Last updated 17 October 2026

Privacy policy

This notice describes AdCtrl's current verification website, local Google connection prototype and private Meta review workspace. Public customer features are not available. Before introducing additional processing, including an AI assistant or public customer onboarding, we will update this notice and provide the relevant disclosures and authorization choices.

Who is responsible

AdCtrl is operated by mondaybrew ApS, CVR 45217779, Vesterbrogade 74, 4., 1620 København V, Denmark. Contact kc@mondaybrew.dk about privacy, access or deletion.

Information used by the connection prototype

When an approved tester authorizes Google access, the prototype receives their verified Google email address, granted permissions, and OAuth access and refresh tokens. The current connection does not request basic profile access or store the Google profile name. It lists accessible Google Ads customer identifiers, Analytics account and property summaries, Tag Manager accounts, and Search Console properties. Merchant Center is paused and its permission is excluded from the current Google connection.

The current Google connection requests ten scopes: Google identity and email, Google Ads access, Analytics read and edit access, Tag Manager read, container editing, version creation and publishing, and Search Console read-only access. Google Ads provides no separate read-only scope for this connection, but the prototype currently uses it only for account discovery. After separate authorization and explicit confirmation, the local prototype can change and restore the display name of a fixed Analytics property. It can also edit a tag name, create a container version and publish the verified version in a separate Tag Manager test container. The tested tag is paused, contains only an HTML comment and has no firing triggers; its container is not installed on a website. Write controls default to disabled and require an approved fixed target. The prototype does not implement Google Ads campaign or budget changes, product changes, conversion uploads or arbitrary production-tag editing. Public URLs supplied for a PageSpeed audit are sent to Google's PageSpeed service.

Meta connection testing

An authorized tester connects selected business assets through Facebook Login for Business. AdCtrl receives a business integration access token, the authorizing business and system-user identifiers, granted permissions and token-expiry information. It can read selected ad-account names, identifiers, currency and time zone; campaign metadata; aggregate advertising performance; pixel identifiers; and assigned Page identifiers, names, category and Page like count. Page access tokens needed for approved form operations are derived and identity-checked server-side. They are never shown in the browser.

The current review workflow can create a paused campaign, paused ad set, uploaded ad image, native lead form, form-linked creative and paused ad. It can edit the names, review ad creative, ad-set budget and targeting, then archive the created advertising objects and form. It checks only resources created by that review connection. Creating a form stores its name, full-name/email question definitions and privacy notice at Meta. Advertising stays paused; this review workspace has no active-delivery operation. The optional lead check creates and reads a synthetic test lead on that connection's new form, using AdCtrl Review Test and adctrl-review@example.com. It does not fetch existing customer leads. Synthetic test leads can still reach configured webhooks, CRMs or polling integrations and trigger their automations. The preview requires an explicit delivery acknowledgment and checks visible Page app subscriptions; known lead subscriptions, missing/incomplete results or changed subscriptions stop the test. The check does not prove all external integrations are absent, and AdCtrl does not change existing Page subscriptions as part of this preflight. These new workflows have passed local API-contract and security tests; live validation is still being prepared.

The Business Login configuration declares advertising, business/catalog, Page discovery/management/insights, Instagram content/insights/messages and Messenger permissions for the expanded review preparation. Only implemented actions are available in the app, and each checks its required granted permissions separately. Declaring permissions does not authorize access or establish provider approval. A limited synthetic Messenger review workflow is implemented and locally tested, with webhook and live messaging gates disabled pending configuration and a separate approved test. No existing conversation history is fetched. Broader messaging and WhatsApp onboarding remain incomplete. The Page and catalog operations described below are implemented but still await live validation. AdCtrl uses direct Meta APIs and has no dependency on Meta's hosted MCP service. The running app does not transmit Meta data to an AI model.

Purpose and authorization

We use this information to verify the selected Google identity or Meta business authorization, maintain the connection, show authorized account information to the tester, perform explicitly approved Meta review operations, Analytics property-name changes and Tag Manager test-container operations, and test authorized API connectivity. OAuth access is based on the account owner's affirmative authorization and can be revoked. We use necessary technical records to operate and secure the prototype. The public verification website is hosted by Vercel, which processes technical request information such as IP address, browser information and request time to deliver and secure the site.

Additional review actions create, rename and delete a new marked catalog in the selected business, manage one staged test product in that catalog, or publish, edit and delete a test Page post and comments created by this connection. Organic posts and comments become public at Meta after explicit confirmation. Catalog deletion is refused while it contains products. Page comment and insight reads are limited to the displayed checks; metric absence is not reported as zero activity. The resource identifiers, exact intended text and verification receipts use the same encrypted connection file. Removing the connection does not remove public posts, comments or catalogs; use their cleanup actions before disconnecting. The catalog product workflow uses a server-generated unique SKU with upsert disabled, staging visibility, out-of-stock availability and zero inventory. Its name, description and DKK price can be confirmed and edited; the public AdCtrl image and page URLs are fixed. It does not connect a shop, sales channel or ad. Only this connection’s created catalog/product can be selected, and catalog deletion requires verified product cleanup and a complete empty product list. Product/catalog identifiers, SKU, intended and observed fields and sanitized raw price diagnostics enter the same bounded encrypted registry/receipts. An unfamiliar price representation leaves the write unverified and cannot be blindly retried. Actual price encoding and provider-token compatibility still need live validation. These additional workflows are locally tested and awaiting live validation. Messaging and other social products remain incomplete.

When separately configured and approved, the synthetic Messenger test subscribes only AdCtrl to the selected Page’s message, echo and postback events. Webhook signatures are checked before processing. A ten-minute window accepts only the private test code and its matching confirmed reply; unrelated messages, identities, attachments and conversation history are not retained or displayed. The encrypted connection file holds the test Page ID, verified participant ID, private code, up to20 matching test events and the current reply receipt. A send acknowledgment alone is not proof of delivery: verification requires a signed Meta echo with AdCtrl’s app ID and the exact reply correlation. Unknown sends are not automatically retried. The Page subscription remains until the Stop action removes it and verifies absence. The app ignores further test events after the window expires; it does not claim the provider subscription expires automatically. Stop the test before disconnecting. Messages remain in Messenger under Meta’s controls.

The Instagram review workflow reads the professional account linked to the selected Facebook Page, its publishing quota and the status of a newly created media container. With separate authorization and confirmation, Meta fetches the displayed public JPEG URL, prepares a container and publishes its exact review caption as a public image post. The app verifies the Page/account link, quota, readiness, caption and published owner, and stores the created identifiers and intended caption in the encrypted review registry/receipts. Comment reads are limited to that connection’s new test post. Unknown publication results are reconciled without another publish request; unknown container creation is reported as unresolved. Separate confirmed controls can disable and restore comments on that new image, then permanently delete only that connection-created test post with the additional instagram_manage_contents permission. Deletion requires Meta’s acknowledgment and an independent complete media-list check before it is reported as removed. These operations are locally tested and still await live validation; Read-only account reach for the selected linked Instagram account and lifetime reach for this connection’s new test post are also implemented and locally tested. They display aggregate provider counts without storing a reporting database. Unavailable or delayed data remains unavailable, rather than becoming zero. The requested time window is not expanded through provider next-window URLs. These reads still require live authorization validation. A separate marked-comment review workflow reads an exact test code on this connection’s new image. A tester manually leaves that code from another account they control; media-owner comments remain visible even when flagged hidden, so the app refuses them as moderation targets. After explicit preview/confirmation, the app can hide/restore that marked top-level test comment, publish a marked public reply from the linked professional account, read its actual author/media/parent/text and delete only the reply and marked comment in that order. Provider acknowledgments and complete list readback are required for cleanup. The new image cannot be deleted while tracked test comments/replies remain. Only matching test-comment/reply text, username, timestamp, visibility and media/parent identifiers enter the encrypted registry/receipts; unrelated comment content from this restricted workflow is not retained or displayed. If content or access changes, manual cleanup at Instagram may be needed. The workflow is locally tested, not live validated; the provider token path remains unverified. A separate synthetic Instagram messaging test is locally implemented but not live validated. It uses Facebook Login, the selected Page's verified linked professional Instagram account and a server-only Page token. After Live app publication, approved access and webhook configuration, the tester can confirm a new AdCtrl Page subscription and open a ten-minute private-code window. Only the exact inbound code binds one controlled eligible participant; unrelated conversations, attachments and history are ignored and not retained or displayed. A separately confirmed marked text reply goes only to that participant. Its acknowledged message ID must match a signed Instagram outgoing echo to be verified; this is not proof the recipient read it. An uncertain unacknowledged send remains unresolved and cannot be blindly retried. The selected Page/Instagram IDs, username, private code, participant ID, up to20 matching test events and current reply receipt stay in the encrypted Meta connection file. Confirm Stop and verify removal of the new AdCtrl Page subscription before disconnecting; the window does not remove it automatically. Messages remain in Instagram. App publication, actual channel grants, subscriptions, exchanges and cleanup are still pending live validation.

Storage and retention

The Google prototype runs on the operator's computer. The Meta review workspace also runs in its own password-protected container on the operator's Hetzner server, using the temporary HTTPS address static.81.30.27.37.clients.your-server.de. Hetzner provides the server infrastructure. Google and Meta tokens use separate encrypted files and separate encryption keys. The hosted Meta workspace has its own key and persistent storage; it does not reuse the operator's local token store or existing agency integrations. Server access is restricted to the operator and authorized administrators. Discovery and inspection results are displayed in the browser; the prototype does not maintain a customer reporting database. Google property-name baselines and GTM edit/version/publication receipts are stored in the encrypted Google connection file for readback and safe recovery; an unresolved Analytics name change must be restored before disconnecting. Up to 20 recent name-change receipts, up to 100 review-operation receipts and a bounded registry of review-created resource identifiers are stored in the encrypted Meta connection file. Receipts describe the selected assets, intended changes, previous configuration where relevant and verified result status, allowing uncertain writes to be checked without blind retries. Uploaded image bytes and Page access tokens are not saved in those receipts. Returned lead field data is not retained in the connection file; synthetic fixture values used to create the test lead are documented in its operation receipt. The Remove local connection control deletes the active encrypted connection file and those receipts, on the computer or review server where that instance runs. It does not delete resources created at Meta: archive the test ads and form, delete test comments/posts, and remove the empty test catalog before disconnecting. Uploaded media and creatives may remain in the account library. This does not establish erasure of infrastructure backups. No application-level token backup has been configured; infrastructure backup retention must be established before customer use, and we do not promise immediate erasure of every backup. Provider revocation remains a separate control. Aggregate test records may describe which services succeeded, without storing tokens or account lists. Google test grants are revoked through its revocation endpoint. For Meta business integration tokens, the authorizing business removes AdCtrl in its Connected apps settings; we check token validity again, then remove the saved token. The local removal control alone does not revoke Meta authorization. Test connection tokens are removed when testing ends. If a provider revocation check fails, we report the incomplete revocation instead of treating local deletion as proof. Meta business integration tokens can remain valid without scheduled expiry until revoked.

The browser receives a necessary HttpOnly, SameSite cookie to bind a connection to its browser session. This cookie lasts up to seven days. The hosted workspace also uses a Secure, HttpOnly, SameSite=Lax reviewer-access cookie lasting up to eight hours after password sign-in. HTTPS is required. This verification website has no advertising or analytics tracking scripts. Hosting security records are subject to our Vercel hosting configuration and the provider's service and security retention requirements. See Hetzner's privacy information and Vercel's Data Processing Addendum for its processing and international-transfer safeguards.

Review evidence

With the operator's authorization, we record selected test-business authorization screens and the prototype's actual read, advertising/form test, restoration, archiving and disconnection workflows to prepare provider reviews. The recordings can contain business, ad-account, campaign and pixel identifiers or names, permission choices and the displayed test results. Raw operator recordings can also contain asset-selector options. Raw recordings and edited review copies are stored separately in restricted Google Workspace/Google Drive folders. Sanitized qualification records, such as test dates, identifiers, request counts and result status, are stored with implementation records in a private GitHub repository. Tokens, app secrets and passwords are excluded from those archives.

The operator edits the review recordings. OpenAI Codex assists with development and reviewing screenshots and sanitized implementation evidence. This is separate from the connection prototype, which has no automated AI marketing feature. Review evidence is retained separately for preparing and supporting provider verification; disconnecting an account does not delete that evidence. Contact us to request access or deletion. Raw recordings are not public review deliverables. Provider-review sharing has not yet occurred. Evidence retention and service-provider retention settings must be finalized before customer onboarding.

Sharing and AI processing

Google and Meta receive their respective OAuth and API requests needed to provide the selected services. The running connection prototype has no AI model integration and does not send connected account data to an LLM through a product feature. Separately authorized development and recording review is described above. We do not sell Google or Meta data or use prototype data to train generalized AI models. Additional AI product features or processing will be disclosed before being enabled and will require the appropriate authorization and provider-policy compliance.

AdCtrl's use and transfer of Google API information must comply with the Google API Services User Data Policy, including applicable Limited Use requirements. Information from Google is used for the user-facing connection and features the account owner has chosen to authorize.

Access, correction, revocation and deletion

You can revoke the Google connection through Google Account connections. The prototype's Disconnect & revoke control also requests revocation and removes its local token file after Google confirms success. For Meta, remove AdCtrl from the authorizing business portfolio’s Settings > Business settings > Integrations > Connected apps. The Meta Remove local connection control deletes the active encrypted token and operation receipts in that instance only; it does not revoke authorization at Meta. See data-deletion instructions or email us to request access, correction or deletion of any retained personal information. Subject to applicable law, you may also request restriction or portability, object to processing and complain to the Danish Data Protection Agency, Datatilsynet.

Changes

This prototype notice will be revised before public customer onboarding or new data flows begin. The date above identifies the current version.