Ad Verdict Desk and dashboard privacy policy

Key points

Who we are

The Ad Verdict Desk is a free tool run by FulFill It, a digital marketing agency based in Lahore, Pakistan. In this policy, “we” and “us” mean FulFill It. You can reach us at contact@fulfillit.pk or on WhatsApp. This policy covers the Ad Verdict Desk and our tracking and dashboard service. The one-hour and 120-day rules in sections 5 and 8 are for the free Ad Verdict Desk check; the dashboard rules are in “Our tracking and dashboard service”. Our main website has its own privacy policy that also applies to it.

What the tool does

The tool checks your website (speed, tracking, security, how well the page turns visitors into customers, and basic search visibility). It then helps you see which of your ads to keep, fix or stop, using the ad numbers you give us. At the end it can email you a report.

Information we collect

1. Your website address

When you type a website address we open its public pages, the same way a visitor or a search engine would, to run the checks. We only read public information. We use Google’s PageSpeed Insights service to measure speed, which means your website address is sent to Google for that test.

2. Your ad numbers

You can type your campaign numbers, upload a report file, paste numbers, or connect an ad account (see section 5). The numbers are money spent, impressions, clicks, video views, page visits, add-to-carts, checkouts, orders or leads, and the value of orders, together with campaign names and what you tell us about your business (for example your currency and how much profit you keep per sale).

3. Your contact details

We ask for these last, only when you want the report or a person to follow up: your name, business name, email address and phone number, and your choice of how to receive the report. We ask you to agree to this policy before we keep them.

4. Technical information

Our servers see your IP address and browser details when you use the tool. We use them to keep the tool safe (for example to limit repeated requests and to block abuse) and to fix problems. We also use a security check from Cloudflare (Turnstile) on the form where you leave your details. Your browser remembers your language choice on your own device.

5. Anonymous usage events

We count steps such as “started” or “verdict viewed” so we can see where people get stuck and improve the tool. These events do not include your contact details or your ad numbers.

Connecting an ad account (Meta, Google Ads, TikTok)

What we can see. We ask for read-only permission. We can see the names, ID and currency of the ad accounts you pick from, and the campaign names and results for the last 14 or 30 days (you choose): money spent, how many people saw the ads, clicks, video views, page visits, add-to-carts, checkouts, orders or leads, and the value of orders.

What we cannot do. We cannot create, edit, pause or delete ads, change budgets, spend your money, or see your payment details, your audiences, your customers’ personal details, or your personal Facebook, Google or TikTok profile.

How we use it. Only to work out your verdict and show it to you on screen and, if you ask for it, send it to you by email or WhatsApp. We do not sell this information, use it for advertising, or give it to other companies.

What we keep. The access key we receive from the platform is encrypted, kept for at most one hour, and deleted as soon as your numbers are loaded or you press Disconnect, whichever comes first. The campaign numbers are used in your browser; we keep only the short verdict summary (campaign names, the keep, fix or stop result and the main figures in it).

Remove our access yourself, at any time.

• Meta: in your Facebook settings, open Business Integrations (or Apps and Websites) and remove “Ad Verdict Desk”.
• Google: go to myaccount.google.com/permissions, choose our app and select Remove access.
• TikTok: in your TikTok for Business account, open the authorized apps settings and remove our app.

Google users. FulFill It's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Meta and TikTok. Data we receive from Meta and TikTok is handled under their platform terms and is used only for the purpose described in this policy.

Our tracking and dashboard service

This section covers our tracking and dashboard service: a small tracking script, a WordPress plugin and a Shopify app that send visit and order counts from your website to your FulFill It dashboard. “Customer” means the business that installs it. “Visitors” are the customer’s own website visitors. We handle visitor data for the customer, to give them the service.

1. What it collects

• Visits: the page address without anything after a question mark, how long the visitor stayed, how far they scrolled, where they came from (search, social, ad, direct, campaign tags), their device type, browser and approximate country, and how fast the page loaded.
• Actions: clicks on buttons and links we are told to count, steps such as add to cart or checkout, page errors, and form activity. For forms we record the field names only, never what was typed.
• Orders: order number, total, currency, status and where the order came from.
• Website checks and settings: scores, audits and the site settings the customer chooses.

What we do not store: visitor names, email addresses, phone numbers, postal addresses, IP addresses, the full browser identification text, form values, or whole web addresses with a query part. The server sees the IP address for a moment to block abuse and, in cookieless mode, to make an anonymous daily code. It is not saved with the visit.

2. Cookie modes and consent

• Standard: two small first-party cookies on the customer’s site (_fi_v and _fi_a) tell us a returning visitor from a new one.
• Cookieless: no cookie. A daily anonymous code is made from the visit and a secret that changes every day. Older secrets are deleted, so one day cannot be linked to the next.
• Consent: the tracker sends nothing until the visitor says yes on the customer’s consent banner.

The tracker stays silent for visitors who send the Global Privacy Control signal. If the customer has visitors in the EU or UK, we recommend cookieless or consent mode. The customer must show their own banner or notice where the law needs one (see the terms).

3. Who can see it

• The customer and the team members they invite, each with a role (owner, editor or viewer) that limits what they can do.
• FulFill It staff, as described next.
• Nobody else. We never show one customer’s data to another customer.

4. FulFill It staff access

By default, FulFill It staff may view a customer’s own tracking data (visits, events, orders, funnels, scores, audits and site settings). We do this to give support, run the service and improve it. We do not ask each time.

• Staff access is read-only. Staff cannot change the customer’s data or settings from this view.
• It is limited by staff role (owner, manager, member, viewer) and every view is logged.
• Staff can never see passwords, access tokens, site secrets or API keys.

5. The “who looked at my data” log

Every time staff look at a customer’s data, we write down who looked, what and when. The account owner can read this log in the dashboard at any time.

6. Ad-account and connector data needs your agreement

Data that comes from a Google, Meta (Facebook and Instagram) or TikTok ad-account connection, and from other connectors, is different. Before every connection we show a pop-up that says, in plain words: “FulFill It administrators can view this ad data to support you and improve the service.” When you press “I agree and connect”, that click is your agreement. We store the version of the text and the time. Without it, nothing connects.

• Only FulFill It administrators (the staff role with full access) can view this data, because of that agreement.
• Other staff roles (manager, member, viewer) can see it only through an explicit grant that you approve.
• You can take back your agreement at any time by pressing Disconnect or Delete data for that connection.
• Staff access to this data is read-only and appears in your “who looked” log.
• We use it only to show it to the customer and give the service they asked for.
• We never sell it, and never share it with other customers.
• We never use ad-platform data to train ad targeting, or to serve any other customer.
• The access key (token) is kept sealed while the connection is on. We cancel it with the platform and wipe it when the customer presses Disconnect or deletes the account.

Google API Services User Data Policy / Limited Use. FulFill It's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data from Meta and TikTok is handled under their platform terms and used only for the purpose described here.

7. How long we keep it

Backups: backups are kept for 14 days, so deleted data can remain in a backup for up to that long.

8. Deleting your data

The customer can delete everything (visits, orders, summaries, connections, team and account) from the dashboard, or by writing to contact@fulfillit.pk. We finish within 7 days and confirm by email. A site owner can also remove one visitor’s records from the dashboard. The customer can download their data first. See the data deletion page.

9. Service providers

• Cloud hosting: servers and database run on reputable cloud infrastructure. Where we store a particular kind of data is stated in the sub-processor list we keep current and send on request to contact@fulfillit.pk. The free Ad Verdict check runs on Cloudflare.
• Google: sign-in, and only for each Google connection the customer turns on (for example Analytics and Search Console).
• Meta and TikTok: only for each ad-account connection the customer turns on.
• Email provider: a business email provider sends sign-in, alert and report emails.

10. Where servers are

Our systems run on reputable cloud infrastructure, and the sub-processor list we keep current (sent on request to contact@fulfillit.pk) says where each kind of data is stored. Customers and visitors may be in other countries, so data crosses borders. We share only what is needed and use providers that protect it to a similar standard. If you are in the EU or UK and want to know the safeguards we use for a transfer, write to contact@fulfillit.pk.

11. Children

The service is for businesses. It is not meant for anyone under 16, and we do not knowingly collect information from children. A customer must not use the tracker on a site made for children without telling us first.

12. Contact

Questions, access or deletion requests: contact@fulfillit.pk or WhatsApp. Company: FulFill It, Super Town, Walton Road, Lahore Cantt, Pakistan.

How we use your information

• To run the checks and show you your website score and ad verdicts.
• To send you your report, and to follow up if you asked us to.
• To keep the tool secure and stop abuse.
• To understand where people get stuck and improve the tool, using anonymous usage events.
• To answer your questions and requests, including deletion requests.

We only send marketing emails if you asked for them, and every such email has an unsubscribe link.

Who we share it with

We do not sell your information. We use a small number of trusted service providers who process it for us and only to run the tool:

• Cloudflare: hosting, the secure connection, the security check and the database that holds your report and contact details.
• Google PageSpeed Insights: receives your website address to measure speed.
• Our email provider: sends your report and our replies.
• WhatsApp: only if you choose to message us or ask for the report there.

We may disclose information if the law requires it or to protect our rights.

How long we keep it

These times are for the free Ad Verdict Desk check. Times for the tracking and dashboard service are in that section above.

You can ask us to delete your information sooner. See the data deletion page.

Your choices and rights

• Ask what we hold about you, and ask us to correct it.
• Ask us to delete it. We do this within 7 days and confirm by email.
• Take back your consent at any time. This does not affect what we did before you did.
• Unsubscribe from any email using the link in it.
• Remove our access to your ad account yourself (section 5).

If you are in a place with privacy laws that give you further rights (for example the UK, the EU or California), you can use those rights too. Write to contact@fulfillit.pk.

Security

Connections to the tool are encrypted. Access keys are encrypted at rest and deleted quickly. Report links are long, random and expire. We limit repeated requests and block abuse. No system is perfectly secure, so please do not type anything into the tool that you would not want us to see, such as passwords or card numbers. We never ask for them.

Children

The tool is for business owners and marketers. It is not meant for anyone under 16, and we do not knowingly collect information from children.

Where information is processed

Our providers run services in several countries, so your information may be processed outside the country where you live. We use providers that protect it to a similar standard and we only share what is needed. Where each kind of dashboard data is stored is stated in the sub-processor list we keep current and send on request to contact@fulfillit.pk.

Changes and contact

If we change this policy in a way that matters, we will update the date at the top and, where we can, tell you. Questions or requests: contact@fulfillit.pk, or WhatsApp.