Third-Party Platform Apps - Privacy Policy and Terms

Version 1.0 — 10/19/2026

1. Who we are and what this document covers

This policy applies to the processing of data through the apps and connections Maestra publishes on third-party platforms (each, an "App"). The platforms currently covered are listed in Section 4. References to "Maestra," "we," and "us" mean the Maestra contracting entity identified in your Order Form: Maestra.io LLC (United States) or Maestra B.V. (European Union). Our Apps are published on the platforms by Maestra.io LLC, 1167 Massachusetts Ave, Arlington, MA 02476, United States.

The Apps are available only to businesses that have entered into a signed agreement with Maestra — a Software as a Service Agreement together with an Order Form (together, the "Agreement"): US SSA · EU SSA. This policy supplements the Agreement, the Maestra Privacy Policy and, for processing in the EU/EEA, the Maestra Personal Data Policy (EU). It contains only App-specific terms; all other matters are governed by those documents.

If anything in this policy is inconsistent with your signed Agreement, the Agreement prevails.

2. Terms of use

Your use of an App and of the Maestra platform is governed by your Agreement, including the Acceptable Use Policy incorporated into it. Connecting a platform does not create a separate contract or a separate data processing agreement; the processing of personal data through an App is governed by the Data Processing Agreement incorporated into your Agreement. In addition, for each platform:

The platform's terms require that you are authorized to grant access to each asset you connect; you connect only assets for which that is true.
You accept the platform's own terms that govern the features you use — for Meta, the Customer List Custom Audiences Terms for each ad account and the Lead Ads Terms for each Page (or the successor terms the platform publishes); an App cannot perform those functions until you have accepted them.
As allocated in your Agreement (Sections 3.2–3.4 of the US SSA; Exhibit D under either SSA), you are responsible for the lawful basis for, and any notices and consents required for, the data you send to audiences and your contacting of leads, and for honouring opt-outs.
The platform's terms prohibit using lead or audience data for sale or licensing, or for discriminatory targeting; you use the App accordingly.

3. Roles

For the personal data of your customers, leads and audience members processed through an App, you are the controller (or "business" under US state privacy laws) and Maestra is your processor (or "service provider"), as set out in the Data Processing Agreement and, under the US SSA, in its Section titled "Privacy and Data Protection Roles". Maestra processes this data only to provide the Services under your Agreement and on your documented instructions; connecting and configuring an App are such instructions (Clause 19 of the Data Processing Agreement). For the business contact details of the person who connects an account, Maestra is the controller, as described in the Privacy Policy and the Personal Data Policy (EU).

4. Platforms covered

4.1 Meta (Facebook and Instagram)

The Maestra app for Meta lets you (a) keep Custom Audiences in your own ad account up to date from customer segments in Maestra, and (b) receive leads from your Lead Ads forms into your Maestra project.

Data we receive from Meta: the name and app-scoped ID of the person who authorized the connection, and an access token for your business, stored encrypted; the names and IDs of the business portfolio, ad accounts and Facebook Pages you chose to share with Maestra; for the selected Page, its lead forms (name, status, questions); leads submitted through your Lead Ads forms — the answers the person entered (for example name, email address and phone number), consent checkbox responses, submission time, and the IDs and names of the form, ad and campaign; and the status, approximate size and terms-acceptance state of the Custom Audiences the App created or linked.

Data we send to Meta: at your direction, the identifiers of people in the segments you select — email address and phone number. Before sending, these are normalized and hashed with SHA-256 inside Maestra. Meta uses them only to match people to its users, under Meta's Customer List Custom Audiences Terms, which you accept for each ad account.

How we use this data: only to provide the App to you — to show your assets in Maestra, to create and update your audiences, to deliver your leads into your own Maestra project, and to show you sync status and errors. Maestra does not sell or share this personal data and does not use it for Maestra's own advertising. Data received from Meta is used as this Section describes; its use in the de-identified, aggregated form described in Section 5 occurs only to the extent the platform's terms permit.

Disconnecting: you can disconnect Meta at any time in Maestra (Integrations → Meta), and from Meta's side (Business Settings → Integrations → Connected apps → Maestra → Remove). On disconnection, syncs stop and the stored access tokens are deleted. Audiences the App created remain in your ad account until you delete them there (Meta Ads Manager → Audiences).

5. De-identified data and AI

Maestra creates irreversibly de-identified, aggregated data ("Resultant Data" and "Anonymized Data," as defined in your Agreement) from use of the Services, and uses it to operate and improve the Services — including training the machine-learning models that power product features such as recommendations and predictions for all Maestra customers.

What we commit to, because each commitment is verifiable:

Identifiable customer personal data is never used to train Maestra's AI or machine-learning models and is never sold (Agreement, Section titled "AI Features");
Models built by Maestra are used solely within the Services and are never licensed, sold, or made available as standalone products;
De-identified data is never used to identify, or to attempt to re-identify, any individual (Agreement, Section titled "Provider Materials and Resultant Data");
Outputs shared outside the Services (such as benchmarks and industry insights) are aggregate-only and do not identify any client or any customer.

Your Agreement (the Sections titled "Data Use as Condition of Service", "AI Features" and "Provider Materials and Resultant Data") records your consent to Maestra's creation and use of Resultant Data and Anonymized Data, including for AI and machine-learning model training. Because Resultant Data and Anonymized Data have no per-customer lineage after derivation, they cannot be attributed to, extracted for, or deleted on behalf of any individual client or person. The deletion rights described in Sections 9 and 10 therefore apply to identifiable data.

6. Sub-processors

The sub-processors engaged in delivering the Services, including hosting and infrastructure providers and their locations, are listed at maestra.io/legal/subprocessors; additions and replacements are notified to you, and may be objected to, as set out in the Data Processing Agreement. The platforms themselves are destinations you connect: they act on your instructions under your own agreements with them and are not Maestra sub-processors (see "Destinations you connect" on the Sub-processor List).

7. Data location and international transfers

The locations and hosting arrangements for production data are described in Section 8 of Exhibit C — Information Security and Data Processing Policy to the SSA. Where personal data is transferred across borders, Maestra relies on Standard Contractual Clauses or, where a sub-processor is covered by one, an adequacy decision, as set out in the Data Processing Agreement (Annex IV) and the Personal Data Policy (EU).

8. Security

Maestra's technical and organizational measures — including encryption of data in transit (TLS 1.2 or higher) and at rest, role-based access controls, centralized logging, and incident response — are set out in Exhibit C — Information Security and Data Processing Policy to the SSA. Maestra's information security program is audited annually against the SOC 2 Type II standard.

9. Retention and deletion

During your Agreement: data received through an App is retained in your Maestra project to provide the Services; leads become customer profiles there. You can configure retention periods for personal data in your account settings (Exhibit C, Section 7.2).
Hashed identifiers prepared for an audience upload are kept only as long as needed to complete the upload.
Access tokens are deleted on disconnection, as described in Section 4.
Agreement termination: you can export your data through the Services until the effective date of termination and request export within thirty (30) days after it; if you make no request, identifiable personal data is deleted within ninety (90) days after termination (Data Processing Agreement, Annex II §7; US SSA, Section 15.3(b); EU SSA, Section 14.3(b)).
Backups: backup copies of deleted data are purged on a rolling basis and are retained for no longer than three (3) months (Exhibit C, Section 7.3).
De-identified data: Resultant Data and Anonymized Data are retained as described in Section 5.

10. Privacy requests and data deletion instructions

If you filled in a lead form, or are a customer of a business that uses Maestra: that business decides how your data is used and is the controller. Please direct requests to access, correct or delete your data to that business — it can delete your profile in Maestra, and you will then also be removed from future audience updates. If you cannot reach the business, or do not know which business it is, email dpo@maestra.io with the subject "Data deletion request", the email address and/or phone number concerned, and the business's name if you know it. We will forward your request to the business concerned, where we can identify it from the information you provide, and assist it as its processor, as the Data Processing Agreement provides.

If you are a Maestra client: disconnect a platform as described in Section 4; delete lead profiles in Maestra or ask your Maestra account team; audiences an App created remain in your own ad account until you delete them there.

Privacy questions about the Apps may be sent to Maestra's data protection team at dpo@maestra.io (Maestra, 1167 Massachusetts Ave, Arlington, MA 02476).

11. Changes

We may update this policy from time to time; the current version date appears at the top of this page. A platform section may be added when Maestra publishes an App on that platform. For existing clients, material changes take effect through notification in accordance with the Agreement.