Privacy Policy

Last updated: October 18, 2026

Who we are

Creative Cost Tracker ("the app") is an internal business tool operated by IRON FITNESS ("we"). It is used only by the owner of the business to analyse their own Instagram advertising. Contact: milia_crossfit@mail.ru.

Which data we receive from Meta

When the owner connects an Instagram professional account they manage through Instagram business login (permissions instagram_business_basic and instagram_business_manage_messages), Meta sends the app notifications about Direct messages that people send to that account. From these notifications we use:

• the Instagram-scoped ID of the person, and the profile name and username, when available;
• the time of each message;
• ad referral data that Meta attaches when a conversation starts from a click-to-Direct ad (ad ID, ad title);
• a phone number, if the person writes one in the conversation to book an appointment;
• the message text, only to display recent conversations to the owner and allow replies.

We also store the access token of the connected account so the app can receive messages and send the owner's replies.

How we use the data

• To determine which advertisement a customer conversation started from, and to link that conversation to a booking by the phone number, or by the profile name or username shown on the booking's screenshot, so the owner can calculate the real cost per booked customer for each ad.
• To let the owner read recent messages and reply to customers from the app.

We do not use the data for advertising profiles, we do not sell it, and we do not share it with third parties.

Retention

• Message text is deleted automatically 24 hours after it is received.
• Ad referral data, timestamps, phone numbers and profile names are kept while the Instagram account remains connected and for up to 24 months for reporting, then deleted.
• When an account is disconnected, its access token is deleted.

Storage and security

Data is stored on a single server operated for us in Frankfurt, Germany (European Union). Access is restricted to the business owner with a password over HTTPS. Server access requires SSH keys. Data is not transferred to other services.

Your rights and data deletion

You can ask us to delete all data related to your Instagram account or conversation at any time. See Data Deletion Instructions. We complete requests within 30 days.

Changes

We will update this page if the way we process data changes.