Your Meta connection

TLDR: Companio Pty Ltd owns the Companio Meta app. Two Companio products connect through it: Companio (agent.companio.ai) and CarouselForge (app.carouselforge.ai).

This notice explains what each product does with Meta data. It forms part of our Privacy Policy. For either product, contact support@companio.ai. Read the deletion instructions.

Companio: ad analysis and approved changes

Permissions we request

Facebook Login for Business offers two connections. Read requests ads_read only. Ads Management requests exactly ads_management, ads_read, pages_read_engagement and pages_show_list. Your consent determines what is granted.

• ads_read: read ad accounts, campaigns, ad sets, ads, creatives, budgets, delivery, change history and performance to explain results and recommend moves.
• ads_management: create ads and make approved changes, or changes within standing limits an admin has deliberately enabled. Connecting alone does not enable autonomous changes.
• pages_show_list: identify the Pages available to use as an ad’s identity.
• pages_read_engagement: read Page post identity and ownership when creating ads from existing posts.

Meta data we read and store

• Encrypted connection tokens, your Meta user ID, granted permissions and selected ad account details.
• Performance totals, ad and creative content, budgets, delivery and change-history evidence, API usage, recommendations, independent checks, limits, approvals and execution history. Historical imports can include Meta results and related Hyros attribution totals.
• Page IDs and names, Page post ownership, linked Instagram account IDs and Instagram media ownership to create ads from existing Page or Instagram posts. Post/account identifiers and creative readbacks are saved in staged ad plans; Page names can enter AI conversation context when you choose a Page.
• Team-shared Desk facts and their source runs: ad IDs and names, campaign names, spend and decision evidence. The Desk’s letter and suggestions are saved too. A browser cache keeps Desk content in local storage on your device.
• Ad decisions, staged plans, write consents and approvals, generated-ad proposals and bindings, exported ad batches and campaign working notes. Meta-derived content can also be copied into chats, run records, files and published pages.

Who receives it

Supabase stores application data. Railway hosts Companio. Anthropic processes ad context and recommendation checks. Generating the Desk letter sends saved ad facts to its configured AI model: the current default is Google Gemini through OpenRouter, rather than always Anthropic.

Cloudflare hosts pages your team publishes when configured. Meta receives identifiers and credentials for connection checks, reads and governed ad writes. The enabled Goodness Lover Hyros feed sends connected ad account and ad IDs to Hyros for attribution matching.

When Companio checks an ad’s destination or fetches creative media, the destination website or media host receives the requested URL, not a copy of your performance report.

• If your chat uses a model routed through OpenRouter, Meta tool results can go to OpenRouter and the selected upstream model provider as conversation context.
• If you request an ad preview and Firecrawl is configured, Firecrawl receives the Meta placement-preview URL to render a screenshot.
• If hosted Hindsight memory is configured, your prompt can be sent as a recall query. Completed non-scheduled chats can be retained in your personal memory bank, including full transcripts and Meta-derived responses or summaries. Some run types exclude agent responses from retention.
• Knowledge files you share with memory are sent to Hindsight’s team-shared bank, which workspace members can use. Connected external AI apps can also write memory notes through Companio’s MCP memory tool into your bound personal bank.
• If you request image generation using Meta-derived copy or creative references, the prompt and reference images go to fal.ai and its selected image model.
• If Stefanbrain is configured and used for copy review or angle research, it receives the supplied ad copy, brief and related instructions, which can include connected-ad copy.
• If optional knowledge search is enabled, OpenAI receives the search query. If Cohere ranking is also configured, Cohere receives the query and matching saved passages. These can contain Meta information from your request or knowledge files.
• External AI apps you connect to Companio’s ad tools receive the requested ad results.
• You can approve changes in the Desk or, if linked, Telegram. Telegram carries proposed ad moves, checker text and a link confirmation containing the workspace name when available. We store user/chat links, hashed one-time codes, update IDs and approvals, including who approved and which channel they used.
• If Sentry is configured, it receives scrubbed error and performance diagnostics, including integration failures. Error reports use fixed labels and omit request bodies, prompts and ad tool outputs.

Other services used for tasks you request

When you ask Companio’s assistant to research, search, generate media, send or publish, its requests may reuse Meta-derived facts or wording. This is not limited to tools labelled “Meta”. Depending on the task and configured tools, recipients include:

• Anthropic for built-in web search and page fetch; OpenRouter and its selected search/model provider, including xAI for X/web search and Google Gemini for media transcription.
• Apify and its scraping-tool operators for Reddit, Amazon reviews, YouTube transcripts and public Meta Ad Library research.
• Firecrawl for research, page reads, previews and screenshots; Stefanbrain for copy review and angle research.
• fal.ai and its selected image model; OpenAI and Cohere for optional knowledge search and ranking.
• Cloudflare for published content; operators of external tools connected through MCP for your requested task.
• Shopify for product-search terms, which can reuse names or wording from ads. Companio’s built-in Shopify and email-report connectors read store or email data; they do not send ad copy as store edits or emails. Separately connected external tools may have other capabilities.
• Requested websites, stores, video sites and media hosts, including YouTube and Judge.me. They receive requested URLs and normal network details; domain lookups also use the hosting system’s DNS service.

What Companio writes to Meta

• Companio can create campaigns, ad sets, ads and their creative media, including ads based on existing Page or Instagram posts, and change ad delivery or budgets under the approval and admin-limit rules above.
• When a team configures its Meta Pixel ID for published pages, Companio installs the Meta Pixel on those pages. Visitors’ browsers contact Meta and send PageView events. This is separate from ad-account reads and stored reports.

How long data stays

• Scheduled cleanup keeps daily performance for 37 months, and inventory, budgets, activity evidence and API usage for 13 months.
• Superseded snapshots can be compacted after a 7-day audit period. Intraday budgets have a 9-day grace period; refresh requests have a 7-day cleanup period.
• Creative records, imported attribution totals and pull-history ledgers have no age-based expiry; the connection cleanup deletes these on disconnect.
• Connection metadata, settings, media-buyer runs and recommendations, checks, approvals, instructions, launch windows, executions, holds, cooldowns, decision/write records and generated-content bindings are not deleted by disconnect and have no complete automatic deletion schedule. They can include ad IDs, amounts, reasons and evidence. Expiring an approval stops its use, not retention of its record.
• Disconnect marks Desk source runs non-current, rather than immediately deleting their facts. Worker cleanup prunes non-current completed runs older than 30 days and their facts. Saved Desk letters and browser copies are separate; there is no complete connection-deletion schedule for them. Clear the site’s browser data to remove local copies.
• Telegram links and code/update records are not erased by Meta disconnect. Unlink Telegram separately in Connections; the active link is removed, but approval history and used/expired code records remain.
• Retained memories in Hindsight, including transcripts, notes and knowledge-file content, are outside Meta disconnect cleanup and have no automatic expiry under that cleanup. Ask support to include retained memory in a wider deletion request.

Disconnect or request deletion

As a workspace admin, open Console → Connections → Disconnect Meta. A successful disconnect of an existing connection clears live and staged credentials immediately and attempts to delete snapshots and creative/import datasets in the same request. If you see an error, retry; do not assume credentials were cleared.

Failed cleanup is queued for worker retries with no guaranteed maximum completion time. Connection, approval and other records listed above remain. Disconnect does not remove ads on Meta or content copied into chats, files or published pages.

Removing Companio in Facebook Business Integrations revokes access at Meta; it does not itself delete stored Companio data. Disconnect in Companio or email support@companio.ai from your account email, naming the workspace and Meta ad account. Say if your request includes retained memories, full transcripts or a wider account deletion. We verify requests and explain any data that remains. Full Companio deletion instructions.

CarouselForge: Instagram publishing and insights

Permissions we request

CarouselForge uses Facebook Login and requests exactly these six permissions:

• pages_show_list: list your Pages so you can choose the linked Instagram professional account.
• pages_read_engagement: read the Page details needed to identify that connection.
• instagram_basic: read the connected Instagram account and media details.
• instagram_content_publish: publish the carousels you approve, now or on a schedule.
• instagram_manage_comments: post your chosen first comment and check whether it was posted.
• instagram_manage_insights: read post performance to report results and help plan future content.

Meta data we read

• Granted permissions, Facebook Page IDs and names, and linked Instagram account IDs and usernames.
• Media IDs, captions, types, timestamps, permalinks, carousel child IDs, thumbnails, like counts and comment counts. Recent comments’ IDs, text and timestamps are read to check CarouselForge’s own first comment, not to provide an inbox or comment-moderation service.
• Publishing-container status and account publishing limits to track publication safely.
• Post insights such as reach, views, likes, comments, saves and shares. Insights can be fetched on request and by scheduled follow-up jobs when enabled and permitted.

What we store, where and how long

• Supabase holds the application database and private media storage. The application host processes this data and keeps operational logs.
• Long-lived Meta user tokens are stored encrypted, alongside expiry and granted permissions. They normally last about 60 days; connection access ends at expiry, revocation or account deletion. Expiry or revocation is not a promise that stored records have been erased: email us for deletion.
• Connection and account records include Instagram IDs/usernames and Page IDs/names. Publication records include approved carousel snapshots, images/videos, captions, first comments, schedule, status, media/comment IDs, permalinks and publication history.
• Publication records and insight events stay until the related project or account is deleted. Deleting a project does not delete the account’s connection token. The browser may also keep a flag that Instagram was previously connected; clear site data to remove it.
• Publication media has shorter cleanup rules: published asset copies become eligible after 30 days, canceled copies after 7 days, and abandoned uploads after 24 hours. Records can remain after those bytes are cleaned up; unfinished or uncertain publishing can delay cleanup.
• When long-term memory is enabled, Hindsight stores reported performance summaries, notes and completed conversation text in your personal and project banks, and an active brand-profile bank when present. These can include Instagram metrics and Meta-derived summaries. Memory has no automatic age-based expiry in this flow.
• Project deletion removes its memory bank and project-attributed entries in personal and brand banks; unrelated memories remain. Brand-profile deletion removes that profile’s bank. Account deletion also attempts to remove the personal bank. Failures or unavailable memory access can leave deletion incomplete or reported as residual data.
• If the restricted design workflow runs, the private design worker saves complete slide results in its own job database. These can include Meta-derived copy. The records are not linked to your project or account and survive normal project and account deletion; email support@companio.ai to request their removal.

Who receives it

• Supabase and the application host process the stored data above. Sentry receives scrubbed error diagnostics rather than raw insight reports.
• Anthropic receives Instagram insight metrics as prompt context for campaign-angle generation, alongside relevant project and brand context. Meta-derived material can also be included in assistant conversations and requested copy or image checks.
• When long-term memory is enabled, Hindsight receives memory lookup queries and the performance summaries, notes and conversation text described above.
• When the restricted creative workflow is enabled for its designated account, OpenRouter and its Z.AI model provider receive the campaign brief, including performance-based feedback, to write or revise carousel copy.
• That workflow also sends the source and campaign brief, approved copy, brand context and supplied images to the private design worker, which uses OpenAI through ChatGPT/Codex to design and review the slides. These inputs can contain Meta-derived material.
• For requested research or stock-photo searches, Firecrawl, Pexels, xAI and the X API receive the chosen queries, topics or URLs when their tools are configured. Those requests can reuse Instagram-derived facts or wording from the assistant’s context; this is not an automatic export of every insight report.
• For requested image generation or restyling, fal.ai and the selected image-model provider receive the image prompt and any reference images. Optional Google Gemini visual review receives rendered carousel images. These inputs can include Meta-derived text or creative material you reuse in the task.
• Meta receives connection credentials and identifiers, approved media through signed asset URLs, captions and first comments to carry out publishing and read insights.

What CarouselForge writes to Meta

CarouselForge creates and publishes Instagram carousel posts using your approved images or videos and caption, then posts your first comment if requested. Scheduled publishing can do this while you are away. It does not use this connection for ads, Threads, Page publishing, Instagram messaging, leads, catalogs or branded-content tools.

Disconnect or request deletion

There is no in-app disconnect today. Remove the Companio app in Facebook’s Business Integrations settings to revoke CarouselForge’s access. Because both products use that app, revocation can affect both connections. Revocation does not erase CarouselForge’s stored publication, insight or Hindsight memory records.

Email support@companio.ai from your account email, naming your CarouselForge account and Instagram account. Ask for connection-data deletion or a wider account deletion. For memory deletion, explicitly include performance summaries, notes and full conversation text in personal, project and brand-profile Hindsight banks. We verify the request, attempt the relevant deletion and explain any remaining records; we do not promise an automatic deletion deadline.

Deleting a project or account does not remove posts or first comments already on Instagram, downloads or copies already held by other providers. Unresolved publishing may need to be settled before deletion can finish. Full CarouselForge deletion instructions.

Government requests for data

This applies to both products. We only disclose customer data to a government or law-enforcement agency when the request is backed by valid legal process that binds Companio, such as a warrant, subpoena or court order.

• We review each request for legal validity and scope.
• We challenge requests that are unlawful or overbroad.
• We disclose only the minimum data the request requires.
• We notify the affected customer before disclosing, unless the law prohibits it or there is an emergency risk to life.
• We keep a record of every request and our response.

Questions: support@companio.ai.