Privacy Policy

1. Introduction

At Metriquo we value your privacy and are committed to protecting your personal data and that of your clients. This Policy describes how we collect, use, store, and protect information when you use our advertising reporting SaaS platform and its data sources with Meta Ads (Facebook and Instagram) and Google Ads.

2. Information We Collect and Permissions Requested

We collect only the information necessary to generate advertising performance reports. When connecting your account with Meta (Facebook and Instagram), we request the following permissions:

• Basic profile (public_profile, email): Name, profile picture and email address to create your identity within the platform.
• Ad accounts (ads_read): Read-only access to Facebook and Instagram campaign metrics: spend, impressions, clicks, reach, and conversions. Ads are never created or modified.
• Business manager (business_management): List of ad accounts associated with the user's Business Manager so they can select which ones to generate reports from.
• Page listing (pages_show_list): Allows displaying the list of Facebook Pages the user manages, so they can select which page to link to their client's report. Only the name, identifier, and profile picture of the page are read. No access to posts, comments, or messages.
• Page metrics (pages_read_engagement): Access to follower statistics of selected Facebook and Instagram Pages. Used exclusively to display the Total Followers separately from New Followers (Ads). This information is shown in the page growth widget within the dashboard. No posts, photos, videos, comments, or private messages are read. Data is strictly statistical and aggregated.
• Page content (pages_read_user_content): Read-only access to public content of associated Facebook Pages. Required to complement the display of organic metrics and interactions related to page content in performance dashboards. We never publish or modify content.
• Instagram metrics (instagram_manage_insights): Read-only access to advanced statistics (insights) of Instagram Business accounts. Used to obtain reach, impressions, engagement, and demographic data to display them in an aggregated form in automated reports.
• Instagram profile (instagram_basic): Reading of public profile information of the connected Instagram Business account (such as username, bio, and follower count). Used only to identify the account on the platform and visually personalize the report.
• Marketing API Access Tier (Marketing API Access Tier): Technical level required by Meta to access standard rate limits and manage multiple ad accounts without operational restrictions. It does not imply access to any additional user data.
• Access tokens: We store your tokens securely using AES-256-GCM encryption. No external system can access them in plain text.

3. Use of Information

We use the collected information exclusively to:

• Generate interactive dashboards and automated monthly reports for your clients.
• Display the followers and Facebook Page growth widget in the dashboard.
• Send notifications and reports via WhatsApp.
• Manage and improve the technical operation and security of the platform.

We do not sell, rent, or shareyour personal data or your clients' advertising data with third parties under any circumstances.

4. Infrastructure Providers and Sub-Processors

To operate the platform, Metriquo uses the following infrastructure providers:

• Vercel — Web application hosting and deployment.
• Neon — Managed PostgreSQL database.
• Google OAuth / Meta OAuth — User authentication and authorization for connecting advertising accounts.

None of these providers have access to the user's advertising data in plain text. Authentication tokens are stored encrypted with AES-256-GCM and are only decrypted by Metriquo' internal services during report generation.

5. Data Security

Meta Ads and Google Ads authentication tokens are stored encrypted in our database with AES-256-GCM, ensuring that only authorized internal services can process them during report generation. All communication between the user's browser and our servers is conducted via HTTPS with TLS encryption.

6. Legal Basis for Processing (GDPR)

The processing of personal data is based on the following legal grounds in accordance with the General Data Protection Regulation (GDPR):

• Explicit consent (Art. 6.1.a): The user grants consent by connecting their Google Ads and/or Meta Ads accounts through the OAuth authorization flows.
• Performance of a contract (Art. 6.1.b): Processing is necessary to provide the report generation service contracted by the user.
• Legitimate interest (Art. 6.1.f): Improving the security, performance, and functionality of the platform.

7. Data Retention and Deletion

We retain your data only while you maintain an active account on Metriquo. You may revoke the connection to Google Ads or Meta Ads at any time from the Settings panel.

To request complete deletion of your data, you may use any of the following options:

• Delete your account from the Settings panel within Metriquo.
• Send an email to soporte@metriquo.com with the subject "Data Deletion Request".
• Use the Data Deletion page.

Upon deleting your account, all personal data, encrypted tokens, project configurations, and associated report data will be permanently deleted immediately.

8. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. We will notify users of significant changes by publishing the new version on this page and updating the effective date.

9. Contact

If you have questions or concerns about this Privacy Policy, please contact us at: soporte@metriquo.com.