What we keep,and what we never see.

Adtool is a thin layer on Meta’s Marketing API, built so you can check it yourself. You sign in through Meta with OAuth 2.0, so we never see or store a password. Everything Adtool does runs through Meta’s own permission system, under a scoped token you can revoke at any time. Every piece of data we hold is kept apart per organization by row-level security, enforced by the database itself, on every table.

We keep what runs your workspace, and nothing in case it comes in handy.

• Row-level security on every table. The rule that keeps organizations apart doesn’t sit in our code, where a bug could skip it. PostgreSQL enforces it, so a query scoped to your organization can’t return another organization’s rows.
• Every data route checks who’s asking. Every request that touches your data re-checks the session on the server first. Privileged operations, our own admin tools included, sit behind separate allowlisted checks that fail closed.
• Signed webhooks only. Callbacks from Stripe and Meta are verified by their signature (HMAC) before we process them. Unsigned requests are rejected.
• Internal access. Only the few engineers who run the system can reach production data, under the audit-logged limits our privacy policy commits us to.

The part agencies look at hardest, so here it is in full.

• Authorization, not credentials. You grant access on Meta’s own domain. Adtool gets a scoped OAuth token with only the permissions it needs to manage pages, upload creatives, read performance and launch ads.
• Encrypted, with the key kept elsewhere. Meta and Google tokens are stored only encrypted (AES-256-GCM, applied by the application), with the key held outside the database, so a copy of the database alone can’t act on an ad account. Your Meta token is decrypted only on our servers, never in your browser. The one token your browser does get is a short-lived Google one, because Google’s own Drive picker needs it to open.
• Revoked at once. Remove Adtool in your Meta Business settings and the token stops working right away. No leftover access, nothing to ask us for.
• A full audit trail, kept by Meta. Everything runs through Meta’s permission system, so every action Adtool takes shows in your Meta activity history, just as if a teammate had done it. You never have to take our word for what happened.
• Syncing inside Meta’s limits. Our performance sync runs well inside Meta’s API limits, and we pace requests per ad account, the discipline Meta expects of platforms with advanced API access.
• Checked by Meta, every year. With advanced access to Meta’s advertising APIs, Adtool goes through Meta’s annual Data Protection Assessment. Falling short would cost us the access the product runs on, so our incentives line up with yours.

We chose not to run servers of our own. Adtool runs on independently audited infrastructure:

• SupabaseDatabase and sign-in
• VercelApplication hosting
• StripePayments
• CloudflareMedia processing and delivery

All traffic is encrypted in transit with TLS, and data at rest is encrypted with AES-256 at the infrastructure level on each of these platforms. The tokens you grant us get a second layer: the application encrypts them itself (AES-256-GCM), the database only ever holds that encrypted form, and the key is kept apart from it. The full list of providers, with where data lives and how transfers are safeguarded, is public on our subprocessors page. Nothing is left out.

Adtool ApS is a Danish company. GDPR is the law we’re incorporated under, not a box we ticked to sell in Europe.

• A DPA as standard. Our Data Processing Agreement is part of the standard terms. No enterprise tier, no negotiation.
• Documented transfer safeguards. Every US-based subprocessor works under the EU Standard Contractual Clauses, documented provider by provider on our subprocessors page.
• Deleted on request, revoked at once. Disconnecting Meta cuts our API access at once, and a deletion request to us removes your stored data. Both are permanent. The only exceptions are records the law makes us keep, like invoices under Danish bookkeeping law, which follow the retention periods in our Privacy Policy.

The formal documents: Data Processing Agreement · Subprocessors · Privacy Policy