Last updated: 28 May 2026

Privacy Policy

Blockwise (“Blockwise”, “we”, “us”) is a B2B real estate advertising workflow tool operated from Australia. This policy explains what personal data we collect, why we collect it, how we store and use it, and how you can request a copy or have it deleted. It applies to www.blockwise.sale and to the Blockwise application at app.blockwise.sale.

1. Who this policy is for

Blockwise has two distinct user groups, and the data we hold for each differs:

• Real estate agents and agency staff who sign in to Blockwise to plan, approve, and review advertising campaigns.
• Members of the public who submit a Meta Lead Ad form created by a Blockwise customer (an agent). Blockwise processes that lead data on behalf of the agent so they can contact the prospective seller.

2. Data we collect from Blockwise customers (agents)

• Account profile: email address, name, workspace name, role.
• Authentication metadata managed by Supabase.
• Advertising configuration: brand kit, target suburbs, ad copy you write or approve, lead form questions, lead destination preferences.
• Audit history of approvals, publishes, and configuration changes.

3. Data we access through the Meta Marketing API

When you connect a Meta Business ad account to Blockwise, we receive an OAuth access token from Meta with your consent. The token is encrypted at rest with AES-256-GCM using a key managed in our application secrets, and is only decrypted in memory at the moment a Meta API request is being made on your behalf. Using that token, Blockwise reads or writes the following Meta data:

• Ad account metadata (ID, currency, timezone) so we can show the agent which account they connected.
• Facebook Pages you administer (name, ID), so the agent can pick which Page will host the lead ads.
• Campaign, ad set, and ad objects we create on your account. These are always created in PAUSED state. We never create, activate, or modify a campaign without a separate in-application human approval.
• Lead form submissions you have authorized us to retrieve from forms Blockwise created on your behalf — see Section 4 below.
• Insights data (impressions, reach, clicks, spend, leads) for campaigns Blockwise manages on your account, so we can show you live performance inside Blockwise Monitor.

We do not use Meta data for purposes other than running and reporting on the campaigns you have explicitly created in Blockwise. We do not sell or share Meta data with any third party other than the infrastructure providers listed in Section 6.

4. Data we collect from members of the public who submit a lead form

If you have submitted a Meta Lead Ad form created by a real estate agent who uses Blockwise, the agent has used Blockwise to fetch your submission from Meta and store it inside their Blockwise workspace. The fields stored depend on the form the agent built but typically include: name, phone number, email address, suburb, and any free-text answers you provided. Blockwise acts as a processor of this data on behalf of the agent (the controller).

If you wish to access, correct, or delete this data, you should contact the agent directly. You may also contact us at privacy@blockwise.sale and we will forward the request to the agent and, on confirmation, delete the data from our systems.

5. Retention

• Account and configuration data: retained while your Blockwise workspace is active.
• Meta access and refresh tokens: stored encrypted and rotated on Meta’s schedule; deleted within 30 days of you disconnecting the integration.
• Lead submissions: retained for 24 months by default and then anonymised, unless the agent deletes them sooner or you exercise your deletion right.
• Audit logs: retained for 24 months for security and dispute resolution.

6. Sub-processors

We use the following infrastructure providers, who are contractually bound to confidentiality:

• Vercel (application hosting)
• Supabase (authentication, application database, encrypted storage)
• Trigger.dev (background job execution)
• Model providers and gateways (large language model inference for ad copy generation)
• Cloudflare (egress filtering and model gateway)

7. Requesting Data Deletion

You have the right to request that we delete all data we hold from or about you. There are three ways to do this:

1. If you are a Blockwise customer:open your workspace settings and click “Delete workspace”. This permanently removes your workspace, all configuration, all stored Meta tokens, and all stored lead submissions within 30 days.
2. If you submitted a Meta Lead Ad form created by a Blockwise customer: email privacy@blockwise.salewith the subject “Delete my data” and tell us the agency or agent who ran the ad. We will route the request to the agent and delete the data from our systems within 30 days of confirmation.
3. If you are a Facebook user who connected Blockwise:you can revoke Blockwise’s access from your Facebook account’s “Business Integrations” settings. Meta will notify Blockwise through our Data Deletion Callback (/api/integrations/meta/data-deletion), and we will delete the associated data within 30 days and return a confirmation code that you can use to track the deletion at privacy@blockwise.sale.

Deletion requests are normally completed within 30 days. Some backup systems may retain a copy for up to 90 days before being permanently overwritten.

8. Security

All traffic to Blockwise uses HTTPS. Access tokens for third-party providers, including Meta, are encrypted at rest with AES-256-GCM. Production access is restricted to named personnel with two-factor authentication.

9. Contact

Privacy questions: privacy@blockwise.sale
General contact: hello@blockwise.sale

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be notified to active customers by email.