Privacy Policy — Coates Media

Last Updated: 2026-06-08

This Privacy Policy describes how Coates Media LLC (“we,” “us,” or “our”) collects, uses, and protects personal information across our websites, applications, and services, including any third-party platform applications we operate (collectively, the “Services”).

This is a master privacy policy. App-specific or service-specific data handling details, where they differ from this policy, are described in the Addenda at the end of this document.

1. Who we are

For privacy questions, requests, or to exercise your rights under this policy, email ancoates@coatesmedia.co.

2. Scope

This policy applies to:

• The Coates Media website (coatesmedia.co) and any subdomains we operate
• Marketing automation and advertising services we provide to our clients
• Third-party platform applications we operate, including but not limited to:
  • Coates Media Connect — Meta Platforms application (App ID: 963876983267406) that Coates Media operates as an agency integration for the client businesses we manage (currently Fred Astaire Dance Studios franchise locations): it (a) processes Lead Ad submissions, routing each client’s leads only to that client’s CRM, and (b) reads advertising performance data and applies approved advertising changes on the Meta ad accounts those clients authorize
  • Google Ads API integration — a Google Cloud OAuth application (project augmented-web-437318-e5) Coates Media operates as an agency automation platform to monitor, report on, and apply approved updates to client Google Ads campaigns across the accounts our clients authorize

Where an individual app or service has data flows or retention practices that differ from this master policy, those differences are described in the Addenda below.

3. What data we collect

We collect personal information in the following ways:

Directly from you:

• When you contact us via email, web form, or other channels
• When you sign up for newsletters, demos, or marketing communications
• When you become a client or vendor

Through our applications and services:

• Lead data submitted through Meta Lead Ads or other ad platforms operated on behalf of our clients
• Form submissions on websites we operate or manage
• Identifiers required for ad attribution (e.g., click IDs, campaign IDs, ad IDs)
• Advertising performance and account-structure data from the ad platforms our clients authorize (e.g., campaign, ad set / ad group, and ad metrics such as spend, impressions, and clicks). This is generally aggregate business data about a client’s own advertising, not personal data about end users.

Automatically:

• Standard web analytics data (pages visited, browser type, IP address) on our own websites
• Performance and usage telemetry from our applications, in aggregate

We do not collect: government identifiers, payment account numbers, biometric data, precise geolocation beyond city/region voluntarily submitted, or health data.

4. How we use the data

We process personal data to:

1. Deliver the services our clients hire us to provide (e.g., routing leads to the correct client CRM, attributing marketing performance, supporting customer follow-up)
2. Operate and improve our websites and applications
3. Communicate with you about Coates Media services if you’ve expressed interest
4. Comply with legal obligations (tax records, regulatory inquiries, etc.)

We do not sell personal data. We do not share lead data with advertisers, data brokers, or marketing platforms outside the scope of the service we are operating.

5. Where data is stored

All data is encrypted in transit (HTTPS / TLS) and at rest using each provider’s standard encryption.

Sub-processors. We rely on the following service providers to operate the Services:

Per-service details are in the Addenda. We update this list as sub-processors change.

6. How long we keep data

If a Lead is converted to a Contact (e.g., a paying customer for one of our clients), the record is retained for the duration of the customer relationship and a reasonable period thereafter, consistent with U.S. business records norms.

7. Who we share data with

We share personal data only with:

1. The client whose service the data was collected on behalf of. Lead data submitted through ads operated for a specific client flows only to that client’s CRM and is accessible only by that client’s authorized staff.
2. Sub-processors acting under a Data Processing Agreement (e.g., Zoho Corporation as CRM provider).
3. Authorities or legal entities if compelled by law (subpoena, court order). We will provide notice to the affected individual where legally permissible.

We do not sell or rent personal data. Aggregated, de-identified data may be used for performance reporting and product improvement.

8. Your rights

You may request, at no charge:

• Access to the personal data we hold about you
• Correction of inaccurate data
• Deletion of your data (see Section 9)
• Restriction of processing
• Objection to processing for marketing purposes
• Data portability — a machine-readable copy of your data

To exercise any of these rights, email ancoates@coatesmedia.co with subject line Privacy Request and include the email address associated with the data. We will respond within 30 days.

9. Data deletion

To request deletion of your personal data, follow the instructions at:

https://coatesmedia.co/data-deletion

For app-specific deletion processes (e.g., Meta Platform integrations), see the Addenda.

10. Security

We protect personal data through:

• HTTPS / TLS encryption for all data in transit
• OAuth 2.0 token-based authentication for all CRM, advertising, and platform API access
• Role-based access controls within client CRMs, scoped to the appropriate audience
• Audit logs of administrative access
• Encryption at rest in our cloud providers

We follow industry-standard practices but cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you in accordance with applicable law.

11. Children

Our services are not intended for use by individuals under 13 years of age. We do not knowingly collect data from children under 13. If we discover such collection has occurred inadvertently, we will delete it.

Some of our clients offer programs for individuals aged 13+ (e.g., youth or family activity programs); in those cases, ad lead forms are completed by a parent or guardian on the child’s behalf, and the data we receive is the parent’s contact information.

12. International users

Coates Media operates in the United States. Data is processed and stored in U.S.-based infrastructure. If you submit data from outside the U.S., it will be transferred to the U.S. for processing. By using our services or submitting data through our platforms, you consent to this transfer.

13. Changes to this policy

We may update this Privacy Policy periodically. The “Last Updated” date at the top reflects the most recent revision. Material changes (e.g., new categories of data collected, new sub-processors) will be communicated to active contacts at the email on file.

14. Contact

Addenda — Application-Specific Notes

A. Coates Media Connect (Meta Platforms App)

Coates Media Connect performs two functions for the clients we manage: (A.1) receiving Lead Ad submissions, and (A.2) reading advertising performance data and applying approved advertising changes. Both operate only on the Meta business assets (Pages and ad accounts) a client authorizes.

A.1 — Lead Ads (lead capture)

What it does: Receives Meta (Facebook / Instagram) Lead Ad submissions from the Pages of the clients Coates Media manages, and routes each submission to that client’s CRM so the relevant business can follow up. Lead data submitted on one client’s Pages flows only to that client’s CRM.

Meta permissions used: leads_retrieval, pages_show_list, pages_read_engagement, pages_manage_metadata, public_profile.

Data collected: First name, last name, email, phone, any additional questions configured on the lead form, and Meta-supplied identifiers (leadgen_id, form_id, ad_id, campaign_id, Page ID).

Data flow: Meta → ops.coatesmedia.co (transient, <60 seconds) → the relevant client’s Zoho CRM (persistent storage). Encryption in transit and at rest.

Authorized Pages: Only Pages a client explicitly authorizes Coates Media to manage (via Meta Lead Access Manager / partner sharing). The current authorized set is the Fred Astaire Dance Studios Pages listed in the Application’s Terms of Service. Adding a client or Page requires explicit authorization.

A.2 — Advertising performance & management

What it does: With the client’s authorization, Coates Media Connect (a) reads advertising performance and account-structure data from the client’s Meta ad account for monitoring, change detection, and reporting, and (b) applies approved advertising changes (e.g., budget, status, or creative updates) staged through Coates Media’s approval queue. This mirrors the agency automation Coates Media operates for Google Ads (Addendum C).

Meta permissions used: ads_read (read advertising data); ads_management (apply approved changes — used only once the client has authorized the management workflow).

Data accessed: Campaign, ad set, and ad performance metrics (e.g., spend, impressions, clicks, results), account and campaign structure, and related advertising metadata for the authorized ad account. This is generally aggregate business data about the client’s own advertising, not personal data about end users.

What we capture and store: Advertising performance metrics, captured into Coates Media’s analytics database (Postgres on ops.coatesmedia.co) for monitoring and client reporting, and mirrored to the client’s analytics workspace where applicable. Retained while the client engagement is active and for a reasonable period thereafter for reporting continuity. Encrypted in transit and at rest.

Authorized ad accounts: Only the Meta ad account(s) a client authorizes (via partner sharing or asset assignment in Meta Business Manager). Adding accounts requires explicit authorization.

Platform data use: Coates Media’s access to and use of data received through the Meta Marketing API adheres to Meta’s Platform Terms and Developer Policies. We do not sell this data, use it for our own advertising, or transfer it except to provide the service to the authorizing client, to comply with law, or in connection with a merger or acquisition with appropriate notice.

Deletion & revocation (Coates Media Connect)

See https://coatesmedia.co/data-deletion. Lead records are deletable on request and via the Meta Data Deletion Callback at https://ops.coatesmedia.co/webhook/fads.meta.deletion. Advertising performance data is aggregate business data about a client’s ad account; it is deleted as part of offboarding that client. A client may revoke Coates Media’s access to their Pages and ad accounts at any time through Meta Business Manager (Business Settings → Partners / Lead Access).

B. coatesmedia.co Contact Form

What it does: Lets visitors send a project brief through the form at https://coatesmedia.co/contact.

Data collected: Name, email, and the details you choose to include (company, budget band, project scope, timeline). We do not store additional technical metadata with the submission beyond what Section 3 describes for general web analytics.

Data flow: Browser → coatesmedia.co → Coates Media automation at ops.coatesmedia.co → stored in Coates Media’s own database (on our infrastructure) and Coates Media’s CRM (Zoho CRM). Encrypted in transit and at rest.

Purpose: To respond to your inquiry. We do not add you to marketing lists without your separate consent, and we do not share contact-form submissions with third parties except the sub-processors that host our database and CRM.

Retention & deletion: Retained while we handle your inquiry and for a reasonable follow-up period (see Section 6); deleted on request per https://coatesmedia.co/data-deletion.

C. Google Ads API Integration

What it does: With the client’s authorization (Google OAuth), Coates Media connects to the client’s Google Ads account to read performance data for monitoring, change detection, and reporting, and to apply approved campaign updates (budget, bid, status, targeting) on the client’s behalf — changes are staged through an approval queue before they are written. This integration is general-purpose across all clients for whom we run Google advertising.

Google data accessed (OAuth scope): https://www.googleapis.com/auth/adwords — read and management (write) access to the authorizing account’s Google Ads data, including campaign, ad group, ad, and keyword performance, account structure, conversion and attribution metrics, and related user-level advertising data.

What we capture and store: Campaign performance metrics, captured into Coates Media’s analytics database (Postgres on ops.coatesmedia.co) and Zoho Analytics for client reporting and historical comparison. Retained while the client engagement is active and for a reasonable period thereafter for reporting continuity. Encrypted in transit and at rest.

Limited Use: Coates Media’s access to, and use of, information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for personalized advertising, sell it, or transfer it except to provide or improve the service, to comply with law, or in connection with a merger or acquisition with appropriate notice.

Authorization & revocation: Access is granted by the client via Google OAuth and is limited to the Google Ads accounts the client authorizes. The client may revoke access at any time at https://myaccount.google.com/permissions.

Deletion: To request deletion of data Coates Media holds from this integration, see https://coatesmedia.co/data-deletion or email ancoates@coatesmedia.co.

This policy is published at https://coatesmedia.co/privacy