Privacy Policy

1. Who we are and what this policy covers

Whitelisters.com ("Whitelisters," "we," "us," or "our") is operated by Mindful, LLC, a California limited liability company, located at 533 Venice Way, Venice CA 90291. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have.

It applies to our website at whitelisters.com, our customer dashboard, and the related services we provide (together, the "Service"). The Service is built for businesses: it gives advertisers access to a roster of Facebook and Instagram pages that can be used as partnership-ad identities inside the advertiser's own Meta ad account.

This policy does not cover third-party sites or platforms we link to or integrate with, including Meta (Facebook and Instagram) and Stripe. Their own privacy policies govern how they handle your information.

2. Information we collect

Information you give us. When you sign up, start a trial, or contact us, we collect your name, work email, company name, job title, password or login credentials, and anything you include in messages to us.

Billing information. Payments are processed by Stripe. Stripe collects your card details directly; we never see or store your full card number. We receive limited billing details from Stripe, such as the cardholder name, billing address, card brand, last four digits, expiration date, and payment status.

Information from Meta when you connect your accounts. When you connect your Meta Business Manager, you authorize us through Meta's login and permission screens. Depending on the permissions you grant, we receive:

• Your Meta user ID, name, and the email associated with your Meta login
• Your Business Manager ID and name, and the IDs and names of the Instagram accounts and ad accounts you choose to connect
• Access tokens that let us assign the pages you select to your ad account
• Performance data for ads that run through our pages, such as impressions, reach, clicks, spend, conversions, cost per acquisition, and return on ad spend

We use this data to run the Service and to power your analytics dashboard, including comparisons between ads run through our pages and ads run through your own brand page. We do not access your personal Facebook or Instagram profile content, private messages, or friends list.

Information collected automatically. When you visit the site or use the dashboard, we and our providers collect device and usage data: IP address, browser type, operating system, referring URLs, pages viewed, actions taken, approximate location derived from IP address, and timestamps. We collect some of this through cookies and similar technologies (see section 5).

Information from other sources. We may receive information about you from partners, referrers, or publicly available business sources, for example if someone refers you to us.

3. How we use information

We use personal information to:

• Create and manage your account, start your trial, and process subscription payments
• Connect your Business Manager and assign the pages you select to your ad account
• Show ad performance in your dashboard and calculate comparison metrics
• Provide support, send service and billing notices (including trial-ending and renewal reminders), and respond to requests
• Send product updates and marketing emails, which you can opt out of at any time
• Monitor, secure, debug, and improve the Service, and develop new features
• Prevent fraud and abuse, enforce our Terms and Conditions, and comply with Meta's platform rules
• Comply with legal obligations and protect our rights

We may create aggregated or de-identified data, such as average performance across all customers, and use it for any lawful purpose, including in marketing. Aggregated data will not identify you or your business.

Legal bases (EEA and UK visitors). If data protection law in the European Economic Area or United Kingdom applies, we rely on: performance of our contract with you (running the Service and billing); our legitimate interests (security, improvement, B2B marketing, fraud prevention); your consent (non-essential cookies, and marketing where consent is required); and legal obligations.

4. Meta Platform data and how we share information

Meta Platform data. Data we receive through Meta's platform (section 2) is used only to provide the Service to you, to keep the Service secure, and to comply with Meta's Platform Terms and Developer Policies. We do not sell Meta Platform data, use it to build profiles of individuals, or share it with data brokers or advertising networks. You can remove our access at any time in your Meta Business Settings or Facebook settings; when you do, we stop receiving new data and delete the tokens we hold.

We do not sell your personal information. We share it only as follows:

• Service providers that process data on our behalf under contract, including Stripe (payments), Supabase (hosting and storage), Resend (transactional and marketing email), PostHog and Google Analytics (site analytics), and Meta (advertising measurement through the Meta Pixel)
• Meta, as needed to assign pages to your ad account and retrieve performance data you authorized
• Our other business lines within Mindful LLC, including our marketing agency, for internal operations and support
• Professional advisers such as lawyers and accountants, under confidentiality obligations
• Legal and safety reasons, when we believe disclosure is required by law, legal process, or to protect the rights, property, or safety of Whitelisters, our customers, or others
• Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to this policy
• With your consent or at your direction

The pages on our roster do not receive your personal information. Ads you run through those pages are visible to the public on Meta's platforms as they would be for any ad.

5. Cookies, retention, security, and international transfers

Cookies. We use strictly necessary cookies to keep you logged in and secure the dashboard. With your consent where required, we also use analytics cookies (Google Analytics and PostHog) to understand site usage, and advertising tags, such as the Meta Pixel, to measure and improve our own ads on Facebook and Instagram. The Meta Pixel sends Meta information such as pages you visit and actions you take on our site, which Meta may link to your Meta account. You can opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout, and manage Meta ad settings in your Meta Accounts Center. You can control cookies through our cookie banner and your browser settings; blocking necessary cookies may break parts of the Service.

Do Not Track. Our site does not currently respond to browser Do Not Track signals. We do honor Global Privacy Control (GPC) signals as an opt-out of sharing where state law requires it.

Retention. We keep account and billing information while your account is active and for up to 7 years after it closes, as needed for tax, accounting, and legal purposes. Meta access tokens are deleted when you disconnect or close your account. Ad performance data is kept while your account is active and deleted or de-identified within 90 days after closure, unless you ask us to delete it sooner. Website usage data is kept for up to 26 months.

Security. We use reasonable administrative, technical, and physical safeguards, including encryption in transit, access controls, and encrypted storage of access tokens. No system is perfectly secure, and we cannot guarantee the security of information you send us.

International transfers. We are based in the United States and process information there. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. Your rights and choices

Everyone. You can update your account details in the dashboard, unsubscribe from marketing emails using the link in any email, and disconnect your Meta accounts at any time. Service and billing emails will still be sent while you have an account.

Deleting your data, including Meta data. To request deletion, email hello@whitelisters.com from your account email with the subject "Data deletion request," or follow the steps at whitelisters.com/data-deletion. You can also remove the Whitelisters app in your Facebook settings under Apps and Websites, which notifies us to delete your Meta data. We will confirm and complete deletion within 30 days, except data we must keep for legal, tax, or fraud-prevention reasons.

California residents. Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to:

• Know the categories and specific pieces of personal information we collect, use, and disclose
• Delete personal information we hold about you
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising
• Limit use of sensitive personal information (we do not use sensitive personal information for purposes that require this right)
• Not be discriminated against for exercising these rights

In the past 12 months we collected identifiers, commercial information, internet activity, approximate geolocation, and professional information, from the sources and for the purposes in sections 2 and 3, and disclosed them to the categories of recipients in section 4. We do not sell personal information. Because we use the Meta Pixel and Google Analytics, we may "share" device and browsing data with advertising partners for cross-context behavioral advertising; opt out with the "Do Not Sell or Share My Personal Information" link in our footer or by enabling Global Privacy Control. We do not knowingly sell or share the personal information of anyone under 16.

Other U.S. states. Residents of states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia, Texas, and Oregon, may have similar rights to access, correct, delete, and opt out of targeted advertising. If we deny your request, you may appeal by replying to our decision with "Appeal" in the subject line.

EEA and UK residents. You may have the right to access, correct, delete, restrict, or object to processing, to data portability, and to withdraw consent. You may also complain to your local data protection authority.

How to make a request. Email hello@whitelisters.com. We will verify your identity by matching your request to your account email and may ask for more information. An authorized agent may submit a request with your signed permission. We respond within the time required by law, generally 45 days.

7. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new effective date and, for material changes, notify account holders by email or in the dashboard before the change takes effect.

9. Contact us

Mindful LLC, d/b/a Whitelisters
533 Venice Way, Venice, CA 90291
hello@whitelisters.com