Last updated: 25 June 2026

1. General

This Privacy Policy ("Policy") describes how Botan App Limited ("Company", "we", "us", or "our") collects, processes, and retains data in connection with the internal marketing analytics and campaign automation platform and its integration with the Meta Marketing API ("Service").
The Service is a business-to-business (B2B) technical integration. The users of the Service are business entities ("Clients") that connect their Meta Business Manager accounts and ad accounts to the Service. The Service does not interact with or collect personal data of end users of Client advertising campaigns.
This Policy is published for purposes of compliance with Meta Platform Terms and Meta App Review requirements. It is addressed to Clients and any other parties whose data may be processed in connection with the Service.
By accessing or using the Service, the Client acknowledges that it has read and understood this Policy.
If you have any questions regarding this Policy, please contact us at finance@botanapp.com.

2. Data Controller

Botan App Limited, with its registered address at Archiepiskopou Makariou III, 95 Charitini Building, 1st floor, Flat/office 102, 1071 Nicosia, Cyprus, is the data controller for any personal data processed in connection with the Service.

3. What Data We Collect

Advertising and campaign data: aggregated performance metrics from Meta Ads API, including ad spend, impressions, clicks, reach, frequency, cost per result, campaign status, ad set configurations, targeting parameters, budget and bid strategy settings, and creative asset metadata. This data is retrieved from Client ad accounts and Business Manager accounts via the Meta Marketing API.
Campaign structure data: information about campaign hierarchies created or managed through the Service, including campaigns, ad sets, ads, targeting configurations, and creative specifications.
Business account data: Meta Business Manager account identifiers, ad account identifiers, and associated account-level metadata necessary to authenticate and operate the Service.
Usage and technical data: logs of API calls, error reports, and operational data generated in the course of providing the Service.

The Service does not collect, process, or store personally identifiable information of end users of Client advertising campaigns. All advertising performance data processed through the Service is aggregated at the campaign, ad set, or ad level and does not identify individual persons.
The Service does not collect special categories of personal data as defined under applicable data protection law.

4. Purposes and Legal Bases for Processing

We process data collected through the Service for the following purposes:
Provision of the Service: to collect, process, and present aggregated advertising analytics and campaign performance data to the Client; to enable automated creation and management of advertising campaign structures via the Meta Marketing API. Legal basis: performance of contract with the Client.
Campaign automation: to programmatically create full campaign structures on behalf of the Client, including campaigns, ad sets, targeting configuration, budget and bid strategy, creative asset uploads, and individual ads. Legal basis: performance of contract with the Client.
Service operation and improvement: to monitor Service performance, identify and fix errors, and ensure technical stability. Legal basis: legitimate interests of the Company in maintaining and improving the Service.
Legal compliance: to comply with applicable laws, regulations, and platform policies, including Meta Platform Terms. Legal basis: legal obligation.

5. Meta Platform Data

The Service accesses Meta Platform Data (as defined in Meta Platform Terms) solely to provide the analytics and campaign automation services described in this Policy.
Meta Platform Data accessed through the Service includes advertising performance metrics, ad account data, campaign structure data, and Business Manager account information.
Meta Platform Data is not used for any purpose other than providing the Service to the Client whose accounts the data originates from.
Meta Platform Data is not sold, transferred, or otherwise disclosed to third parties, except as required by applicable law or as strictly necessary to operate the Service infrastructure (e.g., cloud hosting providers operating under appropriate data processing agreements).
The Company processes Meta Platform Data in compliance with Meta Platform Terms, including the restrictions on data use set out in Section 3 thereof.

6. Data Sharing and Disclosure

We do not sell Client data or Meta Platform Data to any third party.
We may share data with the following categories of recipients, strictly as necessary to provide the Service:
Infrastructure and cloud service providers: hosting, database, and technical operations providers who process data on our behalf under appropriate data processing agreements.
Professional advisors: lawyers, accountants, and auditors who are subject to confidentiality obligations.
Law enforcement and regulatory authorities: where required by applicable law, court order, or regulatory requirement.
Successors in business: in the event of a merger, acquisition, or sale of assets, subject to the acquirer agreeing to protect data in accordance with this Policy.

7. Data Retention

We retain advertising and campaign data for as long as necessary to provide the Service and as required by applicable law.
Upon termination of the Client relationship or upon Client request, data is securely deleted in accordance with Section 10 of this Policy.

8. Data Security

We implement appropriate technical and organizational measures to protect data against unauthorized access, disclosure, alteration, or destruction.
Access to data is restricted to authorized personnel who require access for the purpose of providing the Service.
We use industry-standard encryption protocols for data transmission and storage.
In the event of a data breach that poses a risk to the rights and freedoms of individuals, we will notify affected parties and relevant regulatory authorities as required by applicable law.

9. International Data Transfers

Data processed through the Service may be transferred to and stored in countries other than the country in which it was originally collected.
Where data is transferred from the European Economic Area to countries that do not provide an equivalent level of data protection, we apply appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

10. Data Deletion

Clients may request deletion of their data processed through the Service at any time.
To submit a data deletion request, please contact us at: finance@botanapp.com. Please include in your request: the name of your organization, the Meta Business Manager account ID(s) associated with your account, and a description of the data you wish to have deleted.
We will process deletion requests within 30 days of receipt. Upon completion, we will confirm deletion in writing.
Please note that we may retain certain data after a deletion request where retention is required by applicable law or is necessary to resolve disputes or enforce our agreements.
Where the Service receives a data deletion request from Meta or a Meta user pursuant to Meta Platform Terms Section 3(d)(i), we will process such request in accordance with our obligations under Meta Platform Terms.

11. Contact

Data deletion requests: finance@botanapp.com