Privacy policy

Last updated 4 November 2026

This policy explains what personal data SBTMedia collects when you visit sbtmedia.agency or use our advertising-management services, including the SBTMedia App connected to Meta. It explains why we use the data, who we share it with, and the choices you have.

Who we are

SBTMedia is operated by Sebastian Thuesen and is the data controller for this website and our own advertising operations. When we manage a client’s advertising, the client determines the purposes of that processing and we handle their account data on their behalf. For anything related to privacy, email sebastian@sbtmedia.agency.

What we collect

Information you give us

• Report opt-in form: your first name, email address, phone number and approximate monthly ad spend.
• Funnel teardown questionnaire: your first name, email address, phone number (optional), company name (optional), website, and your answers about your business, goals, traffic sources and ad spend.
• Booking a call: your name, email address, time zone and any notes you add, together with your questionnaire answers, which we pass to Cal.com to create the meeting.
• Email: anything you choose to send us when you write to us.

Information collected automatically

• Usage data: pages you visit, clicks, scrolling, time on page, referring website, browser and device type, and approximate location derived from your IP address.
• Session recordings: we record how visitors move through our pages so we can see where they get stuck. Everything typed into form fields is masked and never recorded.
• Campaign data: if you arrive from an ad or a tagged link, we store the campaign parameters (such as utm_sourceor fbclid) so we know which ad brought you here.

Meta advertising data and the SBTMedia App

We use the Meta Marketing API through the SBTMedia App to manage advertising accounts that we own or have permission to manage. We operate the app through Codex and Claude Code to prepare and create ads, upload creative assets, manage campaigns and ad sets, and check advertising performance.

Depending on the permissions granted, this can include account, business, Facebook Page and Instagram identifiers; campaign and ad-set settings; budgets and targeting settings; ad copy, images, videos and destination URLs; and reporting such as spend, impressions, clicks and conversions. Meta profile information made available through login may also be used to identify the person authorising access.

We use this data to carry out authorised advertising work and to understand and improve campaign performance. Access is limited by the permissions granted to the app and the accounts and assets made available to us. Authorisation credentials are stored separately from public website content and should not be included in AI prompts or published reports.

When we use Codex or Claude Code for this work, relevant account information, ad content, instructions and API results may be processed by OpenAI or Anthropic. Their handling of that information, including retention and any use for model improvement, depends on the product, account settings and applicable agreement. We aim to include only the information needed for the task.

How we use it

• To send you what you asked for and to reply to you.
• To prepare for and hold calls you book with us.
• To understand how the site is used and to improve it.
• To measure how well our advertising works and to show our ads to people who are more likely to find them relevant.
• To keep the site secure and to block spam and abuse.

We do not sell your personal data.

Legal bases

Where data protection law such as the GDPR applies, we rely on: yourconsent for analytics and advertising cookies; the steps needed to respond to your request when you fill in a form or book a call; and our legitimate interests in running, securing and improving the site and providing authorised advertising management. For client account data, we also act on the client’s documented instructions and applicable agreement. You can withdraw consent at any time.

Who we share it with

We use a small number of service providers to run the site. They process data on our behalf or under their own privacy policies:

We may also share data if required by law, or as part of a sale or restructuring of the business.

Cookies

We and our providers use cookies and similar technologies:

• sbt_attr (ours): remembers which campaign brought you here. Kept for 90 days.
• _fbp, _fbc (Meta): ad measurement. Kept for up to 90 days.
• ph_* (PostHog): analytics. Kept for up to one year.
• flick:* (ours, local storage): an anonymous viewer ID, your volume and where you stopped watching, so the video can pick up where you left off.

You can block or delete cookies in your browser settings, and the site will still work. You can also control ad personalisation in yourMeta ad preferences.

International transfers

Some providers, including Meta, Cloudflare, Cal.com, OpenAI and Anthropic, process data in the United States and other countries. Where required, these transfers are protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

We keep the information you submit for as long as we need it to respond to you or work with you, and for up to two years after our last contact unless the law requires longer. Analytics data is kept for up to one year. Our providers keep data according to their own retention policies.

Meta account data, exported reports, creative assets and local advertising-work records are kept for as long as needed to perform the authorised work, support the client relationship or meet applicable legal obligations. We delete data under our control when it is no longer needed, subject to those obligations. Information in AI-service histories or logs is also subject to the relevant provider’s retention rules and account settings.

Removing Meta access and requesting deletion

You can revoke the SBTMedia App’s access through Meta’s Business Integrations or the relevant business and asset settings. Revoking access stops future access through the removed permissions; it does not automatically remove existing ads or copies of data already held.

To request deletion of Meta data we hold, email sebastian@sbtmedia.agency with the subject “Meta data deletion” and identify the relevant business, Page or ad account. Do not send access tokens or passwords. After verifying your authority to make the request, we will delete the relevant records under our control unless retention is legally required, and explain any limits. Requests concerning data held independently by Meta or another provider may also need to be made directly to that provider.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent. To exercise any of these, email sebastian@sbtmedia.agency. We will reply within 30 days. You also have the right to complain to your local data protection authority.

Security

The site is served over HTTPS, and personal data sent to Meta is hashed before it leaves our servers. No system is perfectly secure, but we take reasonable steps to protect your data.

Children

This site is for businesses and is not directed at anyone under 16. We do not knowingly collect data from children.

Changes

We may update this policy from time to time. The date at the top shows when it last changed.