Privacy Policy

1. Who we are

Moufak Agency ("we", "us", or "the Agency") is a digital marketing agency that manages advertising campaigns for its clients. The Moufak Ads Dashboard (the "Service") is a tool used by the Agency's team and its clients to view and manage campaign performance across advertising platforms (Meta, Google Ads, TikTok and Snapchat) in one place, at https://dashboard.moufak.agency.

This policy explains what data we collect, how we use and protect it, and how you can revoke access and request deletion. It applies to this website, the dashboard, and our apps registered with advertising platforms.

2. Data we collect

a. Data you provide

• Client name and business details, and the name and email of dashboard users to create their login.
• Store sales figures entered by the Agency's team to calculate metrics such as MER.
• Ad creatives (images and videos) uploaded by the Agency's team for use in campaigns.

b. Data we receive from advertising platforms with your consent

When you connect an account through the platform's official login (OAuth), we only receive what you approve on the permissions screen:

• Your platform user ID and name, to confirm the connection.
• The business accounts (such as your Meta Business Portfolio), ad accounts and Pages you choose to grant us access to.
• The structure, settings and status of campaigns, ad sets and ads.
• Performance metrics such as spend, impressions, reach, clicks, conversions and conversion value.
• Access and refresh tokens. We never ask for or store your platform passwords.

c. Technical data

We use only the cookies required to keep you signed in, and keep basic server logs (such as request times and errors) for security and troubleshooting. We do not use third-party advertising trackers or analytics tools.

3. How we use data

• Reporting and analysis: unified performance dashboards for the client and the Agency's team, metrics such as ROAS and MER, and cross-channel comparisons.
• Managing campaigns on the client's behalf: under the client's agreement with the Agency, authorized team members may create campaigns, ad sets and ads, change budgets and settings, pause or activate them, and upload creatives to the ad account's library. These actions are only taken by an authorized dashboard user, and only on the accounts the client has granted us access to.
• Operating the Service: security, troubleshooting and user support.

We do not use the data for any other purpose. We do not build user profiles, we do not use one client's data to target ads outside that client's own accounts, and we do not use your data to train AI models.

4. Meta Platform Data (Facebook and Instagram)

• We only request the permissions needed to provide the Service, such as reading and managing ad account data and reading the list of connected business accounts and Pages.
• We process data received from Meta in accordance with the Meta Platform Terms and Developer Policies.
• We do not sell, license or transfer Meta data to data brokers or ad networks, and we do not use it for surveillance or discriminatory decisions.
• You can remove our app at any time and request deletion of your data as described on our Data Deletion Instructions page.

5. Data sharing

We do not sell or rent any data about your accounts or campaigns. We share data only:

• With infrastructure providers acting on our behalf under data protection obligations: Supabase (database, storage and authentication) and Vercel (application hosting).
• With the advertising platforms themselves when carrying out an action on your account, such as uploading a creative or creating or editing a campaign.
• With authorities when required by law.

Within the Agency, a client's data is visible only to that client and to the team members authorized to manage their accounts.

6. Security

• Encryption in transit: all connections are encrypted over HTTPS (TLS).
• Encryption at rest: access tokens are encrypted with AES-256-GCM before storage.
• Access control: role-based permissions in the dashboard and Row Level Security policies in the database.

7. Data retention

• Campaign and performance data: kept while the account is connected and the client works with the Agency, and deleted on request.
• Access tokens: deleted when the account is disconnected or deletion is requested.
• Uploaded creatives: stored temporarily and deleted from our servers once successfully uploaded to the advertising platform.

8. Your rights, disconnecting and data deletion

You may access, correct or request deletion of your data and withdraw your consent at any time. You can disconnect any ad account from the platform's own permission settings, or by contacting us. When you request deletion, we delete the access tokens and data associated with your account from our servers within 48 hours. Step-by-step instructions are on our Data Deletion Instructions page.

9. Children

The Service is intended for businesses and marketing professionals. It is not directed to anyone under 18, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy when the Service or legal requirements change. The updated version will be posted on this page with its last-updated date, and clients will be notified of any material change.

11. Contact