Privacy Policy

1. About This Policy

This Privacy Policy describes how Scale Scientist (“Scale Scientist,” “the App,” “we,” “our,” “us”) collects, uses, stores, and shares information when you authorize the App to access your Meta (Facebook and Instagram) advertising accounts. Scale Scientist is operated by Scale Scientist Inc. (British Columbia, Canada).

Scale Scientist is a software product that helps businesses manage, publish, and optimize Meta advertising campaigns using rules (“SOPs”) that you configure. It integrates directly with Meta’s Marketing API on your behalf.

By authorizing the App via Facebook Login, you agree to the practices described in this policy. If you do not agree, do not authorize or continue to use the App.

2. Scope

This policy applies to data that Scale Scientist accesses, processes, and stores in connection with providing the App. It does not cover Meta’s own collection and use of data, which is governed by Meta’s Privacy Policy.

3. Data We Access from Meta

When you authorize Scale Scientist via Facebook Login, we access the following categories of information through Meta’s APIs, limited to the permissions you grant:

• Authentication data: your Meta user ID, name, and email address, used to authenticate your session.
• Ad account structure: ad accounts you have access to, including their IDs, currency, spend caps, and status.
• Campaign data: campaigns, ad sets, and ads — including names, objectives, budgets, schedules, targeting summaries, and status.
• Ad creative: images, videos, copy, and metadata associated with your ads.
• Performance metrics: impressions, reach, clicks, spend, conversions, CPA, CPM, ROAS, frequency, and similar campaign and ad-level analytics.
• Page information: the list of Facebook Pages you administer and their basic engagement data, used where ads are associated with a Page.
• Business Manager structure: the Business Manager accounts and assets your Meta user has access to, used to scope which ad accounts can be managed through the App.

We do not access your Facebook news feed, personal messages, friends list, photos unrelated to your ads, or any other Meta data outside the scope listed above.

4. Meta Permissions We Request

Scale Scientist requests the following Meta platform permissions. We request only what is necessary to deliver the App’s features, and you may revoke any permission at any time through your Facebook Business Integrations settings.

• public_profile — Basic identity (name, user ID) to authenticate your account.
• email — To send account notifications and the audit log digest.
• pages_show_list — To list the Facebook Pages you administer so you can choose which to manage.
• pages_read_engagement — To read Page-level engagement data that informs ad optimization.
• pages_manage_ads — To manage Page-associated ads (pause, duplicate, create) in line with your configured rules.
• business_management — To identify the Business Manager accounts and assets associated with your Meta user.
• ads_read — To read campaign, ad set, ad, and performance data.
• ads_management — To create, edit, pause, and optimize campaigns, ad sets, and ads on your behalf.

If new features require additional permissions, you will be prompted to grant them and this policy will be updated accordingly.

5. How We Use Your Data

We use the data described above exclusively to:

• Authenticate you and maintain your session.
• Display your ad accounts, campaigns, creatives, and performance metrics within the App interface.
• Enable you to create, edit, publish, and pause Meta ad campaigns directly from the App.
• Evaluate the rules (SOPs) you have enabled and execute the actions you have authorized — such as pausing underperforming ads, shifting budget, or protecting target CPA.
• Generate AI-assisted optimization recommendations (see Section 6).
• Produce the audit log that records every action we take on your behalf.
• Send transactional email (account notifications, audit summaries, security alerts).
• Comply with legal obligations and enforce our Terms of Service.

We do not use your data for advertising to you, for profiling, for resale, or for any purpose unrelated to operating the App on your behalf.

6. AI Processing — Anthropic Claude

Scale Scientist uses Anthropic’s Claude AI (“Claude”) to evaluate campaign performance against your configured rules and to generate optimization recommendations. When AI features are used, relevant data — typically anonymized campaign metrics, ad structures, and configured rules — is transmitted to Anthropic’s API for processing.

• Data sent to Anthropic is used solely to return a result to Scale Scientist.
• Anthropic processes this data under its Commercial Terms and does not use it to train foundation models (per Anthropic's default commercial API terms).
• Personally identifying Meta user IDs and email addresses are not sent to Anthropic.

Anthropic’s practices are governed by Anthropic’s Privacy Policy.

7. Data Storage and Retention

Scale Scientist is designed to minimize stored data. Specifically:

Stored (for the App to function):

• Your Meta user ID, name, and email, linked to your Scale Scientist account.
• An encrypted Meta API access token, used to perform the actions you authorize. Tokens are encrypted at rest using industry-standard encryption.
• The rules (SOPs) you have configured.
• The audit log of actions Scale Scientist has taken on your behalf.
• Standard server and security logs (IP addresses, request timestamps, error traces).

Not stored:

• Ad creative assets (images, videos, copy) — streamed from Meta on demand.
• Detailed Meta performance data — fetched live from Meta's APIs; cached briefly (under 5 minutes) only to reduce API load.
• Your Meta password (never accessed or stored).

Retention periods:

• Account data and rules: retained while your account is active, and deleted within 14 days of account closure or a verified deletion request.
• Audit log: retained for 30 days to enable rollback, then deleted.
• Server/security logs: retained for up to 90 days, then automatically deleted.
• Inactive accounts: if you do not log in or take action for 12 consecutive months, we will notify you and delete your account data within 14 days thereafter.

8. Subprocessors

To operate the App, we share data with the following third-party service providers (“subprocessors”):

• Meta Platforms, Inc.: Ad account integration (source and destination of Platform Data). All data described in Section 3, under Meta's own Privacy Policy.
• Vercel Inc.: Application hosting and edge network for ads.scalescientist.com. All traffic to and from the App passes through Vercel. Vercel does not store Platform Data except in transient request logs.
• Anthropic PBC: AI processing for optimization recommendations (see Section 6). Anonymized campaign metrics and rule definitions.

We do not sell, rent, or trade your data to any third party.

9. Data Sharing

Beyond the subprocessors listed above, we only disclose your data when:

• Legal compliance: we are compelled by valid legal process (subpoena, court order, lawful request by a competent authority), or when disclosure is necessary to protect the rights, property, or safety of Scale Scientist, our users, or the public.
• Business transfers: in the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred to the acquiring entity, subject to this policy or a successor policy at least as protective.
• With your consent: if you explicitly authorize us to share data for a specific purpose.

10. Your Rights and How to Exercise Them

You have the right to:

• Access: request confirmation of what data we hold about you and receive a copy.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: ask us to delete your account and associated data.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Objection and restriction: object to or ask us to restrict certain processing.
• Withdraw consent: revoke the App's access to your Meta account at any time via Facebook Business Integrations. Revocation also triggers deletion of your stored Scale Scientist data within 14 days.

To submit a request, email us at privacy@scalescientist.com or follow the instructions at scalescientist.com/data-deletion. We will acknowledge within 72 hours and complete the request within 14 days.

11. Your Rights under GDPR (EEA, UK, Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR / UK GDPR:

• Contract (Article 6(1)(b)): to perform the services you request.
• Legitimate interests (Article 6(1)(f)): to secure the App, prevent fraud, and improve reliability.
• Consent (Article 6(1)(a)): where required (e.g., optional communications).
• Legal obligation (Article 6(1)(c)): to comply with applicable law.

You have the rights set out in Section 10 and, in addition, the right to lodge a complaint with your local data protection authority. Scale Scientist acts as a data processor with respect to the Meta data we handle on your behalf; you are the data controller.

12. Your Rights under CCPA / CPRA (California)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, disclosed, and sold.
• Access, correct, and delete your personal information.
• Opt out of the sale or sharing of personal information — we do not sell or share personal information as defined by the CCPA/CPRA.
• Limit the use of sensitive personal information — we do not use personal information for cross-context behavioral advertising.
• Be free from discrimination for exercising these rights.

To exercise these rights, email privacy@scalescientist.com.

13. International Data Transfers

Scale Scientist is operated from British Columbia, Canada, and uses subprocessors (Meta, Vercel, Anthropic) that operate globally, primarily in the United States. When data is transferred internationally, we rely on Standard Contractual Clauses, adequacy decisions, or equivalent safeguards as required by applicable law.

14. Security

We protect your data with commercially reasonable safeguards:

• All communication between the App, Meta's APIs, and your browser uses HTTPS/TLS.
• Meta API access tokens are encrypted at rest.
• Access to production systems is restricted to authorized personnel and logged.
• We follow industry best practices for secure development, including dependency scanning and regular security reviews.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.

15. Children’s Privacy

Scale Scientist is intended for business users who are at least 18 years of age and who manage Meta advertising accounts. The App is not directed at children under 13 and we do not knowingly collect data from children.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users or via a prominent in-app notice at least 14 days before taking effect. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

17. Contact

For questions, data requests, or concerns about this Privacy Policy:

Scale Scientist is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. “Meta,” “Facebook,” and “Instagram” are trademarks of Meta Platforms, Inc.