Privacy Policy

Scope

This Privacy Policy explains how we collect, use, share, and retain personal information when you use or interact with:

• Our Meta App that connects your Facebook/Instagram ad accounts and pages to the Command Center;
• Our websites, dashboards, and APIs; and
• Related services (student support, AJC coordination, ETPL compliance, QuickBooks syncing, and LMS integrations).

We publish this policy to meet Meta's requirement that apps provide a publicly accessible privacy policy describing what data is collected and how it is used. We also provide a User Data Deletion path as required during App Review.

1. What We Collect

A. Information you provide to us

• Contact and identity data (name, email, phone), program and cohort preferences, resume/profile details, application forms, and support messages.
• Student Journey data (e.g., AJC assignments, enrollments, progress, credentials, employment verification).

B. Information we receive from Meta (Facebook/Instagram)

• Lead Ads data you intentionally submit in lead forms (form fields such as name, email, phone, custom questions) and metadata (lead_id, form_id, page_id, ad_id/adset_id/campaign_id). We obtain this via Page Webhooks and Graph API per permissions you authorize.
• Ads performance & spend metrics from the Marketing API / Insights (e.g., spend, impressions, clicks, reach, actions) at account/campaign/adset/ad levels.

C. Information we send to Meta

• Server-to-server events via the Conversions API (e.g., Lead, CompleteRegistration, Purchase/Tuition, Placement) with required event parameters and hashed customer identifiers where applicable (SHA-256 applied to email/phone; never hash IP). We may also include event_id for deduplication with the Pixel.

D. Device, cookie, and analytics data

We may collect device/browser data, IP address, user-agent, timestamps, and online identifiers (including cookies such as fbp/fbc) for security, analytics, attribution, and audience measurement.

E. Financial and operational data (program operations)

Tuition invoices/payments (via QuickBooks), program progress and outcomes (via LMS), and AJC/WIOA documentation and metrics.

We do not knowingly collect data from children under 13 or target them with advertising.

2. How We Use Data

We use personal information to:

• Deliver, secure, and improve the Command Center and our services (including dashboards, ETL jobs, and webhooks).
• Process admissions, enrollment, instruction, credentialing, job placement, and compliance reporting (e.g., WIOA, ETPL).
• Ingest Lead Ads in real-time and match them to student records; attribute media performance; optimize campaigns; measure ROAS and outcomes through the funnel to placement.
• Send server-side events to Meta through Conversions API to improve attribution/optimization, using hashing and recommended parameters.
• Communicate with you (service updates, orientation, coaching) and provide support.

Legal bases (where applicable): consent (e.g., marketing form submissions), contract (program delivery), legitimate interests (security, measurement), legal obligations (WIOA/ETPL). GDPR/EEA/UK users have rights described below.

3. How We Share Data

We share data with:

• Processors that host, process, or support our services (e.g., cloud hosting, CRM, accounting, LMS, email/SMS providers). Our key integrations include GoHighLevel (CRM), QuickBooks (accounting), and Kajabi (LMS).
• Meta via Business Tools (Pixel/CAPI) and APIs under the Meta Business Tools Terms for advertising, matching, measurement, and analytics.
• AJCs and relevant government agencies to administer WIOA/ETPL programs, funding, and outcome reporting.

We do not sell personal information. For California residents, our use of Meta Business Tools may be considered "sharing" for cross-context behavioral advertising; you can opt out (see "Your privacy choices").

4. Your Privacy Choices and Rights

• Opt-out of cross-context ads: Use our "Do Not Sell or Share My Personal Information" link (site footer) or email privacy@mentoragile.com to limit use of cookies and identifiers for advertising. We honor Global Privacy Control (GPC) signals where technically feasible.
• Access, delete, correct, or port your data: Submit a request at /privacy-request or email privacy@mentoragile.com. California/CPRA and EU/UK/GDPR users have rights to access, deletion/erasure, correction, portability, and to object or restrict certain processing.
• Lead Ads data deletion: If you submitted a Facebook/Instagram Lead Ad form and want us to delete your data, submit a request at /privacy-request or follow the Data Deletion instructions at /legal/data-deletion. We also implement Meta's Data Deletion Callback for Graph-initiated requests.

5. Data Retention

We retain data as long as necessary for the purposes above and to comply with law and audits. For WIOA/ETPL compliance we maintain certain records for 7 years. Marketing analytics and event logs are typically retained for shorter operational windows unless required for security, audits, or disputes.

6. Security

We use administrative, technical, and physical safeguards appropriate to our services and data sensitivity, including TLS in transit, encryption at rest for key stores, role-based access control, logging/monitoring, and webhook signature verification (X-Hub-Signature-256/HMAC-SHA256).

7. International Transfers

If you are in the EEA/UK, your data may be processed in the United States. Where required, we use appropriate safeguards (e.g., SCCs) consistent with EU/UK guidance.

8. Lead Ads & Meta Business Tools Disclosures

• We use Lead Ads and must have a privacy policy link in each lead form; your submissions go to us, not to Meta.
• We use Meta Business Tools (e.g., Pixel/CAPI). Meta may receive Business Tool Data to provide advertising, matching, measurement, and analytics services to us. See Meta's Business Tools Terms for details.
• For Conversions API, we follow Meta's guidance to hash customer identifiers server-side and to include required/optional event parameters.

9. Contact Us

10. Changes to This Policy

We will update this page when practices change. Material changes will be announced in-app or by email prior to the new effective date.

11. How to Request Deletion (Meta Requirement)

• Self-service: Visit /privacy-request and select Delete my data.
• Email: Send a request to privacy@mentoragile.com with the subject "Data Deletion Request" and the email/phone you used.
• Meta-initiated: Our app exposes a Data Deletion Callback URL in the Meta App Dashboard to process Graph deletion requests automatically. See /legal/data-deletion for details.