Privacy Policy

1. Who we are

ECSD Campaign Manager (the “Application”) is a private internal tool for creating, reviewing, and reporting on Meta advertising campaigns. It is operated by the organization that owns this Meta application (the “Operator”).

The Application is not a consumer product and is not offered to the public. The only people who use it are the Operator and the Operator’s employees and contractors who have been given access.

2. What this policy covers

This privacy policy explains what information the Application collects, why it is processed, how long it is kept, and how to ask for deletion. It applies to:

• Authorized staff and contractors who sign in to the Application.
• Advertising and page data retrieved from Meta on behalf of ad accounts the Operator is authorized to manage.
• Operational records the Operator stores in the Application, including client settings, campaign drafts, location targeting, and school directory data used for campaign setup.

The Application does not use Facebook Login and does not let members of the public create accounts or authorize the app.

3. Information we collect

Sign-in and session data. Access uses Microsoft Entra ID for authorized work accounts. We store the signed-in person’s name, work email, Entra object and tenant identifiers, assigned client and role, and a session cookie so they can stay signed in. We do not use Facebook Login.

Meta advertising data, retained for reporting. When authorized staff connect or sync an ad account, we collect and keep copies of Meta Marketing API data, including:

• Ad account, Facebook Page, and Instagram identity identifiers and names.
• Campaign, ad set, ad, and creative configuration and status.
• Daily performance insights such as impressions, clicks, reach, spend, and related delivery metrics.
• Raw Meta API responses stored so reporting and troubleshooting can be repeated without losing history.

Operator-entered operational data. Staff may save client records, authorized Meta assets, campaign drafts, provisioned campaign identifiers, location targeting presets, school records used to build campaigns, and user access assignments.

School directory data. The Application may import publicly published Edmonton Catholic school directory records (for example school name, address, program list, coordinates, and institutional phone or email). That source data is used to set up campaigns. It is not student education records collected from children.

Server credentials. Meta access tokens and related secrets are stored as server configuration so the Application can call Meta APIs. They are not displayed in the user interface.

4. How we use this information

We process this information only to:

• Authenticate authorized staff and keep an active session.
• Discover, authorize, and use the Meta Pages, Instagram identities, and ad accounts the Operator may manage.
• Create, review, and update paused Meta campaigns on behalf of authorized clients.
• Sync Meta advertising objects and insights and retain those copies for internal reporting.
• Maintain the school and location data needed to target those campaigns.

We do not sell this information. We do not use it for consumer advertising, profiling of the general public, or unrelated commercial purposes.

5. How we share information

Campaign setup and reporting require the Application to send requests to Meta and to receive advertising data back. Meta processes that information under Meta’s own terms and policies.

Information is also stored with the Operator’s hosting and database providers so the Application can run. Access is limited to the Operator and to employees or contractors who need it to operate the Application.

We may disclose information if required by law or to protect the Application, the Operator, or the advertising accounts it manages.

6. Retention

Meta advertising objects, daily insights, snapshots, and raw API responses are retained for internal reporting until the Operator deletes them or decommissions the Application. There is no automatic purge of reporting history.

Client, school, location, user, and campaign draft records are kept while they are needed to operate the Application. Session cookies expire when the session ends or the cookie lifetime elapses. Server credentials are kept only while the Application is configured to call Meta.

7. How to request deletion

Authorized staff and contractors can ask the Operator to delete Application data that relates to them, including their user record and session access. Deletion usually means disabling or removing that person’s account and, if requested, removing other records they ask to have removed.

The Application does not collect personal data from Facebook or Instagram account holders through Facebook Login or similar consumer login. If you believe personal information about you was stored through this Application, contact the Operator and ask for it to be deleted. The Operator will review the request and delete or de-identify stored copies where they can be identified.

Requests can be made by emailing the administrator who issued your access, or by using the contact email listed on this Application’s Meta App Dashboard listing.

8. Security

Access is restricted to people from allowed Microsoft Entra tenants who have been approved for a role. Sessions use an HTTP-only cookie. Meta credentials stay on the server. No security measure is perfect, and the Operator cannot guarantee that stored information will never be accessed without authorization.

9. Children

The Application is not directed at children and is not used by the public. School directory imports may include publicly published institutional contact details for schools. The Application is not used to collect personal information from students.

10. Changes

If the Operator changes how the Application collects, uses, or retains information, this page will be updated and the “Last updated” date will change.

11. Contact

Questions about this privacy policy, access, or deletion should be sent to the administrator of ECSD Campaign Manager, or to the contact email shown on the Meta developer listing for this application.

This page is the Application’s privacy policy. The public URL of this page should also be entered in the privacy policy field of the Meta App Dashboard.