Privacy Policy

• –Name and email address.
• –Password, stored only as a bcrypt hash (we never store your plain-text password). If you sign in with Google, we receive your name and email address from Google.
• –Interface language, time zone and your role in Boostad.
• –Registration requests: name, email address, hashed password (if any), team name and sign-in method. We keep a record of each request, including rejected ones.

When you connect a Facebook account using Facebook Login, we store:

• –Your Facebook user ID and display name. We do not request access to your email address.
• –Your Facebook access token, encrypted with AES-256-GCM before it is written to our database, and its expiry date.

Using that token, and only when you use the corresponding feature, Boostad reads and writes the following through the Meta Marketing API and Graph API:

ads_management

Reading your ad accounts and their campaigns, ad sets, ads, creatives, pixels, apps and media library, so you can pick a template; creating campaigns, ad sets, creatives and ads and uploading images and videos to your ad accounts when you launch; reading performance statistics (such as spend, impressions, reach, clicks and results) of the ad accounts you choose for the Statistics block of your dashboard, to show them there as a summary; running the automated rules you turn on — reading your campaigns, ad sets and ads and their statistics on the rule’s schedule and, when the rule’s conditions are met, turning them on or off, deleting them, changing their budget, bid, bid strategy or name, or copying them.

business_management

Reading business assets available to your ad accounts, such as the Instagram accounts of the business that owns an ad account, so they can be used as the identity of your ads.

pages_show_list

Showing the list of Facebook Pages you manage, so you can choose the Page your ads run from.

pages_read_engagement

Reading your Page and its posts when you reuse an existing ad or post (for example, its call-to-action button), checking which Instagram account is linked to the Page, and listing your Page’s own posts and photos in the Facebook Pages module.

pages_manage_posts, pages_manage_metadata

Facebook Pages module only, requested separately when you grant access from that module: updating your Pages’ profile picture, cover and details, publishing and scheduling posts, and removing posts and content from your Pages at your request.

pages_manage_engagement, pages_read_user_content, pages_messaging, instagram_basic, instagram_manage_comments, instagram_manage_messages, ads_read

Reply automations only, requested separately when you grant access from that module: reading comments on the posts and ads of the Pages you enable in the module and of the Instagram accounts linked to them; hiding, deleting and replying to those comments, posting comments as your Page, sending one private message in reply to a comment, and replying to messages people send to your Page in Messenger and to the linked Instagram account in Instagram Direct — only as set up in the flows you create; subscribing your Pages to Meta’s comment and message notifications; and finding which of your ads a commented post belongs to.

Page access tokens are requested from Meta when needed for an action and are not stored in our database. Performance statistics are read from Meta when you open your dashboard and when an automated rule runs. For the dashboard, statistics are read only for the ad accounts and metrics you choose, at most once an hour for each ad account and period (or when you press “Refresh”, at most once every 5 minutes). We store only the totals for each chosen ad account and period (today, the last 7 days, the last 30 days and all time) — for example, spend, impressions, clicks and conversions — together with the ad account’s currency and the time they were read. They are overwritten at every refresh and deleted when you remove the ad account from your dashboard settings. Statistics read for automated rules are kept in server memory for up to a few minutes to avoid repeated requests and are not stored, except the metric values that made a rule act or notify you, which are kept in that rule’s history (see Section 2.9).

When you connect a Snapchat account, we store:

• –Your Snap member ID, display name and email address, as provided by Snap, and the organization you selected.
• –Your Snapchat access and refresh tokens, encrypted with AES-256-GCM, and their expiry date.

Using those tokens, and only when you use the corresponding feature, Boostad reads your Snapchat organizations, ad accounts, Public Profiles, campaigns, ad squads, ads, creatives and media (to use them as templates), uploads your media, and creates campaigns, ad squads, creatives and ads in your ad accounts when you launch. When you create and turn on automated rules for your Snapchat ad accounts, Boostad also reads your campaigns, ad squads, ads and their statistics on the rule’s schedule and, when the rule’s conditions are met, changes them (status, budget, bid or name) or copies them. When you choose Snapchat ad accounts for the Statistics block of your dashboard, Boostad reads their statistics. Statistics are handled as described for Meta in Section 2.2.

When you connect a TikTok For Business account, we store:

• –Your TikTok For Business user ID, display name and email address, as provided by TikTok (TikTok returns the email address partially masked).
• –Your TikTok access token, encrypted with AES-256-GCM. TikTok issues a long-term token that does not expire; it stops working when you cancel the authorization or disconnect it in Boostad.
• –The IDs of the ad accounts and of the permissions you granted to Boostad, as returned by TikTok when you connect.

Using that token, and only when you use the corresponding feature, Boostad reads your TikTok ad accounts (their names, currency and time zone). When you create and turn on automated rules for your TikTok ad accounts, Boostad also reads your campaigns, ad groups, ads and their reporting statistics on the rule’s schedule and, when the rule’s conditions are met, changes them (status, budget, bid, bid strategy or name) or notifies you. When you choose TikTok ad accounts for the Statistics block of your dashboard, Boostad reads their reporting statistics. Statistics are handled as described for Meta in Section 2.2. When you launch campaigns in TikTok, Boostad reads your campaigns, ad groups, ads, pixels, custom audiences and the TikTok accounts available to the ad account (to use them as templates and to check access), uploads your videos, and creates campaigns, ad groups and ads in your ad accounts. When you turn on Reply automations for a TikTok ad account, Boostad reads the comments on that account’s ads and hides or replies to them as your flows say (Section 2.11). When you disconnect TikTok or delete your Boostad account, we revoke the token with TikTok and delete it.

Separately, in Reply automations you can connect a TikTok account (the account that posts videos, not an ad account) by signing in with it. For each connected TikTok account we store its TikTok ID, username, display name and profile image link, the permissions you granted, and its access token (valid for 24 hours) and refresh token (valid for a year), both encrypted with AES-256-GCM. Boostad uses them only for Reply automations: it reads the account’s latest videos (their IDs, links, captions and times) to find new comments, reads the comments on them, and replies to, hides or likes comments as your flows say (Section 2.11). If a connected account owns the post used in an ad of a TikTok ad account where Reply automations are on, Boostad checks that with this token and sends replies under that ad from this account. When you disconnect the account in Boostad or delete your Boostad account, we revoke the token with TikTok and delete it.

• –Sign in with Google: your Google account ID, name and email address.
• –Google Drive (optional): your Google account ID, name, email address and encrypted access and refresh tokens. We use the drive.file scope, which only gives us access to the files you choose in the Google Picker — not to the rest of your Drive.
• –Links to public Google Drive folders and public Google Sheets that you paste are read without your Google account.
• –Google BigQuery (optional, for custom metrics of automated rules): your Google account ID and email address, encrypted access and refresh tokens, and the Google Cloud project you choose for queries. We use the bigquery.readonly scope: Boostad can only read data and cannot change or delete anything in BigQuery. Boostad runs only the SQL queries you write in your custom metrics, in the project you choose, on behalf of your Google account — so they are billed to that project under your BigQuery pricing. A query that would read more than 10 GB is not run.

If you connect Dropbox, we store your Dropbox account ID, name, email address and encrypted access and refresh tokens, and use them to list and download the files and shared links you choose.

• –File name and type, the media identifiers returned by Meta, Snap or TikTok (image hash, video ID, Snap media ID, TikTok video ID), a preview image URL provided by Meta, and the ad account ID. This lets you reuse previously uploaded creatives.
• –We do not keep copies of your ad images or videos. Files you upload from your computer to Meta go directly from your browser to Meta. Files from Google Drive, Dropbox or links, and all files uploaded to Snapchat or TikTok, pass through our servers only while they are being transferred and are not stored.
• –Uniquify (Meta, Snapchat and TikTok launchers): when you turn it on, a file from your computer is first uploaded to our file storage (operated by Railway) so that our servers can make a slightly changed version of it for each ad account. The original is deleted automatically after 24 hours; the versions are sent to the ad platform and are not kept.
• –Facebook Pages module: photos and videos you add to Page posts, and the profile picture and cover you set, are uploaded from your browser to our file storage (operated by Railway) so that Facebook can download them when the posts or changes are created. They are deleted automatically 24 hours after the posts or changes are created (this window lets you retry failed posts), or 24 hours after you add them if they are not used.

• –Launch history: campaign name, platform campaign ID, ad account ID and name, campaign objective, launch type, number of ad sets and ads created, status, progress and error messages. This is the history shown in your dashboard.
• –Saved launch presets: the settings of a launch (including a copy of the template campaign’s settings) that you choose to save for reuse.
• –Technical launch logs: for each launch, the names of created objects, platform error codes and the names of settings that a platform rejected. We use them to diagnose failures and improve reliability.
• –Launch snapshots: if a launch fails, a copy of the settings that were being sent (campaign, ad set, creative and ad settings, including targeting, ad texts and links), so we can find the cause.
• –Background job records used to run launches after you start them.
• –Facebook Pages module: design templates (without images), post text templates, your publishing draft, a snapshot of your Pages’ data shown in the overview (Page details such as name, picture, cover, categories, description, contacts, address and hours, recent posts, Page status and the linked Instagram account), and the history of tasks — publications, design changes and cleanups (Page IDs and names, post texts and schedules, Facebook post IDs, the fields changed and results). A cleanup search keeps the IDs, dates and short texts of the posts and photos it found until you run or discard the cleanup.
• –Dashboard settings: the ad accounts (their IDs, names, currencies and time zones) and the metrics you choose for each platform in the Statistics block of your dashboard, and the stored totals described in Section 2.2.

• –Rules you create for your Meta Ads, Snapchat Ads and TikTok Ads accounts: their name, the ad accounts they apply to, filters, conditions, actions, schedule, folders and earlier versions of each rule.
• –Rule history: for each run, the time, the ad accounts checked and how many objects were checked; and the campaigns, ad sets and ads a rule acted on or reported (their names and IDs, the campaign and ad set they belong to and their status at that moment), the action, the values before and after the change, the metric values at that moment, and any error messages.
• –Rule frequency records: when rule history is deleted after 90 days, for each object a rule acted on we keep only its ID, the ad account ID, the date of the last action and the number of copies made — so that a rule set to act once, or once every N days, does not act on the same object again.
• –Custom metrics and saved timeframes: their names, formulas, timeframe definitions, the addresses of the public Google Sheets they use and the text of their database queries (BigQuery, PostgreSQL, MySQL, ClickHouse). Values read from these sheets and query results are used during a rule run and kept in memory for a few minutes; we do not store query results — values are stored only as metric values in the rule history.
• –PostgreSQL, MySQL and ClickHouse connections (optional, for custom metrics of automated rules): the server address and port, the database name, the user name and password you enter, the encryption setting and the connection name. The password is stored encrypted. Boostad connects to your database only to check the connection and to run the SQL queries you write in your custom metrics — each in read-only mode, for up to 30 seconds and reading at most 50,000 rows. We recommend connecting a database user that can only read data.
• –Notification channels you connect: for Telegram, the ID, type and title of the chat; for Slack, when you add the Boostad app to your workspace, the workspace name and either the channel name and the incoming webhook address that Slack gives Boostad (for a channel) or the Boostad app’s access token for your workspace and your Slack user ID (for direct messages), stored encrypted; and the last delivery error, if any.

When you send feedback through the in-app form, we store your message and its type. If you leave the “attach diagnostics” option on, we also store the page address, your browser’s user agent, screen size and the most recent JavaScript errors from that page, together with the app version.

When you grant Boostad access to comments and messages, Reply automations are turned on for every Page you can moderate; you can turn them off for any Page at any time. For the Pages where they are on, we store:

• –The Page ID and name, the ID and username of the Instagram account linked to it, and the Page variables you enter (for example, a brand name or a link used in replies).
• –Comments posted on the Page’s posts and ads, and on the posts and ads of the linked Instagram account, after you enabled the module: the comment ID, the post or ad it was left on, the comment text, its time, whether it is a reply, and the author’s ID and name when Meta provides them. These comments are written by other people; Boostad processes them only to run the flows you set up for your own Pages.
• –Messages people send to the Page in Messenger and to the linked Instagram account in Instagram Direct, after you enabled the module: the message ID, the sender’s Page-scoped ID (not their name), the text, the attachment type and its time. Boostad processes them only to run the message flows you set up for your own Pages; replies are sent only within Meta’s 24-hour messaging window.
• –The flows you create (their conditions, reply texts, versions and templates), your Page groups and the author allowlist you enter (Facebook or Instagram user IDs and labels).
• –A log of what each flow did with each comment: the steps taken, the reply or message text sent, the result and the IDs Meta returned for the replies, comments and messages created.
• –If you turn on “Mention the author” in a reply, the reply we post on your behalf mentions the comment’s author (their Facebook Page-scoped ID or Instagram username, as Meta provides them).
• –An index linking your Pages’ posts to your ads (ad, ad set and campaign IDs and names, and delivery status), used to apply flows to ads and refreshed about once an hour while the module is on.
• –Notification settings of each flow: the Telegram chats or Slack channels you choose, whether to report flow errors, the summary schedule, and when the last error notification was sent.
• –TikTok ad accounts where you turn on Reply automations: the ad account ID, name and time zone, the variables you enter, and comments left on that account’s ads after you turned it on — the comment ID, its text and time, whether it is a reply, the TikTok video, ad, ad group and campaign it was left on (IDs and names), the identity of the ad, and the author’s TikTok user ID and username as TikTok provides them. Boostad reads these comments every few minutes only while a flow you turned on uses that ad account, and only to run your flows; replies are posted as the ad’s identity.
• –TikTok accounts you connect to Reply automations (they are turned on when you connect them; you can turn them off at any time): the account ID, username and display name, the variables you enter, and comments left on that account’s videos while it is on — the comment ID, its text and time, whether it is a reply, the video it was left on (ID and link), and the author’s TikTok ID, username and display name as TikTok provides them. TikTok notifies Boostad about new comments, and Boostad also checks the latest videos every few minutes, only while a flow you turned on uses that account and only to run your flows; replies and likes are made as that account.

Our servers keep standard logs (such as IP address, requested address, time and errors) for security and troubleshooting. IP addresses are also used, in memory only, to limit repeated registration attempts.

When an error occurs in Boostad, we send an error report to our error-monitoring provider, Sentry: the error message and where in our code it happened, the page address, your browser and operating system, the app version and your internal Boostad user ID. Error reports do not include your name, email address, IP address, passwords, cookies or request contents, and we remove access tokens from them before they are sent.

When you launch campaigns, upload creatives or manage Pages, we send the advertising content and settings you create (campaigns, ad sets, creatives, ads, media, Page posts and Page details) to Meta on your behalf. When your automated rules act, we send Meta the changes they make to your campaigns, ad sets and ads. When your comment and message flows act, we send Meta the replies, comments and messages they post and the comments they hide or delete. Meta processes this data under the Meta Privacy Policy.

When you launch campaigns or upload creatives to Snapchat, we send the advertising content and settings you create (campaigns, ad squads, creatives, ads and media) to Snap Inc. on your behalf, and when your automated rules act, the changes they make to your campaigns, ad squads and ads. We do not provide Snap with personal data about our users beyond what is needed to act on your connected account. The Snap Privacy Policy is incorporated into this Privacy Policy by reference and applies to data processed by Snap.

When you launch campaigns or upload creatives to TikTok, we send the advertising content and settings you create (campaigns, ad groups, ads and videos) to TikTok on your behalf. When your automated rules act on your TikTok ad accounts, we send TikTok the changes they make to your campaigns, ad groups and ads; when your Reply automations act on comments on your TikTok ads and on your TikTok accounts’ videos, we send TikTok the replies and the hide and like requests. We do not provide TikTok with personal data about our users beyond what is needed to act on your connected account. TikTok processes this data under its own privacy policy for TikTok For Business.

We communicate with Google and Dropbox only to sign you in (Google), to read the files you select and to run the BigQuery queries of your custom metrics. See the Google Privacy Policy and the Dropbox Privacy Policy. Boostad’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect a Telegram chat or a Slack channel for rule notifications, we send it the summaries of your rules’ runs — names and IDs of your campaigns, ad sets and ads, metric values, actions taken and errors — and warnings about expiring access to your Meta account. If you choose a chat or channel in a Reply automations flow, we send it that flow’s errors and summaries (counts of comments, messages and actions) and, for a “Notify” step, the comment or message the step was triggered by: the Page name, the text, the author’s name when Meta provides it, what the flow did and a link to the comment. Anyone in that chat or channel can read these messages. Telegram and Slack process them under the Telegram Privacy Policy and the Slack Privacy Policy. You choose which rules and flows send notifications and can disconnect a chat or channel at any time.

Our application and database are hosted by Railway, which stores and processes data on our behalf only to operate the infrastructure. Our website is served through Cloudflare, which provides the network connection, HTTPS encryption and protection against attacks: requests and pages exchanged between your browser and Boostad pass through Cloudflare's network, and Cloudflare processes them only to deliver and protect the service. Error reports (see 2.10) are processed by Sentry only to help us find and fix errors; a report may include technical identifiers of the objects involved, such as an ad account, campaign or ad ID. Apart from these providers and the notifications you set up (see above), no other service provider has access to the data we receive from Meta or Snap.

We may disclose information if required by applicable law, regulation or a valid legal request.