Privacy Policy

Gineey Inc. ("Gineey", "we", "our", or "us") provides an Operating System for Performance Marketing Agencies. This Privacy Policy outlines how we collect, use, disclose, and safeguard information when performance marketing agencies, immigration consultants, and team members use our web platform, API services, and integrations.

We are committed to maintaining the highest standards of data security, institutional privacy, and complete transparency regarding the handling of Meta Graph API access tokens, lead form submissions, and white-label client reports.

To deliver multi-account ad spend tracking, lead management, and automated client reporting, we collect the following categories of information:

• Account & Contact Information: Name, work email address, agency organization name, phone number, and account credentials provided during workspace creation.
• Meta Ad Account Data: Campaign IDs, ad set structures, creative metadata, ad spend amounts, impressions, clicks, Cost Per Lead (CPL), and Return on Ad Spend (ROAS) aggregated via official Meta APIs.
• Lead Form Submissions: Contact entries captured via Meta Instant Forms, webhooks, or connected landing pages (e.g. lead name, email, phone number, custom form response fields).
• Technical Usage Data: IP address, browser type, device identifiers, session timestamps, and system logs recorded for security auditing and rate limiting.

Gineey integrates with Meta Platforms, Inc. via official Graph API OAuth 2.0 protocols. When you authorize your Meta ad accounts, we request only the necessary permissions required for performance tracking and lead synchronization:

• ads_management / ads_read — Read ad spend, campaign structures, and performance metrics.
• leads_retrieval — Ingest Meta Instant Lead Form submissions in real time.
• pages_manage_ads / pages_read_engagement — Associate ad accounts with official Facebook pages.

Gineey never stores your personal Facebook account password. Long-lived access tokens are encrypted using hardware-isolated AES-256 GCM encryption.

Lead form data captured through Meta Instant Forms is processed instantaneously via high-concurrency webhooks in sub-2 seconds. Gineey acts as a Data Processor on behalf of your agency.

We do not sell, rent, monetize, or share lead data with unauthorized third parties or data brokers. Lead records are stored solely to facilitate instant CRM routing (e.g. HubSpot, WhatsApp, Webhooks) and automated PDF reporting exports.

Gineey uses essential session cookies and local storage tokens to maintain authenticated state, store workspace preferences, and prevent Cross-Site Request Forgery (CSRF) attacks.

For detailed information on cookie categories and management options, please review our dedicated Cookie Policy.

We employ anonymized internal telemetry and security logs to monitor platform health, latency, API error rates, and infrastructure throughput. Telemetry data is stripped of personally identifiable information (PII).

Security is fundamental to Gineey. All data in transit is encrypted using TLS 1.3 encryption. All data at rest — including Meta OAuth tokens, client database records, and audit logs — is encrypted using hardware-secured AES-256 GCM keys.

Databases are backed up automatically on a daily schedule with point-in-time recovery and multi-region failover.

When enabled by your agency administrator, Gineey transmits lead payloads or report notifications to authorized third-party integrations such as Meta Ads, Google Ads, TikTok Ads, Shopify, HubSpot, Slack, BigQuery, and custom Webhook endpoints.

We recommend reviewing the individual privacy policies of third-party platforms linked to your workspace.

We retain agency workspace data, campaign logs, and lead records for the duration of your active subscription. Upon workspace termination or explicit deletion request, all access tokens, leads, and generated PDF reports are purged permanently from our active servers within 30 days.

For step-by-step instructions on requesting complete data deletion (including Meta user data deletion requirements), visit our Data Deletion Instructions page.

Depending on your jurisdiction (e.g. GDPR, CCPA), you have the right to access, rectify, export, or delete your personal and agency data. You can disconnect Meta ad accounts at any time via your Gineey Workspace Settings or directly within your Facebook Business Manager settings.

If you have questions, security inquiries, or data protection officer (DPO) requests regarding this Privacy Policy, please contact our privacy compliance team: