Privacy Policy
DCO Social Wizard — Last updated: 1 April 2026

1. Introduction This Privacy Policy explains how Additive Personalisation Ltd, a Havas company ("we", "us", or "our"), collects, uses, and protects information when you use DCO Social Wizard (the "App"). The App is an internal tool used by authorised agency personnel to distribute dynamic creative optimisation ads to Meta platforms (Facebook and Instagram) on behalf of clients.By using the App, you agree to the practices described in this policy.

2. Who We Are Additive Personalisation Ltd is part of the Havas Group. For any privacy-related queries, you may contact us at:Email: contact@theadditive.co.uk

Address: additive+ (HKX), 3 Pancras Square, London, N1C 4AG, United Kingdom

3. Data We Collect

3.1 User Account Data
When you log in to the App using your work credentials via Firebase Authentication, we collect:Your email addressAuthentication tokens used to verify your identity

3.2 Client and Campaign Data
As part of normal App operation, we process:Client names and associated Meta Ad Account IDsGoogle Sheet content submitted for ad distribution (including ad copy, image URLs, and targeting parameters)Meta ad creative and campaign data created through the AppDistribution logs recording which ads were created, when, and with what outcome

3.3 Usage Logs
The App maintains internal logs of distribution activity for troubleshooting and audit purposes. These logs include timestamps, job statuses, and error details.

4. How We Use Your Data We use the data collected solely for the following purposes:To authenticate authorised users and control access to the AppTo create and distribute ad creatives to Meta platforms on behalf of clients, using the ads_management and business_management Meta API permissionsTo read ad performance and status data from Meta ad accountsTo maintain an audit trail of distribution activity for operational and client reporting purposesTo troubleshoot technical issuesWe do not use your data for any other purpose, including advertising, profiling, or sale to third parties.

5. Legal Basis for Processing We process personal data on the following legal bases under the UK GDPR and applicable data protection law: Legitimate interests: Processing is necessary for the legitimate interests of operating an internal ad distribution tool and servicing clients

Contract: Processing is necessary to fulfil our obligations to clients

Consent: Where applicable, users have consented to their data being processed for authentication purposes

6. Meta API Data Usage The App connects to the Meta Marketing API. Through this connection, the App:

  • Creates ad creatives, ads, and associated assets within client Meta ad accounts using the ads_management permission

  • Reads ad status and preview link data using the ads_read permission

  • Accesses client Business Manager accounts and associated ad accounts using the business_management permission

  • Reads ad account information to confirm successful distribution

  • All Meta API data accessed by the App is used solely for the purpose of distributing ads as instructed by authorised App users. We do not store Meta user data beyond what is required for operational logs. We comply fully with Meta's Platform Terms and Developer Policies.

    7. Data Sharing We do not sell, rent, or share your personal data with third parties except:
    Meta Platforms Inc: Data is transmitted to Meta via their Marketing API to create and manage ads as directed by App users
    Google: Google Sheet data is read via the Google Sheets API to import ad content. We do not write personal data to Google Sheets
    Firebase (Google Cloud): Authentication and database services are provided by Firebase
    Railway: Our backend server is hosted on Railway's infrastructure
    AWS Amplify: Our frontend application is hosted on Amazon Web ServicesThese third parties act as data processors and are bound by their own privacy policies and data processing agreements.

    8. Data RetentionWe retain data for the following periods:Authentication logs: 90 daysDistribution logs: 12 months for operational audit purposesClient and campaign data: For the duration of the client relationship plus 12 monthsAfter these periods, data is deleted or anonymised.

    9. International Data TransfersThe App operates globally and may transfer data to servers located outside your country of residence, including to the United States (Meta, Google, Firebase, Railway, AWS). Where such transfers occur, we ensure appropriate safeguards are in place in accordance with applicable data protection law, including Standard Contractual Clauses where required.

    10. Your Rights Depending on your location, you may have the following rights regarding your personal data:
    Right of access: Request a copy of the personal data we hold about you
    Right to rectification: Request correction of inaccurate data
    Right to erasure: Request deletion of your data where there is no legitimate reason for us to continue processing it
    Right to restriction: Request that we restrict processing of your data
    Right to data portability: Request transfer of your data in a structured format
    Right to object: Object to processing based on legitimate interestsTo exercise any of these rights, please contact us at contact@theadditive.co.uk. We will respond within 30 days.

    11. Security We implement appropriate technical and organisational measures to protect your data, including:Firebase Authentication for secure user loginHTTPS encryption for all data in transitEnvironment-based secret management for API credentialsAccess controls limiting App access to authorised personnel only

    12. Cookies The App uses Firebase Authentication session cookies solely to maintain your logged-in session. We do not use tracking or advertising cookies.

    13. Changes to This Policy We may update this Privacy Policy from time to time. We will notify authorised users of material changes. Continued use of the App after changes constitutes acceptance of the updated policy.

    14. Contact UsIf you have any questions about this Privacy Policy or how we handle your data, please contact:Additive Personalisation Ltd (a Havas company)
    Email:     contact@theadditive.co.uk
    Address: additive+ (HKX) 3 Pancras Square, London, N1C 4AG, United Kingdom