DLTrack
Legal

Privacy Policy

Effective August 25, 2026 · Covers data obtained from Meta’s platforms

This policy explains what data DLTrack processes, why, how long we keep it, who we share it with, and how you can have it deleted. It covers data we obtain from Meta’s platforms (“Platform Data”) as well as data you give us directly.

1. Who we are

DLTrack is a campaign management, synchronisation, automation, and reporting tool for Meta advertising accounts. For the data described here, DLTrack acts as the data controller for your account information and our own service logs, and as a processor acting on your instructions for the advertising data we synchronise from ad accounts you connect.

Operating entity details to be confirmed. Insert your legal entity name, registered address, and (if applicable) EU/UK representative and Data Protection Officer contact before publishing.

2. What we collect

Account data
Your name, email address, hashed password, workspace and team membership, role, and notification preferences. Provided by you when you register or are invited to a workspace.
Meta connection data
Your Meta user ID, name, email address and profile picture as returned by Meta at authorisation, the access token issued to us, its expiry, and the set of permissions (scopes) you granted.
Advertising data
Businesses, ad accounts, campaigns, ad sets, ads, creatives and media, Pages, pixels, targeting configuration, budgets, bids, delivery status, and performance metrics such as impressions, clicks, spend, and conversions — including breakdowns by placement, age and gender, country, and hour.
Conversion and click data
Where you connect a conversion-tracking provider, we ingest click and conversion records. These include a click identifier, campaign and offer identifiers, payout and revenue values, timestamps, and technical attributes: IP address, country, city, device, browser, and operating system.
Usage and security logs
Activity records of actions taken in your workspace (who changed what, and when, including the originating IP address), automation decision records, synchronisation run records, and standard application and error logs.

A note on click and conversion data

Click and conversion records can constitute personal data about the individuals who interacted with your advertising, because they include IP addresses and device attributes. You are the controller of that data and are responsible for having a lawful basis to collect it, for disclosing it in your own privacy notice, and for honouring the rights of the individuals concerned. DLTrack processes it on your behalf, solely to produce the attribution and reporting you have configured.

3. Meta Platform Data

Data we obtain through Meta’s APIs is processed strictly to provide the features you have asked for, in accordance with Meta’s Platform Terms and Developer Policies. Specifically:

  • Purpose limitation. Platform Data is used only to operate DLTrack for the workspace that connected the account — to display your campaigns and reports, publish and edit the changes you make, and evaluate the automation rules you configure.
  • Access is scoped to your grant. We request only the permissions needed for the features you use, and we can only reach the assets you authorised.
  • No cross-customer use. Your Platform Data is isolated to your workspace. It is not pooled with, or used to derive insights for, any other customer.
  • No advertising or profiling use. We do not use Platform Data to build user profiles, to target advertising, or for any purpose unrelated to operating the service for you.
  • Deletion on request. We delete Platform Data promptly on your request, on termination of your account, or when it is no longer needed for the purpose it was collected for — see section 9.

4. How we use data

  • To provide the service: importing and displaying your advertising structure and performance, publishing and editing campaigns, and running reports;
  • To execute automation rules you have configured, and to record what those rules did and why;
  • To attribute conversions and revenue to the advertising that produced them;
  • To send service communications — rule actions, synchronisation failures, alerts you subscribed to, and essential account notices;
  • To secure the service: authentication, abuse prevention, auditing, and investigating incidents;
  • To maintain and improve reliability, including debugging synchronisation and publishing failures;
  • To comply with legal obligations and to establish, exercise, or defend legal claims.

Where the GDPR applies, we rely on:

  • Performance of a contract — to provide the service you signed up for;
  • Legitimate interests — to secure the service, prevent abuse, and improve reliability, balanced against your rights;
  • Legal obligation — where we must retain or disclose information by law;
  • Consent — where you connect an account or opt into optional communications. You can withdraw consent at any time by disconnecting the account or changing your notification preferences.

6. Who we share with

We do not sell your data. We share it only in these circumstances:

  • Within your workspace — with the teammates you have granted access to, limited by their role and per-ad-account assignment;
  • With Meta — when we publish or modify campaigns, or request data, on your instruction;
  • With service providers — infrastructure hosting, database and queue services, error monitoring, and email delivery, each bound to process data only on our instructions and to protect it;
  • Where legally required — to comply with valid legal process, or to protect the rights, safety, or property of DLTrack, our customers, or the public;
  • In a business transfer — if we are involved in a merger, acquisition, or asset sale, subject to this policy continuing to apply, with notice to you.

7. What we never do

We do not sell, license, or purchase data obtained through Meta’s platforms. We do not use it to make eligibility decisions about individuals (including for housing, employment, insurance, credit, or benefits), for discrimination on the basis of protected characteristics, for surveillance purposes, or to build profiles of individuals. We do not transfer it to data brokers, ad networks, or monetisation partners.

8. How long we keep it

We keep data while your account is active and you need it to operate. Specific automated retention windows currently in force:

Activity and audit logs
180 days, then automatically deleted.
Automation decision records
18 months, then automatically deleted.
Performance breakdowns
28 days for placement, age/gender, and country breakdowns; 14 days for hourly breakdowns.
Generated report exports
24 hours, then automatically deleted.
Campaign structure and daily performance
Retained for the life of your account so that historical reporting remains available, and deleted on request or on account closure.

Disconnecting is not the same as deleting. Disconnecting a Meta account stops all further synchronisation and prevents any further action on your ad accounts, but the advertising data already synchronised, and the stored access token, are retained until you close your account or ask us to delete them.

To have that data removed, follow the Data Deletion Instructions. We also recommend removing DLTrack from your Meta account settings, which invalidates the token at Meta’s end.

9. Deletion and your rights

You can ask us to delete your data at any time, and we will action the request within 30 days. Full instructions, including what is deleted and what we must keep, are on our dedicated Data Deletion Instructions page.

Depending on where you live, you may also have the right to:

  • Access the personal data we hold about you, and receive a copy in a portable format;
  • Correct inaccurate data, or complete incomplete data;
  • Object to, or request restriction of, processing based on legitimate interests;
  • Withdraw consent, without affecting processing already carried out;
  • Lodge a complaint with your local data protection authority.

To exercise any of these, email hello@example.com from the address on your account. We may ask you to verify your identity before acting. We do not charge for these requests unless they are manifestly unfounded or excessive.

10. How we protect it

  • Encryption in transit — all traffic to DLTrack and to Meta’s APIs is over TLS;
  • Encrypted access tokens — Meta access tokens are encrypted at rest in our database and are never exposed through the interface or API responses;
  • Workspace isolation — every query is scoped to a workspace, so one customer cannot reach another’s data;
  • Least-privilege access — role-based permissions plus per-ad-account assignment control what each team member can see and do;
  • Auditability — actions in a workspace are recorded with the actor, time, and originating IP address;
  • Internal access control — staff access to production data is limited to those who need it to operate and support the service.

No system is perfectly secure, but we maintain safeguards appropriate to the sensitivity of the data. If a breach affects your data, we will notify you and the relevant authorities as required by law and by Meta’s Platform Terms.

11. International transfers

We and our service providers may process data in countries other than your own. Where data is transferred out of the UK or EEA, we rely on an adequacy decision or on Standard Contractual Clauses together with appropriate additional safeguards. You can request details of the mechanism used at hello@example.com.

12. Cookies

DLTrack uses cookies that are strictly necessary to run the application: a session cookie to keep you signed in, and a CSRF token cookie to protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies on this site. Blocking these cookies will prevent you from signing in.

13. Children

DLTrack is a business tool intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the product, our providers, or applicable requirements change. The “Effective” date above shows the current version. Where a change materially affects how we handle your data, we will notify you by email or in the product before it takes effect.

15. Contact

Privacy questions, data requests, and complaints: hello@example.com. See also our Terms of Service and Data Deletion Instructions.