Privacy Policy

Effective 25 October 2026 · Last updated 1 November 2026

In short: TUMAM lets you manage your own Meta (Facebook and Instagram) ad accounts through Claude or ChatGPT. To do that we keep a small account for you: your name, email, a hash of your password, a short description of your business, your credit balance, the Facebook logins you connect (with their tokens encrypted) and the ad accounts you tick. Your ads, insights and Page data are fetched from Meta only when you ask, and are not stored. We never sell data, and you can delete your account at any time.

1. Who we are

TUMAM (The Unofficial Meta Ads MCP, the "Service") is operated by AfroTechBoss ("we", "us", "our"), based in the Federal Republic of Nigeria. We are the data controller for the personal data described in this policy. You can contact us about privacy at any time at chidileozoemena@gmail.com.

The Service is a remote Model Context Protocol (MCP) server. It connects AI assistants, namely Anthropic's Claude and OpenAI's ChatGPT, to the Meta Marketing API so that you can view and manage advertising accounts you own or are authorised to manage. Anyone can create an account.

2. Scope

This policy covers:

this website, including sign-up, log-in, onboarding, settings and billing pages;
the sign-in (OAuth) flow used to connect Claude or ChatGPT to the Service; and
data the Service receives from Meta Platforms, Inc. and its affiliates ("Meta") through the Meta Marketing API and Graph API ("Platform Data").

It does not cover Meta, Anthropic, OpenAI or our other providers themselves. Their own privacy policies apply to how they handle data (see section 7).

3. What data we process

3.1 Visitors to the website

The website does not use analytics, advertising pixels or tracking scripts, and fonts are served from this site. Like every web server, our hosting provider (Vercel) receives your IP address, browser user agent and the page requested in order to deliver the page and protect against abuse.

To stop people guessing passwords or abusing sign-up and codes, we count attempts from each IP address. We store only a one-way hash of the IP, never the IP itself, and delete these counts after a day.

3.2 Your account

Account details: your name and email address.
Password: stored only as a one-way bcrypt hash. We never store or log the password itself.
Session cookie: when you log in we set one cookie that keeps you signed in for up to 30 days. It is needed for the site to work and is not used for tracking. We store only a hash of it.
Your business: the business name and what you sell, and, if you give them, its location and WhatsApp number. Your AI reads these so it can write ads that fit your business.
Your settings: what you allow your AI to do (for example whether it may make changes, switch ads on or delete), your budget limits, and which optional tools are on.

3.3 Credits and payments

If you buy credits, payments are taken by our payment provider, Bachs. We do not see or store your card details. We keep your credit balance (free and bought), when your free credits next refill, and a record of each pack you buy (the pack, amount, currency and Bachs's payment reference), each refund, each time you redeem a code and the credits it gave, and any credits we add or take back by hand, with the reason (for example, to fix a mistake). Our earlier plan and payment records, if you have any, are kept with them.

Each time your AI uses a tool, we record the tool's name, whether it worked, how many credits it used and when, so your dashboard can show your usage and recent activity. We do not record what the AI asked for or what Meta returned. These records are deleted after 90 days.

3.4 Your Facebook login and Platform Data from Meta

When you connect Facebook, you log in on Facebook and approve the permissions ads_read, ads_management and pages_show_list. We may also ask for instagram_basic and pages_read_engagement so we can show which Instagram account is linked to your Page. We then store:

your Facebook user ID and name, so you can see which login is connected;
the access token Meta gives us, encrypted with AES-256-GCM, and when it expires; and
the ad accounts on that login (ID, name, currency and status), which ones you ticked, and any daily budget cap you set for each.

The Service only ever reaches the ad accounts you tick. When you ask Claude or ChatGPT a question or give an instruction, the Service may request the following from Meta for those accounts and your own Pages, and passes it to your AI without storing it:

ad account details such as name, ID, currency, time zone, status, spend cap and amount spent;
campaigns, ad sets and ads: names, IDs, status, objectives, budgets, schedules, bidding and targeting settings, and placements;
ad creatives: text, headlines, links, call-to-action, image hashes and preview links;
performance insights: aggregated and anonymous metrics such as impressions, reach, clicks, spend, conversions and breakdowns by age, gender, country, region, platform or placement;
delivery and review information, such as issues and ad review feedback;
custom audience metadata: name, type, approximate size range and status. The Service never reads, uploads or downloads the people in an audience;
targeting search results, such as interests, locations and demographic options from Meta's targeting catalogue;
your Facebook Pages and linked Instagram and WhatsApp business details: name, ID, category, username and the linked business phone number; and
images in the ad account's image library, and images you ask the Service to upload.

The Service does not request or process Facebook or Instagram users' profiles, friend lists, messages, contact details, lead form submissions or any other information about individual people. Insights from Meta are aggregated, and Meta applies its own privacy thresholds before returning them.

Your dashboard also reads your Page names and IDs and your linked Instagram usernames and IDs from Meta each time it opens, so you can see what is connected. We don't store these.

3.5 Connecting Claude or ChatGPT

When you connect your AI app, you log in to TUMAM and approve the connection. The Service then issues signed tokens to that app (access tokens valid for 1 hour, refresh tokens valid for 30 days) that identify your TUMAM account. They stop working if you deactivate your account.

3.6 Technical logs

To keep the Service secure and to keep a record of changes made to ad accounts, each tool call writes a log entry with: the time, the tool name, the inputs given, the IDs of the Meta objects involved, the result (success or error), how long it took, and, for changes, the values before and after. Access tokens, passwords, secrets and confirmation phrases are automatically removed before anything is logged. These logs go only to our hosting provider's runtime log system.

4. How we use data

We use the data described above only to:

provide your account, credits and settings;
answer your questions about your ad accounts, and carry out the changes you ask for (for example, creating a paused campaign or changing a budget);
take payments for credit packs, count the credits each call uses, and apply the codes you redeem;
keep the Service secure and enforce its safety limits, such as your budget caps and the rule that new ads start paused;
keep a record of changes made to ad accounts, and investigate errors and misuse;
reply when you contact us, and send messages about your account or the Service (we do not send marketing emails); and
comply with the law and with Meta's terms and policies.

We do not sell, rent, license or trade Platform Data or personal data. We do not use Platform Data to build or improve user profiles, for surveillance, for credit, housing, employment or insurance decisions, to target or retarget people outside Meta's own advertising tools, or to train machine-learning models. We do not combine it with data from data brokers. We do not use it in any way that discriminates against people or breaks the law.

5. Legal bases (where applicable)

Under the Nigeria Data Protection Act 2023 and, where it applies, the EU and UK General Data Protection Regulation, we rely on:

performance of a contract, for providing your account, credits and the Service you ask for;
legitimate interests, for security, abuse prevention, keeping change records; these are balanced against your rights and kept to a minimum; and
legal obligation, where we must keep or share data to comply with the law, for example tax records.

6. How long we keep data

Account, business, settings, Facebook logins and ticked ad accounts: kept while your account is open.
Platform Data: not stored. It is fetched from Meta when you make a request, returned to your AI, and discarded when the request ends.
A Facebook login you disconnect: its token and ad accounts are deleted straight away.
Sessions: expire after 30 days, and end when you log out or deactivate.
Tool call records: deleted after 90 days.
Hashed IP attempt counts: deleted after a day.
When you deactivate your account: it is switched off at once, and your AI loses access. If you log in again within 30 days, it is restored. After 30 days, the account and everything linked to it (business details, settings, Facebook logins and tokens, ad accounts, credit balance, purchases and code redemptions and tool call records) are deleted.
Technical logs: kept only for the retention period of our hosting provider's runtime logs, and deleted automatically after that. We do not export, copy or archive them.

If the Service stops using Meta's platform, or Meta or you ask us to, we will delete any Platform Data we still hold, including any in logs, within 30 days unless the law requires us to keep it. Our payment provider may keep its own payment records as the law requires.

7. Who we share data with

Data is shared only with the service providers needed to run the Service, and only for that purpose:

Meta Platforms, Inc.: the Service sends requests to the Meta Marketing API on your behalf. See Meta's Privacy Policy.
Anthropic, PBC: if you connect Claude, the results of each request are returned to Claude in your own Claude account, where Anthropic's terms and privacy policy apply. See Anthropic's Privacy Policy.
OpenAI: if you connect ChatGPT, the results of each request are returned to ChatGPT in your own ChatGPT account, where OpenAI's terms and privacy policy apply. See OpenAI's Privacy Policy.
Bachs: takes payments for credit packs and receives the details needed for that, such as your name, email and the pack you choose.
Neon: hosts the database that holds your account. See Neon's Privacy Policy.
Vercel Inc.: hosts the Service and keeps its runtime logs. See Vercel's Privacy Policy.

We may also disclose data if the law requires it, for example in response to a valid court order, or to protect the rights, safety or property of people, Meta or us. If the Service is ever transferred to another operator, this policy will continue to apply to data held at that time, and we will update this page before the transfer.

8. International transfers

Our providers may process data in the United States and other countries outside Nigeria. Where the Nigeria Data Protection Act 2023 or the GDPR applies, those transfers are made under the safeguards those providers offer, such as standard contractual clauses or an adequacy decision.

9. Security

All traffic uses HTTPS.
Passwords are stored only as bcrypt hashes, and session cookies only as hashes.
Facebook access tokens are encrypted with AES-256-GCM before they are stored.
Connecting an AI app uses OAuth 2.1 with PKCE, only Claude and ChatGPT can connect, and you approve each connection yourself.
Requests to Meta are signed with an app secret proof, and only the ad accounts you tick can be reached.
Secrets are kept in encrypted environment variables and are automatically removed from logs.
Your AI can only read until you let it make changes. New campaigns, ad sets and ads always start paused; switching ads on and deleting are off until you turn them on; and budgets are capped.

No system is perfectly secure. If we become aware of a breach that affects personal data or Platform Data, we will notify Meta as its Platform Terms require. Where the law requires it, we will also notify the Nigeria Data Protection Commission within 72 hours and tell the people affected without undue delay.

10. Your rights

Depending on where you live, including under the Nigeria Data Protection Act 2023 and the GDPR, you may have the right to:

access the personal data we hold about you;
correct it (you can change your business details and settings yourself in Settings);
have it deleted;
restrict or object to how we process it;
receive it in a portable format;
withdraw consent where we rely on it; and
not be subject to decisions based solely on automated processing that have legal effects on you. The Service makes no such decisions.

To use these rights, email chidileozoemena@gmail.com. We will reply within 30 days. You may also complain to the Nigeria Data Protection Commission or your local data protection authority.

11. Deleting your data

See our Data Deletion Instructions for how to deactivate your account, remove the Service's access to Meta, and ask us to delete any data we hold.

12. Children

The Service is a business tool for managing advertising. It is not directed at anyone under 18, and we do not knowingly collect data from children.

13. Changes to this policy

We may update this policy, for example when the Service or the law changes. We will post the new version here and change the "Last updated" date above. If a change is significant, we will make it clear on this page or email you before it takes effect.

14. Contact

AfroTechBoss
Email: chidileozoemena@gmail.com