What we collect
- Account data: your name, email address and hashed password. Organisation name, slug and the role you hold inside it.
- Billing identifiers: if you subscribe, a Stripe customer id and the last four digits of the payment method. We never see full card numbers.
- Connected platform data: the access tokens you grant us (stored encrypted with AES-256-GCM), plus the pages, Instagram business accounts, Threads profiles and ad accounts you choose to track.
- Content and analytics: posts you publish, comments and mentions on your posts, and daily metrics (reach, impressions, followers, profile views, website clicks) for accounts you track.
- Generated content: the plans you create, the images, captions, video storyboards and emails our agents produce from them, and a record of which agent produced what.
- Publishing records: what you scheduled, when it went out, the post id Meta returned, and any error we hit while trying.
- Technical data: request logs, agent run history and audit records of writes performed through the API or MCP.
Why we collect it
- To manage the social and advertising accounts you connect — publishing, replying, and reporting on their performance.
- To ground AI-generated content in your own data instead of guesses.
- To keep your workspace, team and API keys safe and auditable.
What we never do
- We do not sell your data, and we do not share it with advertisers.
- We do not use your connected pages or ad accounts to train third-party models.
- We do not store your Meta password — we only keep the revocable access token you grant through OAuth.
Meta platform data
- Campaign Swarm is not affiliated with, endorsed by or sponsored by Meta. We are a third-party developer and are not responsible for any content or activities of other companies.
- We request only the permissions needed to read the data you see in the dashboard: pages_show_list, pages_read_engagement, instagram_basic, instagram_manage_insights, ads_read, ads_management and business_management.
- We never publish without your approval: a post is published only after you choose it in the dashboard, pick the account and the time, and it stays cancellable until it goes out. Every publish attempt is logged in your workspace.
- Publishing and comment permissions (pages_manage_posts, instagram_content_publish, threads_content_publish, pages_read_user_content, pages_manage_engagement, instagram_manage_comments) are requested only once those features are enabled for your workspace, and only after Meta approves them for our app.
- You can revoke our access at any time from your Facebook settings (Business Settings → Apps) or by disconnecting the account inside Campaign Swarm. Removing the app removes the token we hold.
- If you request data deletion from your Facebook account settings, our deletion callback purges the associated Meta data from our systems within 30 days.
How long we keep it
- Workspace data is kept until you delete it or close your workspace.
- Audit records of API and MCP activity are kept for 12 months for security purposes.
- Backups are encrypted and rotated within 30 days.
Your rights
- Access: everything we hold about your workspace is visible inside the product, and the MCP read tools expose the same data to your own agents.
- Export: ask us and we will export your workspace data as JSON within 30 days.
- Deletion: delete your workspace, or email us and we will remove it, including backups, within 30 days.
- Contact: support@campaignswarm.com — we answer within 30 days.
Data deletion
You can delete your Meta data from the app at any time, or use the automatic deletion callback Meta calls when you remove the app:
/api/meta/data-deletion
To remove everything, email support@campaignswarm.com or delete your workspace in settings.