Privacy Policy

SalesGenius Inc. (“SalesGenius”, “we”, “us”, or “our”) is a Canadian advertising agency and software platform built for licensed real estate agents and brokerages (our “Clients”). We create, manage, and report on advertising campaigns across Meta platforms — Facebook, Instagram, Messenger, and the Audience Network — and we provide software, including AdGenius and our client portal, that lets Clients connect their own Meta accounts to create and manage that advertising.

For the purposes of Canadian privacy law (PIPEDA), we are a private-sector organization that collects, uses, and discloses personal information in the course of commercial activity. For the purposes of the EU General Data Protection Regulation (GDPR), we act as a data controller for information about our Clients and visitors to salesgenius.co, and as a data processor for personal information of end users that we handle on a Client’s behalf through their Meta ad accounts.

This Privacy Policy applies to:

• visitors to salesgenius.co;
• the real estate agents and brokerages who engage us as Clients;
• individuals whose personal information we process through Meta platforms while operating advertising on a Client’s behalf; and
• anyone who contacts us.

It does not cover Meta’s own data practices, the independent privacy practices of our Clients, or third-party websites we may link to. Those are governed by their own policies.

From website visitors: contact information you provide (name, email, phone), technical and log data (IP address, browser and device type, pages viewed), and information collected through cookies and similar technologies.

From Clients: business information, payment and billing details, marketing assets you provide, communications with us, and — with your authorization — the Meta credentials needed to operate your Meta Business Portfolio and ad accounts on your behalf. These are handled exclusively through Meta’s official OAuth flow and System User mechanisms; we do not ask for and do not store your Facebook password.

From the Meta Marketing API: the data described in Section 5.

With your express authorization, SalesGenius connects to your Meta Business Portfolio and ad accounts through Meta’s Marketing API, Graph API, and related developer interfaces (collectively, the “Meta Platform”). The connection is established through Meta’s official authorization flow, in which you actively grant SalesGenius a defined set of permissions. You may revoke this access at any time from your Facebook account’s Settings → Business Integrations page or from your Business Portfolio’s Connected Apps settings.

SalesGenius requests only the Meta permissions necessary to operate your advertising on your behalf. Depending on the services you have engaged us for, these may include:

• ads_management — to create, edit, pause, and delete campaigns, ad sets, and ads in your ad account
• ads_read — to read campaign performance, audience insights, and reporting data
• business_management — to manage assets in your Business Portfolio that are connected to advertising, such as ad accounts, pixels, and custom audiences
• pages_manage_ads and pages_read_engagement — to attach ads to your Facebook Page and read engagement metrics, since every Meta ad must be tied to a Page
• instagram_basic — to associate ads with your Instagram business account where applicable
• leads_retrieval — to retrieve leads generated by your lead-form ads so we can route them to your CRM
• public_profile — to retrieve your Facebook user ID and display name after you authenticate via Facebook Login, used to identify you within the platform and confirm the correct account is connected
• pages_show_list — to discover which Facebook Pages you manage, so you can select the Page to attribute your ads to
• pages_manage_metadata — to subscribe your connected Pages to leadgen webhook events for real-time lead delivery, and to assign system users to your Pages in the agency partner flow

Through these permissions, we may access and process:

• Public profile data: Facebook user ID and display name, used to identify the connected account within the platform
• Account metadata: ad account ID, name, currency, time zone, status, spending limit, billing information
• Campaign data: campaign, ad set, and ad names; targeting parameters; budgets; bidding settings; creative assets; placements; schedules
• Performance data: impressions, reach, clicks, click-through rate, cost-per-result, conversions, and other reporting metrics
• Page and Instagram data: Page ID, name, profile picture, follower count, engagement metrics on ads we manage
• Lead data from lead-form ads we run on your behalf — typically the name, email, phone number, and any custom fields you have configured in the lead form. This data belongs to you, our Client; we transmit it to your designated destination (CRM, email, webhook) and do not retain it for our own purposes
• Pixel and conversion data from the Meta Pixel installed on your website, used for measurement and audience optimization. We do not see the raw browsing behaviour of individual visitors to your site; we see aggregated and modeled conversion data from Meta

Our own website may use the Meta Pixel and Conversions API to measure the performance of advertising we run for our own marketing purposes. The Pixel sets cookies in your browser and transmits limited information — IP address, browser fingerprint, and pages viewed — to Meta. You can manage this through your browser’s cookie controls or your Facebook ad preferences.

What we do not do. We do not sell data obtained from Meta to any third party. We do not use data obtained through the Meta Marketing API to build models, train AI systems, or develop products outside the scope of the services we provide to the Client whose data it is. We use Meta-derived data exclusively to operate, measure, and optimize that Client’s advertising.

We use personal information to:

• provide, operate, and improve our services and platform;
• create, manage, measure, and optimize advertising campaigns on your behalf;
• route leads from your ad campaigns to your chosen destination;
• communicate with you about your account, campaigns, and support requests;
• process payments and maintain business and tax records; and
• comply with legal obligations and protect our rights.

We do not use personal information accessed through Meta APIs for any purpose unrelated to operating that Client’s advertising. We do not share Meta-derived data with our other Clients. We do not use a Client’s audience or lead data to target advertising for any other party.

In Canada, we collect, use, and disclose personal information in accordance with PIPEDA, relying on your consent and on the reasonable purposes of operating our business.

For individuals in the EEA or UK, we rely on one or more of the following GDPR bases: your consent; the necessity of processing to perform a contract; our legitimate interests in operating and improving our services; and compliance with legal obligations.

Service providers. We share information with vendors who help us operate — including Meta Platforms, Inc., payment processors, cloud hosting, and CRM and communication tools — under contracts that limit their use of the information to providing services to us.

With Clients. Where we act as a processor, we share information (such as leads) with the Client on whose behalf it was collected.

Legal and safety. We may disclose information where required by law, to comply with legal process, or to protect the rights, property, or safety of SalesGenius, our Clients, or others.

Business transfers. If SalesGenius is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction.

We do not sell your personal information. SalesGenius does not sell personal information for monetary consideration, and does not engage in the “sharing” of personal information for cross-context behavioural advertising as defined under U.S. state privacy laws such as the California Consumer Privacy Act, beyond the operation of the Meta Pixel on our own website (which you may disable as described above).

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

• encryption of data in transit using TLS 1.2 or higher;
• encryption of sensitive data at rest, including all stored Meta access tokens;
• strict access controls based on the principle of least privilege, with access logged and reviewed;
• multi-factor authentication on internal systems handling personal information;
• regular security review of our infrastructure, dependencies, and access patterns;
• confidentiality and data-protection obligations in contracts with employees, contractors, and service providers; and
• incident response procedures, including notification of affected individuals and regulators where required by law.

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or object to our processing of your personal information, to receive a portable copy, and to withdraw consent. You may also lodge a complaint with a regulator.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity. There is no fee for a reasonable request, but we may decline manifestly unfounded or excessive requests.

For data we hold as a processor on a Client’s behalf — for example, leads generated by a Client’s ad campaign — we will direct your request to the relevant Client, who is responsible for responding as the controller of that information.

If you would like SalesGenius to delete personal information we hold about you, including data we have accessed through the Meta Platform, you may submit a request in any of the following ways:

• email [email protected] with the subject line “Data Deletion Request”;
• visit our data deletion page for full instructions; or
• if you are a Client, disconnect SalesGenius from your Facebook account at Settings → Business Integrations on Facebook; we will automatically delete the associated tokens and cached Marketing API data within 30 days.

We will confirm receipt within 7 days and complete the deletion within 30 days, unless we are required to retain certain information by law (for example, billing records required for tax purposes). Where we cannot delete information, we will tell you why and how long we are required to retain it.

Your information may be processed in Canada, the United States, or other countries where we or our service providers operate. Where required, we rely on appropriate safeguards such as standard contractual clauses, adequacy decisions, and your consent.

Our services are not directed to children. We do not knowingly collect personal information from children under 16. If we learn that we have inadvertently done so, we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. For material changes, we will provide additional notice, such as an email to active Clients or a banner on salesgenius.co.

SalesGenius Inc. — Privacy Officer
Email: [email protected]
Phone: +1 (647) 643-7037
500-21 Camden St, Toronto, ON M5V 3N3, Canada

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the data protection authority in your jurisdiction.