Privacy policy

About this policy

Scadop is an advertising-management platform for teams. This policy explains how we handle information when you visit our website, use a Workspace, or connect an advertising provider, including Meta/Facebook. It also applies to our staging and beta services.

Scadop handles account and service information to operate the platform. When an organization uses a Workspace, it determines how its advertising and business data is used within that Workspace. Contact that organization as well as Scadop when your request concerns data it controls.

Information we handle

• Account information: your name, email address, authentication identifiers, Workspace membership, assigned permissions, and support correspondence.
• Meta advertising data: the provider identity you authorize, connected ad account identifiers and names, currency and timezone, account access information, Campaigns, Ad Sets, Ads, associated creative metadata, delivery status, and performance reporting made available by your granted permissions.
• Analytics and uploaded data: advertising performance, reporting settings, and content or business records your organization chooses to supply through enabled features.
• Service information: security and audit events, request and error information, and session information needed for authentication, reliability, and abuse prevention.

How we use information

We use information to authenticate users, apply Workspace permissions, connect authorized accounts, synchronize advertising data, produce reports, support users, and protect the service. Where execution features are available, actions require the applicable permissions and approvals.

We do not sell Meta integration data. We use it to provide the integration and user-requested advertising-management functions, rather than for unrelated advertising or profiling.

Provider credentials and access

Provider access tokens are stored encrypted in a server-side credential vault. They are used by authorized backend services and are not exposed in the application interface or browser storage. Do not send tokens, passwords, or app secrets to our support address.

Connecting Meta authorizes only the permissions requested in its consent flow. Additional permissions require a separate authorization step. You may revoke Scadop access through Meta or disconnect the integration in Scadop. Revocation stops future authorized access; it does not itself erase previously retained information.

Sharing and subprocessors

Information is available to authorized members of your Workspace according to their assigned access. We use service providers to operate Scadop, including Clerk for authentication, Render for hosting and databases, and Cloudflare for network and storage services. Data shared with each depends on the service it provides.

Connected advertising providers receive requests and information needed for the integrations you use. Their own privacy terms also apply. We may disclose information where legally required or necessary to address fraud, security incidents, or the protection of rights. Service providers may process information in countries other than your own; applicable transfer requirements govern those arrangements. Contact us for details about relevant subprocessors and processing locations.

Retention and deletion

We retain information for as long as needed to provide the service and connected reporting, meet applicable legal obligations, resolve disputes, and maintain necessary security records. The appropriate period depends on the type of data, the Workspace relationship, and the reason for retention.

When data is no longer needed, we delete it or anonymize it. Any data that must be retained for a legal obligation is limited to that purpose. Backup copies may remain until the applicable backup lifecycle completes and are not used for ordinary service activity. We explain relevant retention limits when responding to a request.

For Meta data removal, follow our data-deletion instructions. Disconnecting a provider, leaving a Workspace, and requesting deletion are distinct actions.

Security and session storage

Scadop uses encrypted transport, encrypted provider credentials, tenant access controls, and permission checks to protect information. Access to operational systems is restricted. No system can guarantee absolute security.

Authentication cookies and local interface preferences support sign-in and application use. Provider credentials are not stored in those preferences. These public policy pages can be read without signing in.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, or a copy of your personal information, object to certain processing, or withdraw consent where processing relies on consent. You may also contact the relevant data-protection authority.

Send requests to contact@scadop.com. We may ask for proportionate information to verify your identity and authority over a Workspace or connected account. We respond within applicable legal timeframes and explain any limits on fulfilling a request. Do not include passwords or access tokens.

Changes and contact

We update this policy when our practices or service change. The date above identifies the latest version. Material changes will be communicated where required. For privacy questions, contact Scadop at contact@scadop.com.