Privacy Policy

Theory Road LLC (“Theory Road”, “we”, “our”) operates the Theory Road Impact Engine, a marketing-reporting platform that ingests advertising data from Meta (Facebook/Instagram), Google, TikTok, LinkedIn, Outbrain/Taboola, and other ad platforms on behalf of the agency’s clients and partner brands. This policy explains what data we collect, how we use it, and the choices you have.

Who this policy covers

This policy applies to visitors of theoryroad.com and theoryroad-impact-engine.vercel.app, to partner brands whose advertising accounts are connected to the Impact Engine by their owner, and to end users who click Theory Road’s tracking links.

Data we collect

• Ad platform data (campaigns, ad sets, ads, daily spend, impressions, clicks, conversions, creative metadata) pulled from each connected platform’s API after the account owner grants access via the platform’s own OAuth flow. For Meta, this uses the ads_management, ads_read, andbusiness_management scopes.
• Click-attribution data (click_id, referrer, landing page, user agent, IP, UTM parameters, platform click identifiers such as fbclid / gclid) captured when a user clicks a Theory Road tracking link.
• Conversion data (lead, qualified, sale, paid_sale status; revenue and payout amounts) received from partner postbacks, form integrations, or Everflow offer callbacks.
• Portal account data (name, email, organization) from Clerk-managed sign-in for operators logging into the reporting portal.

How we use data

• Display normalized reporting dashboards to the account owner (funnel, CPA, ROAS, platform rollups).
• Fire outbound postbacks to ad platforms (conversion events, custom audiences) when an owner explicitly configures the postback rule for their account.
• Manage and update campaign metadata and creative assets for accounts the operator has connected.
• Generate client reports and internal operational alerts.

We do not sell personal data. We do not share ad-platform data with any third party other than the platform it originated from (e.g., we may send a Meta conversion event back to Meta at the owner’s instruction) and infrastructure providers strictly needed to operate the platform.

Sub-processors

• Vercel (hosting)
• Supabase (PostgreSQL database)
• Clerk (authentication)
• Resend (transactional email)
• Twilio (ops SMS)

Retention

Ad-platform metrics are retained for the life of the reporting relationship. Raw click records are retained for 24 months by default; tracked conversions are retained for the life of the reporting relationship. Upon a verified deletion request, we remove personally identifiable data within 30 days.

Your rights

You may request access to, correction of, or deletion of your personal data at any time by emailing privacy@theoryroad.com. See also our Data Deletion Instructions.

Meta Platform data

When an operator connects a Meta ad account to the Impact Engine, we receive the scopes that operator grants (ads_management, ads_read,business_management). The token is stored encrypted at rest and is used only to read and manage the advertising assets of that ad account on the operator’s behalf. We honor Meta’s Platform Terms, Developer Policies, and all applicable data-use restrictions.

Contact

Theory Road LLC · Austin, Texas · privacy@theoryroad.com