Privacy Policy
Last updated: 12 August 2026
1. Who we are
The Gang4 service is operated by:
GANG4, a French simplified joint-stock company (Société par Actions Simplifiée)
23 Boulevard Barbès, 75018 Paris, France
Company number (SIREN): 932 389 810 — Establishment number (SIRET): 932 389 810 00015
Trade register: Paris B 932 389 810
VAT: FR36932389810
Contact: samuel@gang4.io
GANG4 acts as data controller under the General Data Protection Regulation (GDPR — EU Regulation 2016/679).
Gang4 is a platform for online advertising professionals. It allows a brand to connect its Meta advertising assets in order to analyse performance, manage advertising creatives, and moderate comments received on its ads.
2. Data we collect
2.1 Your Gang4 account data
When you create an account, we collect your first and last name, your business email address, and your company name. You provide this data directly.
2.2 Data from your Meta account
When you connect your Meta account through Facebook Login, and only for the assets you explicitly select during authorisation, we access:
- Your ad accounts: identifiers, currency, time zone, and the structure of your campaigns, ad sets and ads;
- Your advertising performance: spend, impressions, clicks, conversions and other metrics provided by Meta;
- Your advertising creatives: images, videos, copy and related assets;
- Your Facebook Pages and professional Instagram accounts: name, identifier, posts;
- Comments and messages received on your ads and posts, including the public name and identifier of their authors.
We do not access any asset you did not select during authorisation.
2.3 Technical data
As you use the service, we collect your IP address, browser and device type, and the pages you visit, for security and service improvement purposes.
3. Use of Meta data — limited use
Data obtained from your Meta account is used solely to provide the features of the Gang4 service. Specifically:
What we do with it
- Display and analyse the performance of your advertising campaigns;
- Provide recommendations on your advertising creatives;
- Display comments and messages received on your ads and posts, and let you reply to them from Gang4;
- Create ads from creatives you have approved, at your explicit request.
What we never do with it
- We never publish to your Pages or accounts without an explicit action from you;
- We do not sell, rent or trade any data obtained from Meta;
- We do not use your data for targeted advertising, profiling, or to build prospecting databases;
- We do not use your data to train artificial intelligence models for third parties;
- We do not access any personal data from your private Facebook account.
Data collected through Meta platforms is used in accordance with the Meta Platform Terms.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the subscribed service | Performance of a contract (Art. 6.1.b GDPR) |
| Service analysis and improvement | Legitimate interest (Art. 6.1.f GDPR) |
| Security and fraud prevention | Legitimate interest (Art. 6.1.f GDPR) |
| Billing and accounting obligations | Legal obligation (Art. 6.1.c GDPR) |
| Marketing communications | Consent (Art. 6.1.a GDPR) |
5. Recipients and processors
Your data is accessible to authorised GANG4 personnel and to technical providers acting as processors, strictly for the purposes of delivering the service. These providers fall into the following categories:
- hosting and delivery of the website and application;
- database and authentication infrastructure;
- payment processing;
- transactional email delivery;
- automated workflows required by the service's features.
The service is hosted by Lovable Labs Incorporated (United States) and delivered through Cloudflare, Inc. (United States).
Each provider is bound to GANG4 by a data processing agreement compliant with Article 28 GDPR and acts only on GANG4's instructions.
We do not share your data with any third party for commercial or advertising purposes.
6. Transfers outside the European Union
Some of our processors are established outside the European Union, notably in the United States. Such transfers are governed by the safeguards set out in Chapter V of the GDPR — the European Commission's Standard Contractual Clauses or certification under the Data Privacy Framework.
7. Retention periods
| Category | Retention |
|---|---|
| Account data | For the duration of the subscription, then 3 years after last activity |
| Advertising data from Meta (campaigns, performance, creatives) | 24 months from collection |
| Comments and messages | 12 months from collection |
| Meta access tokens | Deleted immediately upon disconnection |
| Billing records | 10 years (statutory accounting obligation) |
| Technical logs | 12 months |
When you disconnect your Meta account, we immediately stop collecting new data and delete the associated access tokens.
8. Deleting your data
You may request deletion of your data at any time. The full procedure is described on our dedicated page: Data Deletion.
Three routes are available:
- From Gang4, under Settings → Meta connection, by disconnecting your account;
- From your Facebook account, under Settings → Business Integrations, by removing the Gang4 integration;
- By email to samuel@gang4.io, for full deletion of your account.
9. Your rights
Under the GDPR, you have the following rights over your personal data:
- Right of access (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure (Art. 17)
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20)
- Right to object (Art. 21)
To exercise these rights, write to samuel@gang4.io. We respond within one month at the latest.
You also have the right to lodge a complaint with the French data protection authority (CNIL), 3 Place de Fontenoy, 75007 Paris, France — www.cnil.fr.
10. Security
We implement appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), encryption of access tokens at rest, role-based access control, tenant isolation between customers, and access logging.
No system is infallible. We undertake to notify you and the CNIL of any data breach presenting a risk to your rights, within the timeframes set by the GDPR.
11. Cookies
The service uses only cookies that are strictly necessary for it to function (authentication, language preference). Under applicable law, these do not require your prior consent. We do not use advertising cookies or third-party profiling trackers.
12. Changes to this policy
This policy may be updated to reflect changes to the service or to applicable law. In the event of a substantial change, we will notify you by email or through an in-app notification at least 30 days before it takes effect.
13. Contact
For any question about this policy or about how we process your data:
GANG4
23 Boulevard Barbès, 75018 Paris, France
samuel@gang4.io