Meta integration
MRAD Media operates two applications on the Meta Marketing API. This page explains, for partners and for Meta's own reviewers, what each application does, which permissions it uses and why, how a business authorizes it, what we store and how it is deleted.
Applies to apps owned by the MRAD Media business portfolio. Last reviewed 15 November 2026.
The two applications
MRAD Ads Console
Creates and manages campaigns, ad sets and ads on ad accounts that a business has explicitly authorized. Used by MRAD Media's own media team and by invited partner businesses. Every write is logged with who, what and when.
Use case in Meta terms: Create & manage ads with Marketing API.
MRAD Insights
Read-only reporting. Pulls spend, delivery and conversion metrics for authorized ad accounts and joins them with the business's own revenue data to produce campaign, keyword and hourly performance views.
Use case in Meta terms: Measure ad performance data with Marketing API.
They are separate apps because they have separate audiences and risk profiles: a partner who only wants reporting never grants write access.
Permissions, and why each one
| Permission | Used by | What it is used for |
|---|---|---|
| ads_management | Ads Console | Create, update, pause and archive campaigns, ad sets, ads and ad creatives on authorized ad accounts; read the same objects back to show current state before and after a change. |
| ads_read | Ads Console, Insights | Read Ads Insights (impressions, reach, clicks, spend, actions) for authorized ad accounts to populate reports and to verify that an automated change had the intended effect. |
| business_management | Ads Console, Insights | List the ad accounts and Pages a business has shared with MRAD Media so the user can choose which asset to connect; read business and asset metadata needed to label reports correctly. |
| pages_show_list, pages_read_engagement | Ads Console | Let the user pick the Page an ad is published from and show the Page name and picture in the composer. No posting to Pages. |
| public_profile, email | both | Identify the signed-in user inside the app and send account notifications. No marketing email. |
We do not request leads, catalog, Instagram or messaging permissions. If a feature ever needs one, it will be added here before it is requested.
How a business authorizes us
- Sign in with Facebook Login for Business
An admin of the partner business signs in from the app. Meta shows exactly which permissions are requested.
- Choose the assets to share
Meta's own dialog lets the admin select which ad accounts and Pages to grant. Anything not selected is invisible to us.
- We store a scoped token, encrypted
The resulting business integration token is encrypted at rest and bound to the selected assets. It is never shown to staff.
- Revoke any time
The business can remove the app in Business Settings, or email us; either way access stops and stored data is deleted as described below.
Alternatively a business can share assets with the MRAD Media business portfolio as a partner in Business Settings; the same least-privilege principle applies.
What we store, for how long
| Data | Purpose | Retention |
|---|---|---|
| User ID, name, email of the signed-in admin | Account identification, audit log, notifications | Until the account is deleted |
| Business, ad account and Page IDs and names | Asset selection, labelling of reports | Until authorization is revoked |
| Access tokens | Making API calls on the user's behalf | Until revoked or expired; encrypted at rest |
| Campaign structure and settings | Showing and editing campaigns; audit log | 24 months, then aggregated |
| Aggregated insights (no individual user data) | Reporting and optimization | 36 months |
We never receive or store data about people who see or click ads; the Marketing API returns aggregates only. We do not sell data, share it with other advertisers, or use one business's data to benefit another.
Deleting your data. Remove the app from your Business Settings, use the "Disconnect and delete" action inside the app, or email info@mradmedia.com. Full details and the status-check URL are on the data deletion page. Our apps also implement Meta's Data Deletion Request callback at https://app.mradmedia.com/meta/data-deletion.
For platform reviewers
Each app's App Review submission contains a screencast of the exact flow above on a test business, step-by-step reviewer instructions and test credentials. The apps are built and operated by MRAD Media, the owner of this domain and of the business portfolio that owns the apps. Our privacy policy and terms of service cover both applications. Questions: info@mradmedia.com.