Disconnect the account
Settings › Workspace › Disconnect deletes the token at once and the engine stops reading and writing on that account. You can also remove Optmos in the app settings of Meta.
Security and data
Security stated by what exists.
Optmos operates real budget. This page says what we read, what we write, where the data is kept, who processes on our behalf and what you yourself control. Without claiming in the name of Optmos what only the infrastructure certifies.
What we read
The fields Optmos reads on Meta.
Before connecting, you accept a versioned data agreement; the acceptance records the version. After that, Optmos reads what is below, and only from the ad account you chose.
| Source | What we read |
|---|---|
| Meta · ad account | Id, name, currency and status of the account; id, name and email of the login that authorized. |
| Meta · campaigns and ad sets | Id, name, objective and status of the campaigns; id, name, campaign, status, optimization goal, promoted event and budget (daily or lifetime) of the ad sets. |
| Meta · insights per ad set | Spend, impressions, reach, frequency, link clicks and CTR, conversion actions and values, cost per action, in the 1, 7 and 28-day attribution windows. |
Optmos does not read Facebook Pages, posts, followers or personal profile content.
What we write
One field: the daily budget.
The engine writes the daily budget of the ad set (or of the campaign, when the budget is centralized there).
Nothing else. The engine does not change status, does not pause, does not delete, does not create campaigns, ad sets, ads or audiences. Every write is read back and compared, and the result is kept in Decisions. The ads_management permission exists only for that field. It is requested at connection, together with ads_read; not writing during diagnosis and observation is an engine rule, recorded in Decisions, not a limit of the access. Changing a budget requires a subscription, calibration and the write test.
Where the data is kept
Supabase, Postgres with RLS per workspace.
The database, the authentication and the functions of Optmos run on Supabase. Each row belongs to a workspace, and Postgres row-level security (RLS) ensures that only whoever has a role in the workspace can read it. The access tokens to the platforms are kept in that database and are deleted the moment you disconnect the account.
The card never passes through Optmos: the subscription and the billing are handled by Stripe.
Who processes on our behalf
The vendors the code uses today.
| Vendor | For what |
|---|---|
| Supabase | Postgres database, authentication and server functions. |
| Stripe | Subscription and billing. The card stays with Stripe. |
| Meta | The API of the ad account you connect: reading of the fields above and writing of the daily budget. |
| Lovable | Hosting of the site and the app, delivery of the transactional emails and the AI gateway that takes the Assistant's questions to the model (Gemini, by Google). |
| Twilio | Delivery of WhatsApp notifications, through Lovable's gateway. The channel is not offered in the console today; the code only uses it for whoever already had that preference saved. |
The legal bases of the processing are in the privacy policy.
What you control
Four controls in your hands.
Turn the engine off
In Rules › What the engine operates. Off, no budget is changed.
Roles per person
Owner, admin and viewer. A viewer sees Decisions and the limits, but does not change rules or turn the engine on.
Delete the data
The whole account, or only the data of one ad account, on request by email. Step by step in Data deletion.
Your rights
Access, correction, export and deletion.
The LGPD (Brazil's data protection law) is the basis of the processing: when you connect a client's ad account, Optmos starts processing data that is not its own, and that is why the data agreement comes before the connection. You can request access, correction, export or deletion of your data by writing to contato@sociax.com.br from your login email; we respond within 30 days. We do not sell data and we do not use the platforms' data to target ads.
We do not stamp a compliance seal in the name of Optmos. What the infrastructure certifies, we cite as theirs, with a link, below.
Infrastructure certifications
The certifications are theirs, not ours.
Supabase
Supabase's certifications and security controls are published by Supabase at supabase.com/security.
Stripe
Stripe's PCI compliance and security controls are published by Stripe at stripe.com/docs/security.
Documents
The three Optmos documents.
- Terms of ServiceThe contract between you and Sociax.
- Privacy PolicyWhat we collect, why, and the vendors.
- Data DeletionHow to disconnect and how to delete the account or the data of one ad account.
Start with the study. No card.
In the first step Optmos changes nothing in the account: the management permission comes with the read permission, and not writing before operation is an engine rule. If you would rather ask first, write to Sociax.