Privacy Policy

When you create and use an account we keep:

• your name and mobile number (you sign in with the number), and your email and WhatsApp number if you add them;
• your password, stored only as a one-way hash that we cannot read;
• your wallet balance and the history of every top-up, purchase and refund;
• the orders you place, the products you list and the ads you pay for.

Connecting is optional and only needed to promote a post. You log in on Facebook or TikTok itself, so we never see your password there.

Facebook and Instagram (Meta): we receive your Meta user ID, your name, the permissions you chose to grant, and an access token. When you open the ad form we also read the list of Facebook Pages you manage (their ID and name, and the Instagram business account linked to each) and your recent posts on them (the caption, picture, link and date) so you can choose one. Each Page’s own access token is used only while that list is loaded and is never stored.

TikTok: we receive your TikTok ID for our app (open_id), your display name, and an access token and a refresh token. When you open the ad form we read your recent videos (the description, cover image, link and date). To run a TikTok ad you give us a Spark Ads authorisation code for one video; we use it once to obtain the ad identity TikTok issues for that video, keep that identity with the campaign, and do not keep the code itself.

We do not read your messages, your followers or your friends, and we never post, comment or change anything on your accounts.

• to show you your own posts so you can choose which one to promote;
• to create and run the ad you paid for, on Hawal’s own advertising accounts at Meta or TikTok;
• to show you the ad’s status and results, and to work out and pay any refund;
• to keep the service secure, prevent fraud and meet our legal obligations.

We do not sell your information, and we do not use it to advertise anything to you.

• Meta or TikTok, only what is needed to run your ad: which post to promote, the cities, age range and gender you chose, the budget and the dates. The ad then runs under that platform’s own advertising and privacy policies.
• the companies that host our servers, which store data on our behalf and may not use it themselves;
• authorities, where the law requires it.

From Meta and TikTok we receive totals for your ad — reach, impressions, clicks, results and spend, per day. These are counts; they do not tell us who the people who saw your ad are.

Data is stored on our servers and travels over encrypted connections (HTTPS). Access tokens from Meta and TikTok are encrypted before they are saved, are never written to our logs, and are hidden from every page and API response. Only staff who need it for their work can reach customer data.

• Access tokens: while the account stays connected. A Meta token lasts about 60 days and a TikTok refresh token about a year; we renew them shortly before they run out. When you disconnect, both are deleted at once.
• The name and ID of a connected account: kept after you disconnect, because the campaigns made from it are part of our payment records.
• Campaigns, wallet transactions and refunds: kept as financial records for as long as we need them for accounting and to resolve disputes.
• Everything else in your account: while your account is open.

You can withdraw access at any time, and an ad that depends on it will stop:

• On hawal-online.com, open Sponsored ads → Connected accounts and press Disconnect. We ask Meta or TikTok to withdraw the permission and delete the tokens we hold.
• On Facebook, remove hawal.online under Settings & privacy → Settings → Business integrations (or Apps and websites).
• To remove Hawal’s access to a Facebook Page, open Meta Business Suite → Settings → Partners and remove Hawal.
• On TikTok, remove hawal.online under Settings and privacy → Security → Manage app permissions. A Spark Ads code can be revoked from the video’s ad settings.

If you remove the permission on the platform’s side instead, we notice the next time we renew the token and mark the account disconnected.

To have your data deleted, first disconnect your social accounts as described above, then contact us using the details below with your account number and ask for deletion. We will delete your connected-account data and your profile within 30 days and confirm when it is done.

We keep only what we are required to keep — records of payments, ad spend and refunds — and use them for nothing else.

We use a session cookie to keep you signed in and to remember your language, and your browser stores your light or dark theme choice. We do not use advertising or tracking cookies from third parties.

Our service is not meant for anyone under 18, and the ads we run are never shown to people under 18.

When this policy changes, we update the date at the top. If a change is significant, we also show a notice on the site before it takes effect.