Orange Fox is a performance marketing agency based in Minneapolis, Minnesota. Orange Fox is a trade name of Initial Effort, LLC. This policy explains what information we collect through orangefox.com, what information we handle on behalf of our clients, and how the Max ROAS application handles advertising platform data. Max ROAS is an application owned and operated by Orange Fox.
This policy covers two distinct activities:
Where a section applies to only one of these activities, it says so.
When you visit orangefox.com, our servers and our analytics tools receive standard technical information that browsers transmit: IP address, browser type and version, operating system, device type, referring page, pages viewed, time on page, and the date and time of each request. We use this to understand how the site is used, to diagnose problems, and to measure the performance of our own marketing.
We do not require an account to use orangefox.com, and we do not host user comments or user profiles.
If you submit a form on our site, we collect the information you enter. Our intake form asks for your name, email address, company, website, your role, an approximate revenue range, what you are looking for, and your timeline. If you opt in to our journal, we collect your email address for that purpose. We use this information to respond to you, to evaluate whether we are a fit, and to send you the material you asked for. You can unsubscribe from the journal at any time using the link in any email.
We do not sell this information, and we do not share it with third parties for their own marketing.
We use cookies and similar technologies on orangefox.com. These fall into three groups:
You can refuse or delete cookies through your browser settings. Blocking analytics and advertising cookies does not affect your ability to use the site. You can also opt out of Google Analytics through Google's browser add-on, manage advertising personalization in your Google and Meta account settings, and opt out of the sharing described above by contacting us through the contact form in section 15.
In the course of providing marketing services, we receive access to client systems including advertising accounts, analytics properties, ecommerce platforms, email platforms, and data warehouses. Information we handle in those systems belongs to the client, and we process it under the client's direction and under the terms of our agreement with that client. We do not use client data to benefit other clients, and we do not combine data across clients into any product or dataset that identifies a client or its customers.
If you are a customer of one of our clients and you want to exercise a privacy right, contact that business directly. We will assist them in responding.
This section describes how the Max ROAS application handles data obtained from Meta, and is the section relevant to Meta Platform Terms and to review of our application.
Max ROAS reads advertising data from a business's own Meta ad accounts and produces an audit of that advertising: performance analysis, account structure review, and creative analysis. The audit is delivered to the business that owns the ad accounts, or to the agency that manages those accounts on that business's behalf.
Access is granted by an administrator of the business that owns the ad accounts, who shares those accounts with Orange Fox's Meta Business Manager as a partner. The application uses system user tokens issued in Orange Fox's Business Manager and scoped to the assets that business has shared. It can reach nothing the business has not shared. There is no consumer login: individuals do not sign in to Max ROAS with a personal Facebook or Instagram account, and the application does not read anything from a personal account.
The application holds three Meta permissions: ads_read, ads_management, and catalog_management.
The application's behavior is read-only. It never creates, edits, pauses, or deletes campaigns, ad sets, ads, creatives, budgets, bids, audiences, or catalog items, and it never places or changes an order. We hold ads_management and catalog_management because Meta gates read access to certain assets behind those scopes and provides no read-only equivalent. Specifically, reading the video file behind an ad and the thumbnails Meta generates for it, reading pixel statistics, and reading product catalog content all require those broader permissions. We request them for read access only.
The application does not access data about individual people. It does not read Custom Audience membership or the identifiers behind an audience, does not read the names of the business's own users, does not read Page content, comments, messages, or follower data other than the posts a business runs as ads, does not read lead forms or lead records, and does not read any user profile information. It requests no Pages permissions and no lead access permissions.
We use Meta data solely to produce the audit and the analysis the authorizing business asked for. Creative files are analyzed to describe what is in the advertising: format, aspect ratio, safe zone use, message structure, hook timing, and similar attributes. Metrics are analyzed to identify where performance is constrained. We do not use Meta data to train general purpose machine learning models, we do not sell it, we do not license it, and we do not use it for advertising targeting of our own.
Meta data is stored in our own infrastructure, described in section 8. Retention is limited and enforced on a schedule:
Every deletion is logged. Deletion logs record the ad account, the storage locations removed, the deletion time, and the rule or request that triggered the deletion. They contain no creative content and no personal data.
We do not share Meta Platform Data with any third party except the infrastructure and processing providers listed in section 8, each of which processes it only on our instruction. We do not share it with other clients, we do not include it in any benchmark or aggregate dataset released outside the authorizing business, and we do not transfer it in connection with any advertising or data brokerage arrangement.
An administrator of the authorizing business can revoke our access at any time in Meta Business Manager, by removing the application's access to the relevant assets or by deleting the system user. Revocation stops all further data retrieval immediately.
To have data already retrieved deleted, reach us through our contact form and note that you are making a data deletion request. We will reply to confirm which ad accounts are involved, then delete all Meta data associated with those accounts, including derived text and any stored reports, within 30 days of confirming the request. We will confirm in writing when the deletion is complete.
We access data from other advertising and analytics platforms, including Google Ads, Google Analytics, Google Merchant Center, Google Search Console, and ecommerce and email platforms such as Shopify and Klaviyo, under authorization from the businesses that own those accounts. The commitments in section 6 apply equally to that data: we use it only to serve the authorizing business, we do not sell it, and we delete it on request.
We use third party providers to operate our business and our applications. The categories are:
Each provider receives only the data it needs to perform its function, and is bound by contract to process it only on our instruction.
We protect data with encryption in transit and at rest, access controls limited to the people who need access to do the work, credential storage in a secrets manager rather than in code, and least privilege scoping of every platform token we hold. No system is perfectly secure, and we do not claim otherwise. If a breach affects your data, we will notify you and any applicable regulator as required by law.
We are based in the United States and our infrastructure providers may process data in the United States and other countries. If you are located outside the United States, information you provide to us will be transferred to and processed in the United States. Where required, we rely on standard contractual clauses or an equivalent transfer mechanism.
Depending on where you live, you may have the right to request access to the personal information we hold about you, to have it corrected or deleted, to receive a copy of it in a portable form, to opt out of targeted advertising or the sharing of your information, and to be free from discrimination for exercising these rights. To make a request, reach us through our contact form and tell us you are exercising a privacy right. We will verify your identity before acting, and we will respond within the time the applicable law allows.
We do not sell personal information. The only sharing of personal information we do for cross-context behavioral advertising, as those terms are defined under California law, is through the advertising cookies described in section 4, and you can opt out of it as described there. If you are in the European Economic Area or the United Kingdom and you believe we have handled your information improperly, you may also lodge a complaint with your supervisory authority.
Our website and our applications are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.
We keep website analytics data for the retention period configured in our analytics platform. We keep form submissions and correspondence for as long as needed to respond and to maintain our business records, and then delete them. Advertising platform data follows the schedule in section 6.7.
We may update this policy. When we do, we will change the date at the top of this page. If a change materially affects how we handle advertising platform data, we will notify the businesses that have authorized our access.
Orange Fox, a trade name of Initial Effort, LLC
Minneapolis, Minnesota, United States
For any question about this policy, a privacy request, or a data deletion request, use our contact form at orangefox.com/introduce-yourself. We monitor it and will reply to the email address you provide.