Meta Integration: Doneforyou Ads
Last updated: October 22, 2026
1. About Doneforyou
Doneforyou is AI-powered recruiting software for recruitment marketing agencies. For each of the agency's clients, Doneforyou creates recruiting campaigns with AI: job application landing pages, ad copy and ad images. Applications arrive in an applicant dashboard where the agency – and, if it wishes, its client through a client portal – manages candidates. Doneforyou is offered exclusively to businesses.
2. What Doneforyou Ads does
With Doneforyou Ads, the Ads tab in the app, agencies publish the job ads they created in Doneforyou directly on Facebook and Instagram – in their own Meta ad account and on behalf of their own Facebook Page.
Doneforyou is not an ad account and does not buy media for you. The ads run in your ad account and you pay Meta directly using the payment method stored with Meta. Doneforyou never asks for your Facebook password or any other Meta login credentials.
3. Connecting your ad account and Page
- Sign-in through Meta: You connect using “Facebook Login for Business”. A Meta window opens; you sign in directly with Meta and choose which ad accounts and Facebook Pages Doneforyou may use. Doneforyou never sees your password.
- Business integration: The connection is set up as a business integration in your Meta Business portfolio. For this, Meta usually issues Doneforyou an access token for a system user. A Meta Business portfolio is therefore required.
- Selection: You then select the ad account and the Facebook Page for your ads in Doneforyou. To help you pick the right Page, we show its name, profile picture, category and follower count.
4. Running and tracking job ads
- Special ad category “Employment”: Doneforyou always creates job ads in the special ad category Employment (
EMPLOYMENT). Meta's anti-discrimination rules therefore apply: age range 18 to 65+, all genders, and a location radius of at least 15 km. - Dry run: You can first create a campaign in paused state. It is fully set up in your ad account but does not spend any money until you publish it.
- Control: You publish, pause and end campaigns directly from Doneforyou.
- Reporting: The dashboard shows spend, reach, impressions and clicks, as well as the review status of your ads at Meta, including any rejection reason.
5. Permissions and how we use them
Doneforyou only requests the permissions needed for the features described above:
| Permission | How we use it |
|---|---|
ads_management | To create, publish, pause and end campaigns, ad sets, creatives and ads in your ad account – in the name of the selected Facebook Page. |
ads_read | To retrieve the status, review status (including rejection reason) and metrics of your ads and show them in the dashboard. |
business_management | To retrieve the ad accounts and Pages of your Business portfolio that you granted during the connection, and to operate the business integration with the system user. |
pages_show_list | To list the Facebook Pages you manage so you can choose which Page the ads run under. |
pages_read_engagement | To read the Page's name, profile picture, category, follower count and any linked Instagram account so you can identify the right Page. |
public_profile | To retrieve your name and app-scoped user ID so we can link the connection to your Doneforyou account. |
6. Data we process
- Connection: app-scoped Meta user ID or system user ID, your name on Facebook, the business ID of your Business portfolio, the access token (stored encrypted only) and its expiry date.
- Ad accounts: ID, name, status and currency.
- Facebook Pages: ID, name, profile picture URL, category, follower/fan count and, where applicable, the linked Instagram account with its ID and username.
- Your selection: the selected ad account and Page and the most recently used payer information under the Digital Services Act (DSA).
- Per campaign: the Meta IDs of the campaign, ad set, creatives and ads, the settings, DSA information (beneficiary, payer), status and review status including any rejection note, and aggregated metrics (spend, impressions, reach, clicks). We do not receive data about individual people who see or click your ads.
- Technical log: type, success or error and time of each call to the Meta API – without access tokens or content – to monitor error rates and rate limits.
We send Meta the campaign settings, the selected ad images and ad copy, the link to the job application page and the DSA information. We do not send applicant data to Meta. Full details are in our Privacy Policy.
7. Purpose and no sharing
We use data from Meta solely to create and manage ads on the agency's behalf and to show it the results. We do not share or sell this data, do not use it for our own advertising, and do not use it to train AI models. We do not send data received from Meta to AI services.
8. Retention
- We keep the connection and access token until you disconnect, remove Doneforyou in Facebook, request deletion through Facebook, or delete your account.
- Campaign data stays in your account until you delete the campaign or your account, or request deletion through Facebook.
- We delete data from Meta as soon as it is no longer needed for its purpose, and whenever Meta requests it.
9. Disconnecting
You can disconnect at any time: in Doneforyou, click “Disconnect” (“Trennen”) in the Ads tab, or go to Settings → Connections → Meta. If you like, we pause all running ads first. When you disconnect, we revoke our permissions at Meta (DELETE /me/permissions) and delete the access token immediately. Campaigns already published remain in your Meta ad account.
10. Data deletion
To have the data Doneforyou received from Meta deleted, you can:
- disconnect in Doneforyou (see above),
- remove Doneforyou in Facebook under Settings & privacy → Settings → Business integrations (or “Apps and websites”) and request deletion there,
- email [email protected], or
- delete your Doneforyou account (Settings → Delete account).
If you request deletion through Facebook, we automatically delete the connection and all of your agency's campaign records, and you receive a confirmation code with a status page. See the full data deletion instructions.
11. Security
- Access tokens are stored encrypted only (AES-256-GCM); the encryption key is kept separately from the database in the server environment.
- All connections are encrypted via HTTPS. Calls to the Meta API are additionally signed with
appsecret_proof. - Only authorized personnel have access to systems and data.
- We never ask for your Facebook password or any other Meta login credentials.
Found a vulnerability? Please report it to [email protected]. We review every report and will get back to you. Our security contact is also published in security.txt.
12. Contact
WHITEACADEMY Birger Weiß
Owner: Birger Weiß
Zur alten Ziegelei 10a
48607 Ochtrup, Germany
Email: [email protected]
See also our Imprint and Privacy Policy.