On this page
At a glance
- Read-only Meta accessWe only read ad data. We never create, change or delete ads.
- Never sold, no trackersNo advertising use, no third-party analytics, no tracking cookies.
- Private to your accountYour clients and ad data are visible only to you. Tokens are encrypted.
- Delete any timeDisconnect Facebook or delete a client instantly; full deletion on request.
01Who this policy covers#
This policy explains how Metalytics handles information from the website at metalytics.app, the Metalytics app, and the Facebook connection inside it. Metalytics is the data controller under Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "UU PDP").
It does not cover Meta, Facebook or any other service that has its own privacy policy.
02Information we collect#
| Type | What it contains | Source |
|---|---|---|
| Account | Name, email, password hash (nobody can read the password), language, tool access, last sign-in time | Entered by you when you sign up |
| Facebook connection | Facebook user ID and name, encrypted access token, token expiry date | When you click "Connect Facebook" |
| Your own Meta app (if you use one) | App ID, Configuration ID, app name, encrypted App Secret (only its last 4 characters are ever shown) | When you or our team (at your request) set it up in Settings |
| Ad data | Ad account IDs, campaign / ad set / ad names, daily performance figures, breakdowns by age, gender, placement and region | Pulled from Meta, or from CSV files you upload |
| Work content | Clients, optimization notes, to-dos, tasks, report settings | Entered by you |
| Support | Feedback messages and emails you send us | Sent by you |
| Activity log | Account security events: sign-ins, password resets, account created or deleted, access changed, Facebook connected or disconnected | Recorded automatically |
| Technical data | IP address, browser and device type, time of sign-ins and requests | Recorded automatically by our hosting and sign-in providers |
03Data from Meta (Facebook)#
- Connecting Facebook is optional. We ask only for read-only access to ad data (
ads_read). We never create, change, pause or delete ads. - We do not read your posts, messages, friends or personal profile beyond your Facebook ID and name.
- Ad data is aggregated performance figures, not personal data about the people who saw the ads.
- Data from Meta is used only to show information to you inside Metalytics, in line with the Meta Platform Terms. We do not sell it or use it for advertising.
- Disconnecting in Settings deletes the access token right away. Deleting data in Metalytics does not change or delete anything stored on Meta.
04How we use information#
- to create and secure accounts and sign you in;
- to pull, store and show ad data, build reports, and keep your work notes;
- to send password-reset and service emails and answer support requests;
- to find errors, prevent abuse, and record important account changes; and
- to meet legal obligations.
We process information to provide the service you asked for, with your consent when you connect Facebook, to meet a legal obligation, or for our legitimate interest in keeping Metalytics secure. We do not sell personal information, do not use it for advertising, and do not run third-party analytics or tracking tags.
06International processing#
Our servers are in Singapore, so your data is stored outside Indonesia. We use providers with appropriate security and contractual safeguards for these transfers.
07Security#
- All traffic uses HTTPS. Passwords are hashed. Facebook tokens and the App Secret of your own Meta app are encrypted before storage and never sent to the browser. The App Secret is used only to call Meta for your account.
- Access rules in the database make sure each account can only read its own data. Admin access is limited.
- No system is perfectly secure. If a data breach affects you, we will tell you within 3 × 24 hours of finding out. If you think your account is exposed, email us right away.
08How long we keep data#
- Account, Facebook connection, ad data and work content: while your account is active. Deleting the account deletes all of it.
- Deleting a client deletes all ad data and notes for that client.
- Disconnecting Facebook deletes the access token immediately. Removing your own Meta app deletes its App Secret immediately.
- Activity log: 12 months, then deleted automatically.
- Feedback: kept, but unlinked from your account when the account is deleted.
- Technical logs: kept by our providers for a short period under their own policies.
- Database backups, if any, expire within 30 days.
09Your rights#
You can change your name, password and language in Settings, disconnect Facebook, and delete clients at any time.
Under UU PDP you also have the right to request a copy of your data, correct it, stop its processing, delete it, and withdraw consent. Email aditya@metalytics.app from your account's email address. We may ask you to confirm your identity first, and we reply within 3 × 24 hours. Deletion is explained step by step on the Data deletion page.
11Children#
Metalytics is a business tool for people aged 18 or older. We do not knowingly collect personal information from children.
12Changes and contact#
We may update this policy when the product, our providers or the law change; the "Last updated" date at the bottom will change. We announce important changes in the app or by email before they take effect. Questions and requests: aditya@metalytics.app.
Last updated 1 November 2026