. When a business connects, the access token Meta issues is held there, encrypted, for at most 7 days until our system collects it once; it is then deleted. When a TikTok account owner authorizes us, Cloudflare relays TikTok's one-time authorization code to our system without storing it.
- Anthropic, PBC (United States) provides the AI assistant we use to analyse advertising performance and plan creatives. It receives advertising data, never access tokens.
- GitHub, Inc. (United States) hosts the private repository where our records, including advertising performance reports, are backed up.
Retention
We keep advertising data for as long as we work with the business and for up to 24 months afterwards, for reporting. Access tokens are deleted when access is revoked or the working relationship ends.
Revoking access and deleting your data
You can revoke AI Ads Studio's access at any time: in Facebook, under Settings & privacy → Settings → Business integrations (or Apps and websites), or for a business, in Meta Business Settings. For TikTok, remove AI Ads Studio in the TikTok app under Settings and privacy → Security and permissions → Apps and services. To have the data we hold about you or your business deleted, email iver@hvalbydigital.no with the subject "Data deletion". We will delete it within 30 days and confirm by email.
Requests from public authorities
If a public authority asks us for personal data we hold, we review whether the request is lawful before responding, challenge requests we consider unlawful, disclose only the minimum information required, and keep a record of each request, our response and the legal reasoning behind it.
Your rights
Under the EU/EEA General Data Protection Regulation you may request access to, correction of, or deletion of your personal data, and you may complain to the Norwegian Data Protection Authority (Datatilsynet).
Contact
Hvalby Digital, Norway, iver@hvalbydigital.no