Privacy Policy

Last updated: 15 October 2026

1. Introduction

SHTIK MEDIA LTD (company no. 515560829), Israel ("Shtik", "we", "us") is a digital advertising agency that manages Facebook and Instagram advertising for client businesses. This policy explains what data we receive from Meta Platforms, Inc. ("Meta") through our Meta app, how we use, store, share, protect and delete it, and what control our clients and other people have over it. It applies only to data processed through the app described in section 2. Visitors to our website are covered by our website privacy policy.

Our clients are businesses. This policy is written for them, for their customers who interact with their ads, and for our own employees who use the app.

2. The app and the tools that use it

The app is "Bulk upload - Shtik Media LTD" (Meta App ID 846720434372422). It belongs to Shtik's verified business (Meta Business ID 574353832666286). It is not a public product: only Shtik employees use it, inside two internal tools.

Shtik Pulse: a daily performance report on our clients' advertising. Pulse only reads data; it never creates, edits, pauses or deletes anything in an ad account. It runs automatically each working morning and sends the report to the Shtik team members who manage each client.
The campaign uploader: an employee uses it to create new ads in a client's ad account from creative files and ad text the client approved. It uploads the images and videos, creates the ad creative and the ad, and, when the employee approves it, a new ad set copied from an existing one in the same campaign. Every ad is created paused. An employee reviews it in Ads Manager before it runs, and the uploader never turns ads on.

3. How the app connects to Meta (the Meta API)

Official APIs only. The app reads and writes data only through Meta's official Graph API and Marketing API, using a current supported API version. It does not scrape Meta's websites or use unofficial methods.
Personal login for employees. An employee connects through Facebook Login for Business. Meta shows a consent screen listing the permissions and asks the employee which business assets (ad accounts, Pages, Instagram accounts) the app may use. The app gets a personal access token that works only for those assets and only within that employee's own roles. It expires after about 60 days, after which the employee must log in again.
Business token for automated reports. Shtik Pulse runs without a person, so it uses an access token issued to a system user of Shtik's business. Pulse uses it only to read advertising data.
Permissions we request, and why:
ads_management: upload images and videos and create ad creatives, ads and ad sets in client ad accounts.
ads_read: read campaigns, ad sets, ads and their performance, for the uploader and for Shtik Pulse.
business_management: see which client businesses shared which ad accounts, Pages and Instagram accounts with Shtik.
pages_show_list: list the client Pages an employee can run ads for.
pages_read_engagement: read a Page's name, picture and linked Instagram account.
pages_manage_ads: create ads that run as the client's Page, including click-to-WhatsApp and Messenger ads.
instagram_basic: read the client's Instagram professional account and username so ads appear under it.
pages_read_user_content: read comments on the client's ad posts.
We use each permission only for the purpose listed, and we follow Meta's Platform Terms and Developer Policies.

4. Ad accounts: what we can reach and what we do there

The client decides. The app reaches only ad accounts, Pages and Instagram accounts that the client shared with Shtik in Meta Business Manager, and only those the employee selected at login. It can't see a client's other assets or any assets of other businesses.
What the tools do: read the account's structure and performance (Shtik Pulse and the uploader); create ads, creatives and, on approval, ad sets (the uploader). New objects are always created paused.
What the tools never do: turn ads or campaigns on; change, add or read payment methods or billing details; change account spending limits; add or remove people or partners; change business settings; delete anything that existed before an upload run.
Budgets: a new ad set copied by the uploader keeps the budget of the ad set it was copied from, and that budget is shown to the employee for approval before anything is created. It spends nothing until a person turns it on.
Accountability: every change made with a personal token appears in Meta's activity log under the employee's name.

5. Data we receive from Meta

Advertising data for shared ad accounts: account name, ID, currency and time zone; campaigns, ad sets, ads and creatives with their names, settings, targeting, budgets, status and delivery or review issues.
Performance data: spend, impressions, reach, frequency, clicks, results, conversions and conversion values as Meta reports them, by day and at campaign, ad set and ad level. This is aggregated data; it doesn't identify the people who saw the ads.
Page and Instagram details of the client accounts used in ads: name, ID, profile picture, the linked Instagram professional account and its username.
Comments people leave on clients' ad posts: the comment text, time and the commenter's public name and ID as Meta shows them.
Employee data for those who log in: name, Meta user ID, their access token, the permissions they granted and their roles on client ad accounts.

We do not request or receive lead-form submissions, Messenger or Instagram direct messages, the personal profiles of people who see ads, or payment information.

6. Client data we send to Meta

To create ads, the uploader sends the client's own approved material to the client's own ad account: images, videos, ad text, headlines, links with tracking parameters, and ad and ad set settings. This material belongs to the client. We keep working copies only as described in section 9.

7. How we use the data

To create and manage ads on our clients' behalf, as agreed with each client.
To report advertising performance to the client and to the Shtik team that manages the account, and to recommend changes.
To spot problems early, for example ads Meta rejected, campaigns that stopped spending, tracking that stopped reporting, or customer questions in ad comments.
To check that each employee has the right access to each client, and to keep a record of what our tools created.

8. What we never do with Meta data

Sell, license or rent it, or give it to data brokers or ad networks.
Use it to target or retarget people outside the client's own ad account, or to build profiles of people who see or comment on ads.
Use one client's data for another client, or combine clients' data to benchmark them against each other by name.
Use it to make decisions about anyone's eligibility for housing, employment, credit, insurance, education or similar, or for surveillance.
Use it to train or fine-tune AI models.

9. Where data is stored and for how long

Shtik Pulse stores daily and monthly performance history on Shtik-managed computers, so results can be compared over time. Reports go by email to the Shtik team members who manage the client.
The uploader keeps a record of each run (the IDs of the ads, creatives and media it created, and the run report) with the client's working files. Creative files are uploaded directly from the employee's computer to Meta. Any copy placed in temporary storage during an upload is deleted when the run ends.
Comments are displayed in the tool and are not stored after the session.
Access tokens are kept in the encrypted credential store of the employee's computer, or of the computer that runs Shtik Pulse. They are deleted when the employee logs out, leaves Shtik or removes the app, and they expire automatically.
Retention: client data is kept as long as we manage that client's advertising. It is deleted within 90 days after the relationship ends or after the client removes our access, unless the client asks us in writing to keep its reports.

10. Sharing and service providers

Data is shared only with the client it belongs to and with the Shtik employees who work on that client. We use these service providers, which process data on our behalf, under contract, only for these tools:

Anthropic (United States): the AI assistant the campaign uploader runs in.
Google (United States): Google Workspace, used to send reports by email and keep working files.
Cloudflare (global): our secure login service and temporary file storage.

Some of these providers process data outside Israel, under their contractual data-protection commitments. We disclose data to anyone else only with the client's consent or when the law requires it. If we ever receive a legal request for Meta data, we check that it is lawful and disclose only the minimum required.

11. Security

Access is limited to Shtik employees who work on the client, each with their own login.
Our app secret is kept only on our secure login server, never on employees' computers. Access tokens are stored encrypted, never in plain files, emails, chat messages or code, and can be revoked at any time.
All traffic to Meta and to our login server is encrypted (HTTPS).
Ads are always created paused, every upload is shown to the employee for approval first, and a person reviews each ad before it runs.
When an employee leaves, we remove their access to the app and to client assets and revoke their token.
If a security incident affects Meta data, we act to contain it, notify Meta and affected clients as required, and report as the law requires.

12. Deletion of Meta data

When we delete:

On request. Anyone (a client, a person who commented on an ad, or an employee) can email info@shtik.co.il with the subject "Data Deletion Request". Tell us which business, Page, ad or Meta account it concerns. We may ask you to confirm your identity.
When a client removes our access in Meta Business Manager, or when the client relationship ends. The tools lose access immediately, and we delete that client's stored data within 90 days unless the client asks us in writing to keep its reports.
When an employee removes the app in Facebook Settings → Business Integrations, logs out or leaves Shtik. Their token stops working and we delete it.
When Meta asks us to, when the data is no longer needed for the purpose we received it for, or if we stop operating the app.

What we delete: stored performance history, upload records, working copies of creative files and the related access tokens, from our active systems within 30 days of a request. Copies in backups are overwritten in the normal backup cycle within 90 days. Comments are never stored (see section 9), so there is nothing of them to delete on our side.

Confirmation: we confirm by email when deletion is complete. If the law requires us to keep something, we tell you what and why.

What stays on Meta: ads, campaigns and other objects in a client's ad account belong to the client. Our deletion doesn't remove them; the client can delete them in Ads Manager. A comment you posted on Facebook or Instagram is controlled by Meta and can be deleted there.

Full instructions: https://shtik-global.com/pages/data-deletion

13. Your rights

Under the Israeli Privacy Protection Law, and where applicable other privacy laws, you may ask to see the data we hold about you, correct it, or have it deleted. Clients may also ask for a copy of their reports. Write to info@shtik.co.il and we will answer within 30 days.

14. Children

The app is a business tool used by Shtik employees and is not directed at children.

15. Changes to this policy

We may update this policy, for example when the app gets new permissions. Changes are posted on this page with a new date. A change that widens how we use Meta data is also reported to our clients.

16. Contact

For any question about this policy or to use your rights: info@shtik.co.il · SHTIK MEDIA LTD, Israel.

GET MORE RESULTS