Who operates this service
Leiritech, based in Leiria, Portugal, operates TARS, a business operations and marketing application. This policy covers TARS and the Meta developer app named tars_ad_manager (app ID 1619311276393533), including its Facebook, Instagram and Marketing API integrations.
For privacy questions and requests, contact hello@leiritech.com. For Leiritech’s own business operations, Leiritech determines the purposes of processing. When we operate a workspace on behalf of another business, that business may be the controller and we process its information according to its instructions. This policy does not replace that business’s own privacy notice.
Information we process
Depending on the features enabled and permissions granted, we receive Meta account and asset identifiers, Page names, Instagram usernames, connected-business and ad-account information, permission information, and access tokens used to authenticate API requests. We do not ask you to provide your Facebook or Instagram password to TARS.
We process campaign, ad-set and ad configurations, targeting settings, budgets, delivery status, creative text, images, videos, post identifiers and URLs, and performance information such as impressions, reach, clicks, engagement and spend returned by Meta.
We also process information supplied by authorised users: project and brand details, campaign briefs, uploaded assets, prompts, generated content and support correspondence. Task records may retain the inputs, outputs, review results, errors and changes needed to explain an operation. Hosting and application services may record request information, IP addresses, timestamps and security logs.
How we use information
We use this information to connect authorised business assets; display and manage campaigns and content; prepare creative material; report performance; provide requested analysis; execute configured tasks and automations; troubleshoot failures; and protect the service. Actions affecting Meta assets are subject to the permissions and settings of the connected account.
For personal data subject to the GDPR, the applicable basis depends on the activity: performing a contract for services requested by an individual; legitimate interests in operating, securing and improving business tools; complying with legal obligations; or consent where an optional activity requires it. Where consent is the basis, it can be withdrawn without affecting prior lawful processing.
Service providers, AI and disclosures
TARS uses infrastructure and service providers to operate the application. These include Vercel for public website hosting and Cloudflare R2 for stored media. Meta receives requests and content submitted through the connected Facebook, Instagram and advertising features and handles information under its own policies.
When an authorised user enables an AI feature, the selected prompts and relevant project, brand, content or campaign context may be sent to the configured text or media-generation provider. Providers can include OpenAI, Anthropic and Genspark, depending on the selected integration. Task outputs and generated media may be retained for review and reuse.
We do not sell personal data. Access is limited to authorised users and people or providers who need information to operate, support or secure the service. We may disclose information when required by law or where necessary to establish, exercise or defend legal claims.
Storage, security and international processing
Application records are stored in the databases and storage used by TARS; media may also be stored in Cloudflare R2. We use authentication, access controls and HTTPS connections to help protect information. No system can guarantee absolute security.
Service providers may process information outside your country, including outside the European Economic Area. Where applicable data-protection law requires safeguards for an international transfer, the transfer must be covered by an appropriate lawful mechanism, such as an adequacy decision or contractual safeguards. Contact us for information about the providers and safeguards relevant to your workspace.
How long information is kept
We retain information for as long as needed to provide the configured service, maintain campaign and task history, investigate problems, secure the system and meet applicable legal obligations. Retention depends on the workspace, the type of record and whether the information remains necessary for those purposes.
Disconnecting Meta access stops future use of the revoked permission but does not automatically erase information previously stored in TARS. You can request deletion using the instructions linked below. Where deletion applies, we remove or anonymise the relevant records; restricted backup copies may remain until they are replaced or expire. Information that must be retained for a legal obligation or claim is limited to that purpose.
Your choices and privacy rights
You can ask for access to, correction of, or deletion of personal data about you; object to processing; request restriction or portability where applicable; and withdraw consent where processing relies on it. These rights are subject to applicable law and the rights of others.
Email hello@leiritech.com and identify the relevant TARS workspace, Page, Instagram account or request. We may ask for proportionate information to verify your identity or authority before disclosing or deleting records. Never email passwords, access tokens or app secrets. We respond within the time limits required by applicable law.
You may also complain to your local data-protection authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. You can revoke the integration’s access using Meta’s business or account settings, or ask the administrator who connected the assets to do so.
Public pages and policy changes
These public policy pages do not require a TARS account. The Leiritech website stores your language preference in browser storage and a locale cookie. Hosting services process the technical request information needed to deliver and protect the pages.
We may update this policy as the service or its data practices change. The date at the top identifies the current version. Material changes affecting connected users will be communicated through the service or another appropriate channel.