Privacy Policy

Last updated: 27 September 2026

This Privacy Policy explains how SMITH MEDIA ADVERTISING LTD ("we", "us") collects, uses and protects personal data when you use SMFlow, the advertising tracking and analytics platform available at smflow.online (the "Service").

1. Who we are

SMITH MEDIA ADVERTISING LTD is a company registered in England and Wales (company number 12769151), registered office 41 Devonshire Street, Ground Floor, London, W1G 7AJ, United Kingdom. For any privacy question or request, email contact@smithmediaadvertising.com.

We are the controller of the personal data of people who hold an account on the Service. For tracking data collected from visitors to our customers' ads and landing pages, our customer (the advertiser) is the controller and we act as their processor, handling that data only on their instructions.

2. Data we collect

Account data

• Name, email address and a securely hashed password.
• Sign-in records: IP address, browser user agent and session times, used to keep accounts secure.
• Settings and configuration you enter (campaigns, offers, traffic channels, rules).

Data from Meta (Facebook) when you connect an ad account

If you choose to connect a Meta ad account, through Facebook Login or by supplying a Meta System User token, we request only the ads_read and business_management permissions and receive:

• The list of ad accounts you have access to: their IDs, names, currency, time zone and status.
• Campaign, ad set and ad names, IDs, statuses and objectives.
• Performance and cost metrics for those ads (spend, impressions, clicks and similar insights).
• An access token that lets the Service read this data on your behalf.

We do not request or receive your Facebook password, friends list, posts, messages or any other profile information.

Tracking data (processed on behalf of our customers)

When someone clicks a customer's ad or visits a customer's tracked landing page, the Service records: IP address, browser user agent, device, operating system, browser, language, approximate country derived from the IP address, referrer, the URL parameters of the visit (including ad click identifiers such as fbclid), the Meta browser identifiers _fbp/_fbc where present, and any conversion (for example a sale or lead) reported back by the customer's offer or affiliate network.

3. How we use data

• To provide the Service: attribute clicks and conversions to campaigns and show customers their own advertising performance, cost and return on ad spend.
• To sync cost and campaign structure from connected Meta ad accounts into the customer's own reports.
• Where a customer turns it on, to send conversion events for their own campaigns to Meta through the Meta Conversions API, using that customer's own pixel and credentials.
• To secure the Service, prevent abuse and fix errors.
• To communicate with account holders about the Service.

4. How we use Meta Platform Data

Data we receive from Meta is used only to show the connected customer their own advertising data inside the Service and to calculate their campaign results. We:

• do not sell, license or rent Meta Platform Data;
• do not share it with data brokers, advertising networks or any other third party, except the service providers listed in section 5 that host the Service for us;
• do not use it for advertising, profiling individuals, or building user profiles;
• do not combine it with data from other customers;
• process it in line with the Meta Platform Terms and Developer Policies.

5. Who we share data with

• Hosting and infrastructure providers that run our servers and databases, under contracts that require them to protect the data.
• Meta Platforms, only when a customer connects Meta or enables the Conversions API for their own campaigns.
• Authorities, if required by law or to protect our rights, users or the public.

We never sell personal data.

6. Legal bases (UK GDPR)

• Contract: to provide the Service to account holders.
• Legitimate interests: to secure and improve the Service and prevent fraud.
• Consent: when you choose to connect a Meta ad account. You can withdraw it at any time by disconnecting (see section 9).
• Legal obligation: where the law requires us to keep or disclose data.

For tracking data, the customer (advertiser) is responsible for having a lawful basis, including any cookie consent required on their own websites.

7. Retention

• Account data is kept while your account is active and deleted within 30 days of account closure, unless the law requires us to keep it longer.
• Meta access tokens are deleted immediately when you disconnect an ad account or close your account.
• Meta cost and campaign data, and tracking data, are kept for as long as the customer's account is active, or until the customer asks us to delete them.

8. Security

The Service is served only over HTTPS. Access tokens and API secrets are encrypted at rest, passwords are hashed, and access to production systems is restricted to authorised personnel.

9. Disconnecting Meta and deleting data

You can disconnect a Meta ad account at any time from the Traffic Channels page, which immediately deletes its access token. You can also remove the Service's access from Facebook under Settings → Business Integrations. To have all data we hold about you or your Meta ad accounts deleted, follow the steps on our Data Deletion page.

10. Cookies

• Session cookie: keeps account holders signed in. It is strictly necessary.
• Tracking cookie (smflow_click_id): set on tracked links so a later conversion can be attributed to the right click. Customers are responsible for obtaining any consent their visitors need.

11. International transfers

If personal data is transferred outside the UK, we use appropriate safeguards such as UK adequacy regulations or the UK International Data Transfer Addendum.

12. Your rights

Under UK data protection law you have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. Email contact@smithmediaadvertising.com and we will respond within one month. If your data was collected as a visitor to one of our customers' sites, we will pass your request to that customer. You can also complain to the UK Information Commissioner's Office at ico.org.uk.

13. Children

The Service is a business tool and is not intended for anyone under 18.

14. Changes

We may update this policy. The "Last updated" date above shows the latest version; material changes will be notified to account holders.