Effective Date: March 1, 2026 • Compliant with Meta Platform Terms, EU GDPR (Art. 13 & 17), and India DPDP Act
Leads Connect, operated by Cloudbase Solutions ("Leads Connect", "we", "our", or "us"), provides a secure, tokenized client onboarding and Meta Marketing API partner delegation platform for digital marketing agencies, media buyers, and their clients.
We practice strict data minimization and zero-trust architecture. We never request, handle, or store client passwords, we never sell personal data, and we do not access private social communications.
When a client or agency authorizes their Meta account via official Meta OAuth Login, we access and process only the minimal necessary marketing metadata:
The following permissions are requested during Meta OAuth login. This list is dynamically generated from our application configuration to ensure 100% transparency:
| Permission (Scope) | Category | User-Facing Purpose & Rationale | Data Accessed | Revocation |
|---|---|---|---|---|
| business_management | Business | Required to identify client Business Portfolios and programmatically request agency partner access to manage assets without password sharing. | Business Portfolio IDs, names, verification status, and asset ownership metadata. | 1-Click Revoke |
| ads_management | Ads | Required to establish agency partner relationships on selected client Ad Accounts and assign campaign management permissions. | Ad Account IDs, account names, currencies, and partner permission assignments. | 1-Click Revoke |
| pages_show_list | Pages | Required to display available Facebook Pages to the user so they can select which page to delegate to the agency. | List of Pages managed by user (ID, name, category). | 1-Click Revoke |
| pages_read_engagement | Pages | Required to verify Page status, category, and health during asset verification checks. | Page profile details and verification status. | 1-Click Revoke |
| pages_manage_ads | Pages | Required so the agency can run advertising campaigns linked to the client's Facebook Page. | Page advertising permissions and partner delegation tokens. | 1-Click Revoke |
| public_profile | Identity | Required by Meta Login to confirm user identity during the OAuth flow. | App-scoped User ID and Name. | 1-Click Revoke |
All Meta OAuth access tokens and sensitive platform credentials are encrypted at rest using AES-256-GCM authenticated encryption with separate cryptographic keys. All communications are strictly enforced over TLS 1.3 encryption.
Our multi-tenant architecture physically isolates agency workspaces so no agency or client can view another tenant's data or advertising assets.
Users and clients have the unconditional right to disconnect their Meta account, revoke access permissions, and request total permanent erasure of all stored tokens and audit logs at any time.
To execute a real-time data deletion request, trigger an automated removal callback, or verify confirmation code status, visit our dedicated Data Deletion Instructions & Request Portal.
In compliance with the India Information Technology Act and DPDP Act 2023, as well as GDPR Article 13/14, you may direct privacy inquiries, grievance redressals, or data access requests to: