Privacy Policy

Primeboxly Management (the “Platform”) is the internal operations platform of Primeboxly (“Primeboxly”, “we”, “us”), an e-commerce operator selling in cash-on-delivery markets in Africa and the Gulf. Our team uses the Platform to research and test products, manage creatives, sourcing and stock, record daily sales performance, follow finances, and read and manage Primeboxly’s own Facebook and Instagram advertising through the Meta Marketing API.

Accounts are created only by invitation from a Primeboxly administrator; there is no public sign-up. The people whose personal data the Platform processes are therefore mainly Primeboxly’s team members and invited collaborators (administrators, media buyers, video editors and sourcing specialists), people who apply to join us through the public application form, and the business contacts our team records (for example suppliers and transport companies).

The Platform’s Meta integration runs through Primeboxly’s Meta developer app, connected to Primeboxly’s own Meta Business portfolio. This policy does not cover Meta’s own services, which are governed by Meta’s Privacy Policy, nor Primeboxly’s online stores.

Account and profile

• Name, e-mail address, role in the team, and — only if you or an administrator add them — job title, phone number, location and profile photo.
• Your password is never stored: we keep only a salted scrypt hash of it. Invitation links and password-reset links are stored as hashes too.
• The markets (countries) and media buyers an administrator assigns to you, and your account status (invited, active, suspended or archived).

Sign-in and security records

• For each signed-in session: a hash of the session token, when it was created, last used and expires, the IP address and the browser’s user-agent string.
• Your last sign-in time, and an audit log of important actions (who did what and when, with the values that changed) — for example campaign launches and edits, stock corrections and team changes.

Work content you create in the Platform

• Products and their markets, prices, costs, links and notes; creative files (videos and images) and their versions; briefs, revision requests, tasks and notes.
• Team chat messages, voice notes and attachments, and in-app notifications.
• Daily performance entries (aggregated counts of orders, confirmations and deliveries, revenue and ad spend), stock and sourcing records, including the business contact details of suppliers and transport companies (such as a name, phone number and location).
• For team members who are paid by commission or by output: the compensation agreements and earnings records an administrator keeps for them.
• Primeboxly’s internal finance records, which only the super administrator can open.

Job applications

If you apply through the public “Join” form: your name, e-mail address, the role you are interested in, your location, your message, and, if you attach them, your CV and a photo.

What we do not collect

• The Platform does not store the names, phone numbers or addresses of the customers of Primeboxly’s stores: sales are recorded as daily totals per product and market.
• We do not use Facebook Login, and we do not collect Facebook or Instagram users’ profiles, friend lists, messages or other personal information from Meta (see the next section).
• We do not collect payment card details. Advertising is paid directly to Meta (see our Terms of Service).

How the connection is made

A Primeboxly super administrator connects the Platform to Meta by entering an access token generated for a system user of Primeboxly’s Meta Business portfolio (Settings → Integrations). An individual ad account can optionally be given its own token, by the super administrator or by the media buyer assigned to that account. No one signs in with a personal Facebook account, and the Platform can only reach the ad accounts, Pages and pixels that Primeboxly’s business has assigned to that system user.

What the Platform reads from Meta

• Ad accounts: ID, name, currency, status, time zone and, where available, the name of the business that owns the account.
• Campaigns, ad sets and ads: IDs, names, statuses, objectives, optimisation goals and budgets, and a thumbnail link of each ad.
• Performance metrics per day: spend, impressions, reach, clicks, link clicks, landing-page views, results, video plays and watch milestones, add-to-carts, checkouts initiated and purchase value. These are aggregated statistics about ads, not information about identifiable people.
• For publishing: the Facebook Pages an ad account can advertise with (ID and name), their linked Instagram business accounts (ID and username), and the account’s Meta pixels (ID, name and the time they last received an event).

Figures are refreshed in the background (about every 5 minutes for the last few days, and the whole last month a few times a day), and statuses about every minute. Only campaigns that ran or spent in the last four months are read; older days within those four months are loaded only when a team member asks for them.

What the Platform sends to Meta — only when a person asks

• When an authorised user presses Publish in “Create campaign”, the Platform creates the campaign(s), ad sets, ad creatives and ads described on the review screen in the chosen ad account, and uploads the selected creative videos or images. Placements are limited to Facebook and Instagram, and every ad creative is opted out of Meta’s multi-advertiser ads.
• When an authorised user edits a campaign, ad set or ad from the Platform, only the fields they changed (such as a name, budget or on/off status) are sent.
• When an authorised user duplicates an ad set or an ad from the Platform (choosing how many copies and whether they start on or paused, then pressing Publish), the Platform asks Meta to copy it that many times — an ad set with its ads — in the same campaign or ad set. The copies keep the original’s audience, budget, creatives and text; only their names change (“… - Copy 1”).
• When an authorised user deletes a campaign from the Platform (after confirming it), the Platform asks Meta to delete that campaign — Meta deletes its ad sets and ads with it. Its past figures stay in the Platform.
• To show each campaign, ad set and ad’s delivery the way Meta does (in review, active, off, rejected, deleted…), the Platform reads their status and schedule, the ad sets’ learning phase, and asks Meta about objects its lists no longer return.
• If a launch fails midway, the Platform pauses the objects it had already created in that launch, so nothing half-built can spend money; the user can then retry.
• Before a launch, the Platform asks Meta whether its publishing system user may create ads in the chosen ad account (the tasks it holds there and the account’s status), so nothing starts that Meta would refuse. When it may not, a super administrator can press Give Primeboxly access: the Platform then asks Meta to assign that ad account to its own publishing system user with the “manage campaigns” task — the same as Business Settings → System users → Assign assets. Nothing else is assigned, and it is written to the audit log.
• Nothing is created, changed or switched on in Meta without a person’s explicit action, and every launch, edit and deletion is written to the audit log.

Meta permissions and why we use them

Who can see it

Administrators can see every connected ad account. A media buyer only sees, and can only publish in, the ad accounts an administrator assigned to them. Video editors and sourcing specialists do not have access to Ads Manager.

We use data received from Meta only to run Primeboxly’s own advertising inside the Platform. We do not sell it, use it to profile individuals, or share it with anyone outside the providers listed below, and we handle it in line with Meta’s Platform Terms and Developer Policies.

• To create and secure your account, sign you in, and give you the access that matches your role and assigned markets.
• To run Primeboxly’s operations: product research and testing, creatives, sourcing and stock, daily performance, profit calculations in US dollars, team tasks and chat.
• To show advertising results and, when a user asks, to publish and edit Primeboxly’s campaigns in Meta.
• To write ad-copy suggestions with Claude, only when a user chooses that option (see “Service providers”).
• To answer a user’s questions in the Platform’s assistant (“Hmed”), only when they open it and send a message, a photo or a document, or talk to it on a call (see “Service providers”). Each user’s conversations with Hmed are kept in their own account so they can continue them later; a user deletes any of them from the conversations list.
• To calculate the earnings of team members paid by commission or by output, when an administrator has set this up.
• To send invitations and password-reset links, by e-mail when e-mail delivery is configured, or by a link an administrator shares with you.
• To review job applications.
• To keep the Platform secure, investigate misuse, keep an audit trail, and meet legal obligations.

• Meta access tokens, optional Meta app secrets and other integration keys (such as the Claude API key and the Azure Speech key) are encrypted in our database with AES-256-GCM, using a key derived from a secret that exists only in the server’s configuration.
• They are decrypted only on the server, at the moment a request is made to the provider. They are never sent back to a browser: the Platform shows at most the first and last four characters.
• Only the super administrator can add, replace or disconnect the business-wide tokens; an ad account’s own token can also be managed by the media buyer assigned to that account. Disconnecting deletes the stored token immediately.
• Tokens are not written to the audit log, and we never ask anyone for their Facebook password.

We do not sell or rent personal data. We share data only with the providers needed to run the Platform:

• Meta Platforms — receives what is needed to create and manage Primeboxly’s ads when a user publishes or edits them: creative files, ad copy, budgets, schedules, target countries, and the chosen Page, Instagram account and pixel.
• Hetzner Online GmbH — hosts the server that runs the Platform, its database and its stored files.
• Anthropic (Claude API) — only when a user chooses “Claude writes it” while creating a campaign: the product name, market, language, price, product-page link, the user’s notes, the product’s photo (reduced to a small image first) and the public text of that product page are sent so Claude can suggest ad copy. If the user writes the copy themselves, nothing is sent to Anthropic. For every generation (a campaign’s copy or an assistant reply) the Platform records who asked, the model, the number of tokens used and what it cost in dollars, to charge the user’s AI balance and to show the organisation’s administrator where the spending went. When a user writes to the Platform’s assistant (“Hmed”, available on every page), their messages, any photo, screenshot or document they attach, the page they are on (its section and the product or campaign open there) and the operational data the assistant reads for them within their own permissions (product names, codes, stages and markets; test, sourcing and stock figures; daily sales figures; campaign names, status, budgets, spend, results and costs; team members’ names, roles and markets; the user’s own tasks; for the ads they ask about, ad set and ad names, their creatives’ codes and their delivery figures) are sent to Anthropic to produce the answer. The assistant never reads the founder’s private cash workspace. On a call with Hmed, or when dictating, the user’s speech is turned into text by the browser’s own speech recognition before it is sent, and Hmed’s answer is read aloud by the browser’s own speech synthesis (in Chrome, Edge and Safari those services are run by the browser’s maker, under its own terms); no audio is sent to Anthropic or stored by us. Changes the assistant proposes (a campaign’s or an ad set’s budget, turning a campaign, ad set or ad on or off, duplicating an ad set or an ad, a workflow launch) are only made after the user approves them, and only in the ad accounts that user may already change.
• Microsoft (Azure AI Speech) — only when the organisation’s administrator has set up “Hmed’s voice” in the Platform’s settings: during a call, the TEXT of Hmed’s spoken answers (sentence by sentence) is sent to Microsoft to be turned into a natural voice, and the audio comes straight back to the user’s device to be played; it is not stored by us. The user’s own voice is never sent to Microsoft. Without that setting, the browser’s voice is used instead.
• An e-mail delivery (SMTP) provider — only if e-mail sending is configured, to deliver invitation and password-reset e-mails (name, e-mail address and the link).

To prepare ad copy, the Platform’s server may also fetch the public product page a user entered; it only fetches public internet addresses.

We may also disclose information if required by law or by a valid request from a competent authority, or to protect the rights, property or safety of Primeboxly, our team or others.

• One strictly necessary cookie, pbx_session, keeps you signed in. It is HttpOnly, sent only over HTTPS, limited to our own site, and expires after 30 days or when you sign out.
• Your browser’s local storage remembers your light/dark theme choice, and session storage remembers that the welcome animation was shown.
• If you install the Platform as an app, a service worker keeps a copy of the Platform’s own static files (scripts, styles and an offline page) so it opens quickly. It never stores pages, business data or uploaded files.

The Platform does not use analytics, advertising or social-media tracking cookies, and does not load third-party trackers. Its fonts are served from our own server.

• Business records (products, creatives, performance, stock, sourcing, finance, chat and the audit log) are kept for as long as Primeboxly uses the Platform for its operations. There is currently no fixed period after which they are automatically deleted.
• Team accounts: when an administrator removes someone from the team, an account with no work history is erased; an account with history is archived, so that the products, creatives and decisions it is linked to keep their author. Archived accounts can no longer sign in and all their sessions are ended.
• Sign-in records: sessions expire after 30 days; password-reset links after 20 minutes; invitation links after 7 days.
• Meta data: cached advertising data is kept as part of Primeboxly’s advertising history. Disconnecting Meta stops all further access immediately; data already copied stays until it is deleted on request.
• Job applications are kept until they are deleted on request.
• Backups: the database is backed up daily and these backups are kept for about 14 days; a backup is also taken before each update of the Platform, and the most recent ten are kept. Deleted data can remain in backups until they are replaced.

To ask us to delete your data, see User Data Deletion.

• All traffic is encrypted with HTTPS (TLS 1.2 or 1.3).
• Passwords are hashed with scrypt; session, invitation and reset tokens are stored only as hashes.
• Role-based access control is enforced on the server for every page and action; media buyers are limited to their own products, markets and ad accounts.
• Uploaded files are served only to signed-in users; applicants’ CVs and finance evidence only to the super administrator.
• Sign-in attempts are rate-limited, and suspending or removing a member ends their sessions immediately.
• Integration secrets are encrypted at rest (see above); important actions are recorded in an audit log; the database is backed up daily.
• Automated deployments run through a restricted account that cannot obtain administrator access to the server.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will inform you and the relevant authorities where the law requires it.

Depending on the law that applies to you, you may have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected — you can edit your own name, job title, phone, location and photo at any time in your profile;
• have your data deleted, or its use restricted, or object to how it is used;
• withdraw a consent you gave, and complain to your data-protection authority.

To exercise these rights, e-mail contact@primeboxly.com from the address registered on your account. We will verify your identity before acting and reply within the time the applicable law requires. Deletion requests follow the steps on our User Data Deletion page.

The Platform is hosted by Hetzner Online GmbH. Meta, Anthropic and Microsoft may process the data they receive in other countries, including the United States, under their own terms and safeguards. Our team members work from several countries and access the Platform from where they are.

The Platform is a professional tool for adults. It is not intended for anyone under 18, and we do not knowingly collect children’s personal data.

We may update this policy when the Platform or the law changes. We will change the “Last updated” date above and, for important changes, tell our team inside the Platform.

For any question about this policy or your personal data, write to Primeboxly at contact@primeboxly.com.