What we store, how it’s isolated, and why you stay in control.

Adtool is deliberately built as a thin, auditable layer on top of Meta’s Marketing API. You authenticate with Meta directly via OAuth 2.0 — we never see or store a password. Every action Adtool takes runs through Meta’s own permission system under a scoped access token you can revoke at any time, and every piece of data we hold is isolated per organization with row-level security enforced by the database engine itself — on every table, no exceptions.

We follow a strict data-minimization principle: we store what powers your workspace, and nothing speculative.

• Row-level security on every table. Tenant isolation isn’t a check in our application code that a bug could bypass — it’s a policy enforced by PostgreSQL itself. A query scoped to your organization is physically incapable of returning another organization’s rows.
• Authentication on every customer-data route. Every request that touches your data re-validates the caller’s session server-side before any access. Privileged operations — including our own internal admin tooling — sit behind independent, allowlisted authorization checks that fail closed.
• Webhook integrity. Inbound callbacks from Stripe and Meta are cryptographically verified (signature / HMAC validation) before they’re processed. Unsigned requests are rejected.
• Internal access. Production data access is limited to the small set of engineers who operate the system, under the same audit-logged constraints our privacy policy commits us to.

This is the part agencies rightly scrutinize, so here it is without abstraction:

• Authorization, not credentials. You grant access on Meta’s own domain. Adtool receives a scoped OAuth token tied to the specific permissions required to manage pages, upload creative, read performance data, and launch ads — nothing broader.
• Instant, unilateral revocation. Removing Adtool in your Meta Business settings kills the token immediately. There is no residual access, no offboarding process on our side required.
• A complete audit trail — on Meta’s side. Because everything runs through Meta’s permission system, every action Adtool performs appears in your Meta activity history, exactly as if a team member had done it. You never have to take our word for what happened.
• Rate-governed, read-disciplined syncing. Our performance sync engine is built to operate well inside Meta’s API limits with per-account governance — the engineering discipline Meta expects of platforms with advanced API access.
• Subject to Meta’s standard, every year. As a platform with advanced access to Meta’s advertising APIs, Adtool is subject to Meta’s annual Data Protection Assessment. Falling short means losing the access our product exists on — our security incentives are structurally aligned with yours.

We made an explicit architectural decision not to operate our own servers. Adtool runs entirely on independently audited infrastructure:

All traffic is encrypted in transit with TLS. Data at rest is encrypted (AES-256) at the infrastructure level across these platforms. The full provider list, with data locations and transfer safeguards, is public on our subprocessors page — nothing is undisclosed.

Adtool ApS is a Danish company. GDPR isn’t a framework we opted into for market access — it’s the law we’re incorporated under.

• A Data Processing Agreement as standard. Our DPA is part of our standard terms. No enterprise tier, no negotiation.
• Documented transfer safeguards. All US-based subprocessors operate under EU Standard Contractual Clauses, documented per provider on our subprocessors page.
• Deletion on request, revocation instantly. Disconnecting Meta severs our API access at once; a deletion request to us removes your stored data. Both are permanent — the only exceptions are records we’re legally required to keep, like invoices under Danish bookkeeping law, which follow the statutory retention periods set out in our Privacy Policy.

Formal documents: Data Processing Agreement · Subprocessors · Privacy Policy