What we collect, and why.

What we collect

If you book a discovery call or subscribe to our notes, we keep what you typed: your name, business name, email, phone if you gave one, and what you told us about your business. That's it — there is no hidden enrichment and no purchased data. If you connect a Facebook Page or Instagram account so we can publish for you, what we access is covered under managing connected accounts below.

Analytics without cookies

When we measure site traffic, we use self-hosted Matomo in cookieless mode. No analytics cookies are set, no data is shared with ad networks, and nothing follows you around the internet afterward.

How we use it

To respond to you, to prepare for your call, and — if you subscribed — to send occasional notes. We don't sell, rent, or share your information with anyone outside The Smithy, a Glass Umbrella Inc company, except the service providers that host our systems, deliver our email, and run the AI tools we work with.

Managing connected accounts on your behalf

The Smithy, a Glass Umbrella Inc company, acts as what Meta calls a Tech Provider when a partner connects a Facebook Page or Instagram professional account to us. We access only the business data needed to publish and report on that partner's behalf. Specifically, that is the access token that authorizes publishing, the Page and Instagram account identifiers, the content we publish for you, and the engagement and performance metrics Meta returns for that content, such as reach, impressions, and interactions. We do not access, store, or process your Meta account password or login credentials; your private or direct messages; your customers' or followers' personal data beyond the aggregate metrics Meta provides; or any business data unrelated to the content we publish for you. We access this data solely to provide the publishing and reporting service you engaged us for, and for no other purpose.

Nothing goes out on its own. A named person approves every post before it publishes, and we record that approval with the post.

How we use and share partner data

We use partner data only to provide our publishing and reporting service and to meet our legal obligations. We do not sell partner data, and we do not use it for our own advertising or to build profiles. Where we use service providers, including hosting and AI tools, to deliver the service, we send them only the data that service needs, and only to deliver it. One partner's account data never goes into another partner's reports.

Use of AI tools

We use third-party AI tools in our work, for example to draft content and generate reports. We send these tools only the information needed for the task at hand. We do not sell your data, and we do not use your data for advertising.

How long we keep partner data

We hold the access token in our access-controlled systems, never in shared documents or code, and we delete it the moment you disconnect. Content and performance data for your connected accounts stay for the length of the engagement, so reports can compare one month with the last. They leave our live systems within 30 days of disconnect, and any backup copies expire no later than 35 days after they leave. Once a post is live, we remove any media we stored only to publish it. Your own media library stays as long as you keep it with us.

Disconnecting and deleting your data

You can disconnect The Smithy at any time, either from your Meta Business settings by removing The Smithy as a connected app or Business Integration, or by emailing us at privacy@thesmithy.co. On disconnect we immediately revoke and delete the stored access token, so we can no longer publish or read on your behalf. Within 30 days of disconnect we remove your account content and performance data from our live systems, and any residual backup copies expire no later than 35 days after that removal. To request deletion without disconnecting, or to confirm that a deletion has completed, email privacy@thesmithy.co and we will respond within 30 days.

Our use of information received from Meta's APIs follows Meta's Platform Terms and Developer Policies.

Removal

Email hello@thesmithy.co and we'll delete what you gave us when you booked a call or subscribed, lead records included, from live systems right away; rolling backups expire fully within 35 days, and we'll confirm when it's done. A partner's connected accounts follow their own timeline: see disconnecting and deleting your data.

Last updated October 2026. Questions: hello@thesmithy.co.