Privacy policy

This policy describes how Hacoeur inc. ("Hacoeur", "we") collects, uses, retains and protects personal information in the course of its digital marketing services, including advertising management on Meta (Facebook, Instagram), Google Ads, web analytics and its reporting plugin One-Click Report by Hacoeur.

1. Controller and contact details

Hacoeur inc., 105 Reid Street, Saint-Lambert, Quebec J4R 0A6, Canada. NEQ: 1176347160.

Person responsible for the protection of personal information: Hari Tafita — info@hacoeur.net — 514 264-4203.

2. Information we collect

• Account and contact: name, email, telephone, company, job title, IP address, device and browser.
• Meta advertising campaign data (Facebook Lead Ads, Facebook Page Insights, Meta Ads) accessed through Meta's Graph API when you connect your account: Page identifiers, Lead Ads forms, the content of the leads collected (name, email, telephone, form answers), campaign statistics and Page engagement. Together with the associated OAuth access tokens.
• Google data (Search Console, Analytics 4, Google Ads) accessed through the Google APIs when you connect your account: sessions, conversions, keywords and advertising performance. Together with the associated OAuth tokens.
• E-commerce and CRM data (WooCommerce, HubSpot) where connected: orders, products, contacts and sales cycles.
• Browsing data on hacoeur.net: pages visited, traffic source, technical cookies and audience measurement cookies.

3. Purposes of processing

We use this information solely in order to:

• Provide the advertising management, analytics and reporting services our clients have subscribed to (agency services).
• Consolidate data from multiple sources (Meta, Google, WooCommerce, HubSpot) into a single interface within the One-Click Report by Hacoeur plugin.
• Retrieve the leads generated by the client's Meta Lead Ads campaigns and display them in the client's dashboard (leads_retrieval).
• Communicate with the client about their campaigns, results and recommendations.
• Meet our legal, tax and contractual obligations.

We do not sell or rent any data. We do not use Meta or Google data for targeted advertising aimed at third parties.

4. Use of the Meta platforms (Facebook, Instagram)

When a client authorizes Hacoeur to access their Facebook Page, their Meta advertising account or their Lead Ads forms through the official Meta login screen, we receive an access token (Page Access Token) that allows us only the actions matching the permissions granted: reading leads (leads_retrieval), managing Page metadata (pages_manage_metadata), reading engagement (pages_read_engagement) and listing Pages (pages_show_list).

Tokens are stored in encrypted form in the plugin database, hosted on the client's own WordPress server. The client may revoke this access at any time from their Facebook settings or by contacting us.

5. Use of the Google platforms

In the same way, when a client connects their Google accounts (Search Console, Analytics 4, Google Ads), we receive OAuth 2.0 tokens used solely to read reporting data. The scopes requested are limited to what is strictly necessary (read-only on GA4, Search Console and Google Ads). Tokens can be revoked from the client's Google account.

6. Sharing and disclosure

We share information only with:

• The third-party platforms the client has explicitly connected (Meta, Google, HubSpot and others), for the purpose of delivering the service.
• Our infrastructure providers (WordPress hosting, email delivery through Resend, analytics), who are bound by confidentiality obligations.
• The competent authorities where the law requires it.

7. Retention and deletion

Data is retained for as long as the client uses our services, and thereafter for as long as our legal obligations require (accounting records: 6 years in Quebec). Meta leads and advertising statistics remain in the client's WordPress database until the client deletes them.

Anyone may request the deletion of their data by writing to info@hacoeur.net or by following the data deletion instructions. Requests are handled within 30 days.

8. Transfers outside Quebec

Some providers (Meta, Google, cloud hosting) process data outside Quebec, in particular in the United States and in Europe. These transfers are governed by those providers' privacy policies and, where applicable, by standard contractual clauses.

9. Security

Access tokens and sensitive data are encrypted at rest. Transmissions use HTTPS/TLS. Access to production systems is restricted to authorized personnel.

10. Your rights (Quebec Law 25, GDPR)

You have the right to access your information, to correct it, to withdraw your consent, to request its deletion or its portability, and to file a complaint with the Commission d'accès à l'information du Québec (CAI). Contact info@hacoeur.net to exercise these rights.

11. Cookies

hacoeur.net uses technical cookies (session, preferences) and anonymized audience measurement cookies. No third-party advertising cookie is set without consent.

12. Changes

We may update this policy. Significant changes will be posted on this page together with a new update date.