Privacy Policy
1. Who we are
Tornado FX LTD (company no. 513976621), Hatsav 13, Re'ut, Israel ("Tornado FX", "we"). We provide AI business consulting and an AI-assisted platform that plans, runs and reports on advertising and marketing for businesses (the "Service"). Contact: privacy@tornadofx.co.il.
2. Our role
When a business connects its advertising accounts to the Service, that business decides what we do with its data and we process it on its behalf (we act as a processor / service provider). For our own website visitors and customer contacts, we are the controller.
3. Data we access
Only what a business explicitly grants when it connects, and only for the assets it selects:
| Source | Data | Why |
|---|---|---|
| Meta (Facebook, Instagram) Marketing API | Ad accounts, campaigns, ad sets, ads, creatives, budgets, performance insights, audiences you created | Report results, recommend changes, and (only when the business approves) create or edit ads |
| Facebook Pages / Instagram accounts | Page and account name, ID, posts and engagement metrics | Run Page ads and plan organic posts |
| Lead ads (lead forms) | Details people submit in the business's lead forms (e.g. name, phone, email, answers) | Deliver each lead to the business's own CRM, sheet or messaging tool |
| Meta datasets (pixel / Conversions API) | Event names, counts and quality diagnostics; conversion events the business sends through us | Measure results and improve ad delivery |
| Google Ads, TikTok and other ad platforms (if connected) | The equivalent account, campaign and performance data | The same purposes |
We do not request passwords. Access is granted through the platforms' own login and permission screens.
4. How we use it, and what we never do
- We use the data only to provide the Service to the business that connected it.
- We do not sell data, share it with advertisers or data brokers, or use one client's data for another client.
- We do not use platform data or lead data to train AI models.
- Every change to live campaigns is logged, and spending changes require the business's approval within the limits it sets.
- We comply with the Meta Platform Terms and Developer Policies, and the equivalent terms of every other platform.
5. Service providers
We use a small number of sub-processors under written agreements: Anthropic (AI model processing, with no training on our data), Vercel (servers and storage), and Google Workspace (email, and Google Sheets when a business chooses it as its lead destination). The current list is available on request.
6. Storage, security and retention
- Access tokens are encrypted at rest, stored separately per business, and never shown in reports or logs.
- Data is transferred over HTTPS and accessed with least-privilege permissions.
- Reports and campaign history are kept while the business uses the Service.
- Lead details are passed on to the business and kept by us for no more than 30 days.
- When a business disconnects or asks for deletion, we delete its tokens immediately and its remaining data within 30 days, except where the law requires us to keep it.
7. Revoking access and deleting data
A business can disconnect at any time. In Meta Business Settings, go to Integrations → Connected apps (or Business integrations in Facebook settings) and remove "super-campaigner". You can also email us. See Data deletion instructions.
8. Your rights
Under the Israeli Privacy Protection Law, 5741-1981 (including Amendment 13), and, where they apply, the GDPR and US state privacy laws (such as the CCPA), you may ask to access, correct or delete your personal data, or object to its processing. If you submitted a lead form to one of our clients, that client is your main contact, and we will help them answer you. Write to privacy@tornadofx.co.il; we reply within 30 days.
9. Changes
We will post updates on this page and change the date above. Material changes are emailed to connected businesses.