Ads Forge is the create/publish studio in THE APP FORGE. It is operated in South Africa (ZAR) by THE APP FORGE.
This policy is for anyone who signs in to Ads Forge, connects an advertising or publishing account, or reviews the Ads Forge Meta app.
Which platforms we connect to
When you connect an organisation, Ads Forge may talk to these platforms — only with the accounts you connect for that organisation:
Meta — Facebook Page and Instagram (the professional Instagram account linked to a Page), including the Meta Marketing API for ads. The Meta app is Ads Forge (ID 2143117803247915), owned under THE APP FORGE (business ID 1094565723018185). It does not use MadComms (1395386116123133).
Google — Google Ads, and, separately, YouTube (uploading the videos you approve to your own YouTube channel, through YouTube API Services).
TikTok — posting the videos and photos you choose to your TikTok account (see TikTok below), and, separately, a TikTok advertising account if you add one for ads.
We do not use another organisation's tokens. A connection on one org cannot read or publish for another.
Credentials we store
When you complete OAuth on Connections, we store the platform's access token. Google and TikTok also issue refresh tokens; we store those so the connection can stay working. Meta issues long-lived access tokens rather than refresh tokens; we store that access token the same way.
Tokens are encrypted at rest (AES-GCM) in a server-side vault. Encryption keys are held only in the hosting environment — not in this repository and never sent to the browser. Tokens are never committed to git. Organisation machine keys are stored as one-way hashes only — we cannot read the raw key back.
What we do with the data
We use connected-account data only to run Ads Forge for that organisation:
read advertising account identifiers and last-30-day campaign performance (spend, leads, CPL) so Insights can report;
draft and generate ad copy and images from briefs you provide;
queue campaigns, ad sets, and ads as PAUSED;
read the Instagram account linked to the Facebook Page you choose (its username, name, profile picture and follower count, with Meta's instagram_basic permission), to show you which account it is on Connections and in Studio, and so ads can run on Instagram as that account. We read it when those screens open and do not store it;
for lead ads, read each lead from the business's chosen Facebook Page and store it in that business's Pipe Forge pipeline (see Meta lead ads below);
publish organic posts to the Facebook Page, Instagram, TikTok or YouTube destinations you pick.
We do not sell personal information. We do not use your tokens to advertise or publish for anyone else. Pulse remains the read-only historical reporting sibling — Ads Forge Insights is last-30-day, not a warehouse of all-time ads data.
Org billing uses PayFast hosted checkout in ZAR. Ads Forge never sees card numbers.
Google
Ads Forge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we access, and why
Google Ads (the https://www.googleapis.com/auth/adwords permission): the Google Ads accounts your Google login can reach (their names, ids, currency and time zone, and which are manager accounts), so you can choose the one this organisation uses; that account's campaigns, ad groups, ads, keywords and their performance (spend, clicks, impressions, conversions), so Insights and Results can report; and, only when you press publish on a draft, creating the campaign, ad groups, ads and keywords in that account, always PAUSED. We never switch an ad on or change a budget on our own.
That is the only Google Ads permission we ask for. YouTube is a separate Google sign-in with its own two permissions, described under YouTube below. We ask for each on Connections, for one organisation at a time, and use it only for the organisation you connected it to.
What we do not do
We do not sell Google user data, and we do not use it, or transfer it, to serve advertising, build advertising or interest profiles, or for any purpose other than the features above.
We do not use Google user data to train AI or machine-learning models, and we do not let people read it except with your permission, for security, to comply with the law, or where it has been aggregated and anonymised for running the service.
We do not share it with other organisations on Ads Forge or with third parties, other than the service providers that host Ads Forge for us.
Storage, and how to revoke access
Google's access and refresh tokens are encrypted at rest (AES-GCM). Campaign figures are kept with the organisation's studio records so reports can be shown.
Disconnect in Ads Forge: Connections → Google → Disconnect. That asks Google to revoke Ads Forge's access and deletes the stored Google tokens straight away.
To have the Google data we hold deleted, use /data-deletion or email info@theappforge.app; we delete it within 30 days. Campaigns already created in Google Ads stay there until you remove them.
YouTube
Ads Forge uses YouTube API Services to upload videos to your YouTube channel. By connecting YouTube you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's use of your information is described in the Google Privacy Policy (https://policies.google.com/privacy, also at http://www.google.com/policies/privacy).
What we access, and why. When you press Connect YouTube channel on Connections, Google asks you to allow two permissions: youtube.upload (https://www.googleapis.com/auth/youtube.upload), to upload the videos an owner or admin of your organisation approves and to set the cover image you chose as the video's thumbnail; and youtube.readonly (https://www.googleapis.com/auth/youtube.readonly), to read your channel's id, title and handle so you can see which channel you are posting to, and to check the processing status of each video we upload so we can tell you when it's live. We do not read your other videos, analytics, subscribers, comments or watch history, and we never change or delete videos already on your channel.
What we store. Google's access and refresh tokens, encrypted at rest (AES-GCM) in our server-side vault and never sent to your browser; your channel id, title and handle; and, for each YouTube post, the title, description, tags, privacy setting and cover image you approved, the link to your video file in Ads Forge's media storage, and the YouTube video id and link YouTube returns. We refresh or delete the channel and video details we hold at least every 30 days, and we delete them if Google stops letting us refresh your access.
When we upload. Only after an owner or admin of your organisation approves the post, at the time they picked, with the privacy (public, unlisted or private) shown on approval. An API key or automation can create a draft but can never approve or upload.
Sharing. We don't sell YouTube data, use it for advertising, or share it with other organisations on Ads Forge or with anyone other than the service providers that host Ads Forge for us (Cloudflare and Supabase). Ads Forge doesn't let third parties serve ads, and doesn't use advertising cookies. It uses only the cookies needed to keep you signed in.
How to revoke access. In Ads Forge: Connections → YouTube (organic) → Disconnect YouTube. That revokes Ads Forge's access at Google and deletes the stored tokens and channel details straight away. You can also revoke Ads Forge's access at any time on Google's security settings page, https://security.google.com/settings/security/permissions. When you do, we delete the YouTube data we hold about you within 7 days.
Deleting your data. Request deletion at /data-deletion or email info@theappforge.app. We delete the YouTube data we hold about you within 7 days. Deleting data from Ads Forge doesn't delete anything on YouTube. To remove a video from YouTube, delete it in YouTube or YouTube Studio.
Questions or complaints about how we handle your YouTube or Google data: info@theappforge.app, THE APP FORGE, 44 Will Scarlet Road, Robindale, Randburg, Gauteng, 2194, South Africa.
TikTok
This covers the TikTok account you connect on Connections to post from Ads Forge. You sign in on TikTok's own page (TikTok Login Kit) and TikTok asks you to allow three permissions: user.info.basic, video.publish and video.upload. We use them only to post the videos and photos you choose, when you press Post to TikTok.
What we read from TikTok
When you connect: your TikTok open_id (the id TikTok gives Ads Forge for your account), an access token, a refresh token, when they expire, and which permissions you allowed.
When you choose your TikTok account as a destination on Posts: your TikTok display name.
Each time you open Post to TikTok: your creator info (nickname, username, profile picture, the privacy levels TikTok offers you, the longest video you may post, and whether comments, Duet and Stitch are turned off). It is read live to show the form and is not stored, except your username, which is saved on the post so we can link to your profile.
After you post: the status TikTok reports (processing, published or failed) and the post id TikTok returns.
We do not read your videos, followers, likes, comments, messages or analytics from TikTok.
How we store it
The access and refresh tokens are encrypted at rest (AES-GCM) in our server-side token vault, next to your open_id. The key is held only in the hosting environment. Tokens are never sent to your browser or shown on screen.
When the access token expires, we use the refresh token to get a new one from TikTok, so the connection keeps working until you disconnect.
For each TikTok post we keep: the caption, the media link, the options you chose (privacy, interactions, commercial disclosure, the AI-generated label), the video's length, which member of your organisation pressed Post and when, and TikTok's publish id and post id.
Videos you attach are stored in Ads Forge's media storage, with their size, type and length, and TikTok fetches them from https://ads.theappforge.app/media/post/…. Like any link a platform pulls media from, that link is public to anyone who has it.
When we post
Only when you press Post to TikTok. TikTok posts cannot be scheduled, and no automation, bot or API key can post to TikTok.
You choose who can see each post from the options TikTok gives your account. There is no default.
How and when we delete it
Disconnect TikTok on Connections: we ask TikTok to revoke Ads Forge's access (TikTok's OAuth revoke endpoint), then immediately delete the stored access token, refresh token and open_id, and your TikTok destination and display name. If TikTok does not confirm the revoke, we still delete them and tell you, so you can finish it in the TikTok app.
If you remove Ads Forge in the TikTok app, TikTok refuses our stored token from then on. Press Disconnect in Ads Forge as well to delete our stored copy.
Post records and attached videos are kept while your organisation uses Ads Forge, so you can see what was posted. Posts already on TikTok stay on TikTok; delete them in the TikTok app.
To delete everything (TikTok tokens, post records and attached videos), request deletion at /data-deletion or contact the operator. We complete it within 30 days.
How to disconnect TikTok
In Ads Forge: Connections → TikTok (posting) → Disconnect TikTok.
In the TikTok app: Profile → Menu (☰) → Settings and privacy → Security (on some versions, Security and permissions) → Manage app permissions (or Apps and services permissions) → Ads Forge / App Forge → Remove access.
For full deletion, use /data-deletion.
Meta lead ads (Instant Forms)
A business can run Facebook and Instagram lead ads with Ads Forge: ads that open a Meta Instant Form. For this, the business owner connects Meta with Facebook Login and chooses one Facebook Page for ads. Ads Forge then uses three Meta permissions, only for that Page: leads_retrieval, pages_manage_ads and pages_manage_metadata.
What we read about a lead (leads_retrieval)
When someone submits an Instant Form on the chosen Page, Meta's leadgen webhook tells us only the lead's id.
We then read that one lead from Meta: the answers the person gave on the form — typically full name, email address and phone number, plus the answers to any custom questions the business added — the consent checkboxes they ticked, when they submitted it, the form's id, whether it came from an ad or organically, the platform (Facebook or Instagram), and the ids and names of the campaign, ad set and ad it came from.
We read leads only for the Page the business chose. A lead from any other Page is refused before anything is asked of Meta.
What we do on the Page (pages_manage_ads, pages_manage_metadata)
List the Page's Instant Forms, and create a new one when the owner fills in the form on Connections (its questions, the privacy policy link and the thank-you screen they choose).
Before a lead ad is created, check the chosen form belongs to the Page and is active. Every ad is created PAUSED.
Subscribe the Page to our app's leadgen webhook when the owner presses Subscribe, keeping anything our app was already subscribed to, and read whether that subscription is active and whether the Page has accepted Meta's Lead Ads Terms. We change no other Page setting.
A Page access token is created from the owner's connection for each of these requests and thrown away afterwards: it is never stored, logged or sent to the browser.
Where leads are stored
Each lead is written into the business's own sales pipeline in Pipe Forge (https://pipe.theappforge.app), the CRM module of THE APP FORGE, operated by the same company, THE APP FORGE. Ads Forge reads the lead and hands it to Pipe Forge; it does not keep its own copy of the answers.
Only people with access to that business's Pipe Forge workspace can see its leads. One business's leads are never shown to another.
Our service providers host the data: Cloudflare (both apps, and the connection between them) and Supabase (the databases).
We do not sell lead data, share it with other customers, or use it for advertising. Lead stages go back to Meta only if the business switches on Meta's Conversions API for CRM (off by default), and then only the lead id and its stage, no contact details.
Pipe Forge's optional assistant sends only what a team member types or pastes into it to xAI (Grok) for an answer. Lead records are never sent to it automatically.
How long we keep leads
A lead is kept while the business uses Pipe Forge: until the business deletes it or closes its account, and within 30 days of a deletion request.
If we cannot read a lead's details from Meta, we stop asking once Meta's 90-day limit on reading a lead has passed.
How to have a lead deleted
If you filled in a business's Instant Form: ask that business, or email wessel@theappforge.app with the business's name and the email or phone number you gave. We delete the lead from that business's pipeline within 30 days and confirm by email.
If you are the business: email wessel@theappforge.app from an owner's address to delete one lead, all Meta leads, or your whole workspace.
To stop new leads arriving, press Disconnect Meta on Connections, or remove Ads Forge in your Facebook settings.
Audience lists (Meta custom audiences)
A business can use Ads Forge to make Meta custom audiences on its own ad account: a list of its customers, visitors to its website (through its Meta pixel), people who opened or submitted its Instant Forms, and lookalikes of those. Meta uses an audience to show the business's ads to (or keep them from) those people.
Customer lists: what happens to the file
The business uploads a CSV of email addresses and/or phone numbers. Before uploading, an owner confirms that the people on it gave consent, or that the business has another lawful basis under POPIA (a contract, or a legitimate interest), and chooses which. We record who confirmed it, which basis, and when.
Our server normalises each value (an email is trimmed and lower-cased; a phone number becomes digits with its country code) and turns it into a SHA-256 hash in memory. Only the hashes are sent to Meta, which uses them to match people and then discards the ones it cannot match.
We do not store the file, the email addresses, the phone numbers or their hashes, and we do not log them. We keep only the audience's name, which ad account it is on, how many rows were received and sent, and the confirmation above.
The purpose is limited to showing that business's ads on Meta (or excluding people from them). We do not use a list for anything else, combine it with another business's data, or sell it.
Other audiences
Website, Instant Form and lookalike audiences are rules Meta applies to data it already holds; no personal information passes through us to make them.
Lookalikes are never used on ads in Meta's special ad categories (credit and other financial products, housing, employment).
Retention and deletion
Meta keeps an audience until the business deletes it in Meta Ads Manager (website and Instant Form audiences only count people from the retention window the business chose, at most 180 or 365 days). Meta's own terms for custom audiences apply.
To have us delete our record of an audience, or if you want to know whether a business used your details in a list it uploaded through us, email wessel@theappforge.app. The business that uploaded the list is responsible for the list itself; ask it to remove you, and to delete the audience in Meta Ads Manager.
How long we keep it
While the organisation stays connected, we keep encrypted tokens and studio records (drafts, generated creatives, queue items, publish records) so the studio can draft, queue, publish, and report.
If you disconnect a connection in Ads Forge, we wipe that connection's encrypted access and refresh tokens immediately.
If you ask us to delete your data, we delete stored access and refresh tokens, generated creatives tied to that user, and hashed organisation machine keys within 30 days. When Meta sends us your data deletion request (after you remove Ads Forge in Facebook settings and ask for your data to be deleted), we verify Meta's signature and straight away delete every Meta connection and token made with your Facebook login, in every organisation, and Pipe Forge erases the name, phone, email, answers and consent of the Meta leads read with it. Meta gives you a confirmation code and a link that shows what was done.
Campaigns, ads, and posts already created on Meta, Google, or TikTok stay on those platforms. Ads Forge will not re-enable them. Pause or delete them in those products if you want them gone.
How to revoke and delete
In Ads Forge, open Connections and disconnect the account. That removes the stored tokens for that connection.
On the platform, revoke Ads Forge / Ads Forge from Facebook settings, Google account permissions, or the TikTok app (Settings and privacy → Security → Manage app permissions).
Request full deletion at /data-deletion, or email the operator at THE APP FORGE from the Facebook user that authorised Ads Forge, or use Meta's "Remove app" flow.
Meta's automated callback is POST /api/meta/data-deletion (Meta's signed request, verified with our app secret). Its status is at /data-deletion?code=... and GET /api/meta/data-deletion?code=....
Contact
Contact THE APP FORGE in South Africa at wessel@theappforge.app for anything in this policy, including deletion requests.
Ads Forgecampaigns, forged