Overview
Marketoo is a private workspace used by a marketing agency to plan, produce, approve and publish marketing content for its clients. It is not a consumer product and is not open to public sign-up — access is by invitation only.
This policy explains what information the platform holds, why it holds it, who it is shared with, and how it can be removed. It covers the Marketoo web application and the social media accounts a client chooses to connect to it.
Information we collect
Workspace accounts
For each agency team member: name, email address, role, and a hashed password. We record sign-in times to keep accounts secure. We never store passwords in readable form.
Client business information
Information the agency and its clients enter during onboarding and day-to-day work: company and brand details, products and services, target audiences, marketing goals, budgets, competitors, business contact details, and files that are uploaded such as logos and brand guidelines. This is business information about organisations, not personal profiles of individuals.
Connected social account data
When a client connects a Facebook Page or Instagram professional account, we receive and store the identifiers and names of those accounts, their profile pictures, and access tokens that allow the platform to publish on their behalf. See Meta Platform Data below for the full detail.
Technical information
Standard server logs (IP address, browser type, pages requested, timestamps) generated when the application is used, retained for security and troubleshooting. We do not use advertising cookies or third-party tracking pixels in this application.
How we use information
We use the information described above only to operate the service, specifically to:
- authenticate users and keep the workspace secure;
- produce marketing content, captions and creatives for the agency's clients;
- route content to the right client for review and approval;
- publish approved content to the Facebook Pages and Instagram accounts a client has explicitly connected, at the time the agency schedules;
- report on how published content performed;
- diagnose faults and prevent abuse.
We do not sell any information, rent or share it with data brokers, use it to build advertising profiles of individuals, or use one client's confidential business information to serve another client.
Meta Platform Data
This section describes data obtained through the Facebook Login for Business, Facebook Pages and Instagram APIs. It applies only after a client has connected an account, and only to the accounts they selected during that connection.
What we access
- Page and account identity — the id, name and profile picture of each connected Facebook Page and Instagram professional account, so the agency can see and choose where a post will be published.
- Access tokens — the credentials that permit publishing on behalf of the connected accounts.
- Published content records — the identifier and permalink of each post this platform publishes, so the agency can link back to the live post.
- Performance metrics — aggregate metrics for posts published through this platform, such as reach, impressions and engagement counts, used for client reporting.
What we do not access
We do not read private messages, we do not collect the personal profiles, friend lists or follower lists of the people who engage with a client's content, and we do not access Pages or Instagram accounts that were not selected when the connection was made.
Publishing is never automatic without approval
Content is published only from the connected accounts, only to the destinations the agency selects, and only after the content has moved through the approval workflow in this platform.
Disconnecting
A connection can be removed at any time from within the platform, or from Facebook directly under Settings & Privacy → Settings → Business Integrations. Once removed, the stored tokens stop working immediately and are deleted, and no further content can be published.
Security
The application is served only over HTTPS and is closed to anonymous visitors by default — every page and API route requires a signed session unless it is explicitly public, like this one. Passwords are stored only as salted hashes. Social media access tokens are encrypted before being written to the database, so a copy of the database alone does not yield usable credentials. Access to production systems is limited to the agency staff who need it.
No system is perfectly secure. If we become aware of a breach affecting your information, we will notify affected clients without undue delay.
Data retention
- Social access tokens — deleted as soon as a connection is removed or revoked.
- Client business information and content — retained for as long as the client relationship is active, and deleted within 90 days of a written request or of the relationship ending, except where we are required to keep records for legal or accounting purposes.
- Server logs — retained for a short operational period and then discarded.
Your choices and rights
You can at any time:
- ask what information we hold about you or your business;
- ask us to correct anything that is wrong;
- disconnect a Facebook Page or Instagram account;
- request deletion of your data — either by writing to us, or through the data deletion page.
Requests are answered within 30 days. Removing this application from your Facebook account automatically triggers a deletion request, which we process on receipt.
Children
This is a business tool and is not directed at children. We do not knowingly collect information from anyone under 18.
Changes to this policy
If this policy changes materially, the date below is updated and workspace administrators are notified. Continued use of the platform after a change means the updated policy applies.
Contact
Questions about this policy, or about information we hold, can be sent to:
«Registered company name»
«Registered address, City, State, PIN, India»
«privacy@yourdomain.com»