1. Scope and controller
This policy applies to the LULIAN AI web product and its Meta/Facebook authorization flow. We read or create ad objects only after a user authorizes access, selects specific assets, and confirms the action.
2. Data read through the Meta Marketing API
| Category | Specific data | Purpose | Retention |
|---|---|---|---|
| Ad accounts and ad objects | Ad account ID, name, currency and timezone; Campaign, Ad Set, Ad, and Creative IDs, names, statuses, and relationships. | Show selectable accounts, verify project asset bindings, build ad drafts, create PAUSED objects after confirmation, and display the result returned by Meta. | Bindings are retained while the connection is active and deleted within 30 calendar days after disconnection or a verified deletion request. Execution receipts are retained for up to 180 days for security audits. |
| Advertising performance data | Date, spend, impressions, clicks, reach, frequency, CTR, actions/conversions, and related Campaign, Ad Set, and Ad IDs. | Produce historical performance diagnostics, strategy suggestions, creative inputs, and confirmation screens. We do not sell this data or use it for unrelated advertising profiles. | Raw API responses are not retained as separate long-term files. Normalized performance snapshots are retained for up to 90 days, then deleted or aggregated and de-identified. A deletion request may end this period earlier. |
| Page and delivery assets | Facebook Page ID and name; the ID/name of an Instagram account connected to that Page; WhatsApp Business and phone number ID/display name. | Confirm the ad identity and Click-to-WhatsApp destination, and prevent creation under an unconfirmed Page or phone number. | Retained while the project connection is active and deleted within 30 calendar days after disconnection or a verified deletion request. |
3. Credentials and minimum permissions
OAuth access tokens are encrypted and stored only on the server. They are used solely for authorized reads, asset confirmation, and ad creation, and are never displayed in pages, logs, or receipts. Credentials are deleted within 30 calendar days after revocation, expiration, disconnection, or a verified deletion request.
We request only the Meta permissions needed for these service functions. Users may revoke app access in Meta account settings at any time; after revocation, LULIAN AI obtains no new Meta data.
4. Sharing and security
We do not sell Meta platform data. It is disclosed only to contracted hosting, database, and security operations providers as necessary to operate the service. We use tenant isolation, server-side credential encryption, access controls, and audit records.
5. Deletion, withdrawal, and deadlines
Follow our Data Deletion Instructions. We acknowledge a properly formatted email within 3 business days and delete Meta credentials, asset bindings, performance snapshots, generated content, and identifiable execution records within 30 calendar days after identity or administrator access is verified.
If law, a dispute, or a security investigation requires temporary retention, we identify the category, basis, and expected end date. The record is isolated, not used for product functions, and deleted or de-identified when the obligation ends.
6. Contact
Privacy and data deletion email: lulianxiandao@gmail.com. Do not send a Facebook password, access token, or other login secret by email.