Privacy policy.

Fly ROAS AI (“Fly ROAS”, “we”, “us”) is an AI media-buying service for Meta advertising on Facebook and Instagram, available at www.flyroas.com. The service is operated by Fly ROAS AI.

Under the EU and UK General Data Protection Regulation (GDPR) we are the controller of the personal data described in this policy. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary.

You can contact us about anything in this policy at support@flyroas.com.

Fly ROAS AI is an independent product and is not affiliated with, endorsed or sponsored by Meta Platforms, Inc.

This policy explains how we handle personal data when you visit our website, create an account, connect your Meta assets, use the Fly ROAS AI web app, or contact us. It also explains how we handle data we receive from Meta through its APIs (“Meta Platform Data”).

It doesn’t cover third-party services you reach through Fly ROAS AI — such as Facebook, Instagram or Meta Ads Manager — which are governed by their own privacy policies.

Fly ROAS AI is built for businesses. If you use it on behalf of a company, “you” means both you and the business you represent.

Information you give us

• Account details — your name, email address and password (stored only as a salted hash, never in plain text), plus preferences such as timezone and language. If you sign in with Google, Google shares your name, email address and profile picture with us, and we never receive your Google password.
• Brand information — the website link you give us and any edits you make to your Brand DNA, products, prices, offers and the claims you confirm your ads may make.
• Product images and brand assets — product photos, logos and any other files you upload.
• Instructions and settings — creative instructions, target cost per acquisition (CPA), monthly cap, daily limit, Autopilot mode and other settings.
• Messages to us — when you email us or use our contact form: your name, email address, company (optional), topic and message. The contact form also records your IP address to prevent spam and abuse.

Information we create or collect as you use the service

• Brand DNA — when you paste your website link, we visit the publicly available pages of that site and extract its colours, fonts, logo, tone of voice, product names, descriptions, prices and images.
• Generated creatives — the images, videos and ad copy generated for you, and the inputs and settings used to create them.
• Competitor research — publicly available ads from the Meta Ad Library for brands relevant to yours, and our analysis of their structure, hooks and layouts. This is information about other businesses’ public advertising.
• Ad performance metrics — from the ad accounts you connect: spend, impressions, reach, clicks, click-through rate, purchases, cost per acquisition, return on ad spend and similar figures. They power your dashboards, Autopilot verdicts and Flight Log.
• Flight Log — a plain-English record of every decision Autopilot makes and the numbers behind it.
• Usage, device and log data — IP address, browser and device type, pages and features used, timestamps and error logs, which we use to keep the service secure and working.

Information from Meta

When you connect Meta through Facebook Login for Business, Meta shares with us an access token, the identifiers of the business assets you choose to share — ad accounts, Facebook Pages, Instagram accounts and Pixels — and basic profile information such as your name and Meta user ID. Exactly what we can access, and why, is set out in Meta Platform Data.

Information from payment processors

Payments are handled by Razorpay (in India) and PayPal (internationally). We never receive or store your full card number, CVV, UPI PIN or bank login. The processor sends us what we need to run your subscription: transaction ID, amount, currency, status and date, limited details about the payment method (such as its type), and the billing name, country and any tax details you provide for invoices.

Cookies and analytics

Essential cookies keep you signed in, secure your session and remember your currency and cookie choice. They are always on because the service can’t work without them.

Optional analytics and advertising cookies are used only if you click “Accept” in our cookie banner. They help us understand how people use our website and measure our own ads:

• Google Analytics and Google Ads: pages visited, device and browser type, approximate location, and whether a visit led to a sign-up or purchase. Until you accept, Google receives only cookieless signals with no identifiers.
• Microsoft Clarity: how visitors scroll and click on our public pages, to find confusing parts of the site. Text you type is hidden, and everything inside your Fly ROAS AI account is hidden from recordings.
• Meta Pixel: whether a visit to our website led to a sign-up or purchase, so we can measure and improve Fly ROAS AI’s own ads on Facebook and Instagram.

We never use your connected ad accounts, Meta Platform Data or brand content for our own analytics or advertising, and we don’t sell browsing data. You can change your choice at any time with “Cookie settings” at the bottom of every page.

• To provide the service — extract your Brand DNA, research competitors, generate creatives, launch ads to your Meta ad account and run Autopilot within the rules you set.
• To run Autopilot — Autopilot makes automated decisions about your ad campaigns: for example, stopping a test that has spent twice your target CPA without a sale, or stepping up the budget of an ad with three or more sales under target. These decisions concern your campaigns, not you as a person. They always stay inside the caps and launch mode you choose, and each one is recorded in your Flight Log.
• For billing — process payments, manage plans and credits, and issue invoices.
• To communicate with you — sign-in and password emails, receipts, approval requests in “Ask me first” mode, alerts, important service changes and replies to your support requests.
• For safety and security — detect and prevent fraud, spam, abuse and security incidents, and enforce our Terms of service.
• To improve the service — understand how features are used and fix problems, using aggregated or de-identified information wherever possible.
• To meet legal obligations — keep tax and accounting records and respond to lawful requests.

Fly ROAS AI uses generative AI to analyse brands and create ads. We run this work through fal.ai, which provides the AI image, video and language models that power the service. fal.ai processes this data on our behalf, only to return the results we ask for.

• What we send: the product photos and brand assets you upload, Brand DNA details (colours, fonts, voice, products and prices), your creative instructions and summaries of competitor ad structures — only what a task needs. We never send your password, payment details or Meta access tokens.
• What it’s for: extracting and summarising your Brand DNA, analysing competitor ad structures, writing ad copy and generating images and videos from your real product photos.
• No cross-customer training: your brand assets and ad performance are never used to train models for other customers.

AI output can be wrong, so we design for human review: new ads are created paused in your ad account and only go live after your approval — or, if you switch Autopilot to hands-off, inside the rules you set.

If you’re in the EEA, UK or Switzerland (GDPR)

• Contract — to provide the service you signed up for: your account, Brand DNA, creatives, launches, Autopilot and billing.
• Legitimate interests — to keep the service secure, prevent fraud and abuse, improve features, research public Meta Ad Library data and communicate with business customers, always balanced against your rights.
• Consent — where we ask for it, for example when you grant Meta permissions or opt in to optional communications. You can withdraw consent at any time. This doesn’t affect processing that happened before.
• Legal obligation — to keep tax and accounting records and respond to lawful requests.

If you’re in India (DPDP Act, 2023)

We process your digital personal data on the basis of the consent you give — when you create an account, connect Meta or contact us — or for legitimate uses permitted by the DPDP Act, such as data you voluntarily provide for a specific purpose. You can withdraw consent at any time by disconnecting Meta, deleting data or your account in Settings, or writing to us. Withdrawal doesn’t affect processing already carried out, but some features will stop working.

You also have the right to access information about your data, to correction and erasure, to grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity — see Your rights and choices.

We share personal data only as described here. We don’t sell it or rent it to anyone.

• Service providers (sub-processors) that process data on our behalf under contract — listed below.
• Meta — when you launch ads or use Autopilot, we send your creatives, ad copy and campaign settings to your own ad account through Meta’s APIs.
• Professional advisers — such as lawyers and accountants, under duties of confidentiality.
• Legal and safety reasons — when required by law, or to protect the rights, property or safety of our users, the public or us.
• Business transfers — if we’re involved in a merger, acquisition or sale of assets, your data may transfer to the new owner under this policy. We’ll tell you before that happens.
• With your direction — anyone else you ask us to share it with.

Our sub-processors

Meta also processes data on its platforms as an independent controller, under its own terms and privacy policy. We’ll update this list when we add or replace a sub-processor.

Our service providers operate in several countries, including India and the United States, so your data may be processed outside the country where you live.

When we transfer personal data from the EEA, UK or Switzerland, we rely on safeguards recognised by law — such as adequacy decisions or Standard Contractual Clauses. Transfers of data from India are made in line with the DPDP Act, including any restrictions notified by the Government of India.

Deleted data can remain in encrypted backups until they’re overwritten in the normal backup cycle. We never restore deleted data from backups for use.

• Meta access tokens and other third-party credentials are encrypted at rest (AES-256-GCM).
• Data travels between your browser, our servers and our providers over encrypted connections (TLS/HTTPS).
• Passwords are stored only as salted hashes.
• Card and bank details are handled by PCI DSS–compliant payment processors and never touch our servers.
• Access to production systems is limited to people who need it to run the service.

No system is perfectly secure. If a breach affects your personal data, we’ll notify you and the relevant authorities as the law requires.

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it,
• correct data that’s inaccurate or incomplete,
• have your data erased,
• receive your data in a portable format,
• object to or restrict certain processing, including processing based on legitimate interests,
• withdraw consent at any time,
• nominate someone to exercise your rights if you die or become incapacitated (India),
• complain to a data protection authority — for example, your local supervisory authority in the EEA or UK, or the Data Protection Board of India.

Choices you can make yourself

• Disconnect Meta at any time in Settings, or remove Fly ROAS AI in your Facebook settings.
• Edit your Brand DNA, products and creatives directly in the app.
• Delete your account and data from Settings→ then Danger zone→ then Delete account & data — see our Data deletion instructions.
• Unsubscribe from any non-essential email using its unsubscribe link. Service messages — receipts, security notices and approval requests — continue while your account is open because the service needs them.

How to make a request

Email support@flyroas.com from the address on your account. We may need to verify your identity before acting, and we’ll respond within one month — sooner where the law requires.

Grievance Officer (India)

If you have a grievance about how we handle your personal data, write to our Grievance Officer at support@flyroas.com with the subject line “Grievance”. We’ll acknowledge it and respond within the timelines set by the DPDP Act and its rules. If you’re not satisfied with our response, you may approach the Data Protection Board of India.

Fly ROAS AI connects to Meta through Meta’s official Facebook Login for Business. While connecting, you choose which ad account, Facebook Page, Instagram account and Pixel to share, and you can change or revoke that choice at any time.

Permissions we request, and why

How we treat Meta Platform Data

• We comply with the Meta Platform Terms and Meta’s Developer Policies.
• We use Platform Data only to provide the Fly ROAS AI features you use — never for any other purpose.
• We don’t sell, license or purchase Platform Data, and we don’t transfer it to data brokers, ad networks or anyone else, except service providers that process it on our behalf to run Fly ROAS AI.
• We don’t use Platform Data to build or augment profiles of people, to make eligibility decisions (such as for housing, employment, credit or insurance), or for surveillance.
• We never post to your Page’s timeline or send messages on your behalf.
• Access tokens are encrypted at rest.
• We delete Platform Data within 30 days when you disconnect, remove Fly ROAS AI in Facebook, delete your account or ask us to — except anything the law requires us to keep.

To revoke access, disconnect in Fly ROAS AI Settings, or go to Facebook→ then Settings & privacy→ then Settings→ then Business integrations→ then Fly ROAS AI→ then Remove. See our Data deletion instructions for details.

Fly ROAS AI is a business service for people aged 18 and over. We don’t knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, contact us and we’ll delete it.

We may update this policy as the service or the law changes. The date at the top shows the current version. If we make a material change, we’ll tell you by email or in the app before it takes effect.

Questions, requests or complaints about privacy: support@flyroas.com.

Grievance Officer (India): support@flyroas.com, subject line “Grievance”.