Privacy Policy

1. Who we are

The service is operated by Mainstream Media. Marketing agencies open a separate account for each of their business clients, and that client's sales team manages its leads inside it. This policy covers two groups of people: those who use the service, and those who submitted their details to a campaign and whose details entered it.

2. Information we collect

• User details — name, email address, role in the account, and authentication identifiers.
• Lead details — name, phone, email and any additional field the client defined for its campaign type, as the person provided them in the form.
• Platform connections — when a client connects an external account, we store the access token issued to us and the scopes granted.
• Operational data — sign-in timestamps, session cookies and basic request logs needed to run and secure the service.

3. Meta platform data (Facebook and Instagram)

With the client's permission, the client connects their own Facebook Page to the service. From that point we read:

• The contact details a person submitted in a lead form on that Page, in order to show them to that client's sales team.
• Performance data for that client's own Pages, published content and ad campaigns, for the report shown to the client and to the agency serving them.
• We do not access private messages, friend lists or personal photos.
• Data is retained only while the connection is active, and is deleted within 30 days of disconnection.

4. How the information reaches us

Leads arrive automatically from the intake address the client connects to a campaign or from the Page they connected, or are entered manually by a sales representative. We do not buy or import lists from any other source.

5. How we use it

Only to operate the service: showing leads to the team responsible for them, measuring response times, and returning conversion events to the advertising platform the lead came from. We do not use the data for our own ad targeting, for profile building, for resale, or to train models.

6. Who can see it

Isolation between clients is enforced in three layers in the code. One client cannot see another client's data — not even within the same agency; an agency sees only its own clients; and a sales representative sees only the campaign types assigned to them.

7. Sharing with third parties

We do not sell or rent personal information. Data reaches only:

• The infrastructure providers the service runs on — Supabase (authentication and database) and Vercel (hosting).
• The advertising platform the lead came from, when a conversion event is returned to it according to the client's configuration.
• Law enforcement or regulators, where required by valid legal process.

8. Retention and deletion

Account details and content are retained while the account is active. When an account is closed or a platform connection is removed:

• The access token is revoked and deleted immediately.
• Data stored from that platform is deleted within 30 days.
• Backups containing residual data are purged on the standard backup rotation, and no later than 90 days.

9. Security

Data is stored on Supabase servers in the European Union (Frankfurt), in a private schema that is not publicly exposed, with row-level security enabled. Traffic is encrypted and access is restricted by role. No system is perfectly secure, and we cannot guarantee absolute security.

10. Your rights

You may request a copy of the personal data we hold about you, request its correction or deletion, and disconnect any external platform connection. Contact the agency that manages the account, or us directly at the address in section 13.

11. Age

The service is not directed to people under 16, and we do not knowingly collect personal information about them.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent version, and material changes will be communicated to active users.

13. Contact

Questions about this policy — arad@msmedia.co.il.