Meta App Review preparation

Submission answers and copy bank

This page mirrors the practical Meta submission flow for the HelloAgencyAI Marketing API app. Each answer is written so the team can copy it into the real Meta App Review form after the final readiness gate passes.

App HelloAgencyAI

App ID 228821948110807

Use case Create and manage ads with Marketing API

Reviewer demo https://helloagencyai.com/meta/

Copy controls

Use these answers in page order inside Meta App Review.

Previous submission lessons

What this page is preparing for

Marketing API Access Tier call volume is no longer treated as a blocker: Meta dashboard evidence shows 709 Marketing API calls against the 500-call gate. The feature is still pending App Review approval, so also confirm that the live reviewer demo agrees with these answers; do not paste copy that is stronger than the current /meta/ evidence.

Page 1

Use case and app purpose

Choose the Marketing API create/manage ads use case and explain the internal agency workflow.

Page 2

Permissions and features

Request the required Marketing API permissions and describe why each one is needed.

Page 3

Data handling

Describe Meta business, Page, ad account, campaign, and insight data handling.

Page 4

Testing and screencasts

Point reviewers to the read-only demo and upload walkthrough clips that match it exactly.

Reviewer note

Previous rejection lesson to keep in every submission field

HelloAgencyAI is an internal agency operations app that uses Meta Business Manager asset assignment and a system-user token. It is not a consumer-facing Facebook Login app. The reviewer walkthrough therefore shows the Business Manager grant path, the authorized business/Page/ad account readbacks, and the exact app screens where each requested permission is used. The app only works with owned or client-authorized business assets, and any ad-management proof is kept paused or read-only unless a human explicitly approves the change.

Meta form page 1

Use case and app details

Use case

Which use case should be selected?

Create and manage ads with Marketing API.

App purpose

Describe what the app does

HelloAgencyAI is an internal agency operations app for advertising teams that manage authorized client Meta advertising assets. The app helps agency operators validate the connected Meta business portfolio, select the correct Facebook Page and ad account, read campaign and ad performance, prepare campaign/ad set/ad/creative changes, and keep a reviewer-visible audit trail. It supports the agency's day-to-day advertising workflow by using Meta Business Manager asset grants and system-user tokens for server-to-server Marketing API operations.

Who uses it

Who are the app users?

The app is used by trained internal agency operators at HelloAgencyAI and The Contractors Marketing who are responsible for client advertising setup, audit, reporting, and campaign maintenance. It is not available as a public consumer app. Access is limited to authorized staff and authorized client business assets that have been assigned through Meta Business Manager.

Authorization

Explain the login or authorization flow

HelloAgencyAI uses Meta Business Manager authorization rather than a public consumer Facebook Login flow. The business installs the app, assigns the relevant business assets to an authorized system user, and issues a HelloAgencyAI-scoped system-user token. The reviewer demo explains this server-to-server flow and shows the resulting authorized business, Page, ad account, campaign, ad, creative, and insight readbacks. Tokens and app secrets are never exposed in the browser.

Reviewer access

Testing instructions or test credentials

No username or password is required for the public reviewer walkthrough because this is an internal server-to-server app, not a public Facebook Login app. Reviewers can open https://helloagencyai.com/meta/ and inspect the review console. The console shows the app identity, system-user authorization context, connected business portfolio, assigned Page, Page engagement metrics, authorized ad account readback, campaign/ad object readbacks, campaign-level insight metrics, paused ad-management proof status, and audit log. The Ads section labels the permission-specific proof accounts: ads_read uses an authorized reporting account with real insight rows, while ads_management uses The Contractors Marketing account for the paused proof asset. The page does not expose tokens or run public browser writes. Before submission, verify that the live console reports Ready with no blockers and that the ads_management proof panel shows a PAUSED proof asset.

Evidence gate

What must be true before these answers are pasted?

Before submitting, verify the live reviewer demo and API evidence match the submission answers. The /api/meta/review-data endpoint should report ok=true, no blockers, the required permissions present, at least one successful API read for each requested advanced permission within 30 days, usable ads_read insight rows from the configured reporting proof account, and ads.managementProof.found=true with status=PAUSED and effective_status=PAUSED from the configured paused proof account. Marketing API Access Tier call volume is treated as satisfied because Meta dashboard evidence shows 709 Marketing API calls, above the 500-call requirement. Confirm the request edit page does not show a new error-rate warning before final submission.

Meta form page 2

Permission and feature answers

business_management

Why does the app need business_management?

HelloAgencyAI needs business_management to validate and manage the Meta business assets that have been assigned to the agency by the owning business. The app reads the authorized business portfolio, ad accounts, Pages, and related asset access before an agency operator performs campaign setup or reporting. This prevents work from being performed against the wrong business, Page, or ad account and supports the required Marketing API workflow for client-authorized ad management. The reviewer demo shows the business portfolio and assigned asset readbacks in the Assets and Evidence sections.

pages_show_list

Why does the app need pages_show_list?

HelloAgencyAI needs pages_show_list so the app can list the Facebook Pages assigned to the agency system user through Meta Business Manager and select the correct Page for an advertising workflow. The selected Page is used as the ad identity and is checked before campaign/ad setup. This is required so agency operators do not attach ads to the wrong Page. The reviewer demo shows the assigned Page list, selected Page, and Page-to-ad workflow in the Pages section.

pages_read_engagement

Why does the app need pages_read_engagement?

HelloAgencyAI needs pages_read_engagement to read basic Page engagement context for an authorized Facebook Page before campaign planning and ad setup. The app uses Page profile and engagement metrics such as followers, fans, and talking-about count to confirm Page health and provide advertising context. It does not use this permission to publish organic Page content from the reviewer demo. The reviewer demo shows the selected Page metrics and the evidence row for pages_read_engagement.

ads_read

Why does the app need ads_read?

HelloAgencyAI needs ads_read to read authorized ad account performance and object data for reporting, auditing, campaign readiness checks, and optimization planning. The app reads ad account metadata, campaigns, ad sets, ads, creatives, and Ads Insights metrics such as spend, impressions, clicks, and reach. This lets agency operators review campaign health and confirm existing account state before recommending or preparing changes. The reviewer demo shows campaign-level insight rows and campaign/ad object readbacks from an authorized reporting proof account. The paused ads_management proof may appear on a different authorized account because The Contractors Marketing account currently proves the paused write/readback flow but has no historical delivery metrics.

ads_management

Why does the app need ads_management?

HelloAgencyAI needs ads_management so authorized agency operators can create and update campaign, ad set, ad, creative, URL, placement, and paused draft settings for client-approved advertising workflows. The app is designed with human approval gates and review-safe controls: public reviewer pages do not run browser-side writes, proof assets must remain paused, and no active delivery or budget increase is triggered from the demo. The reviewer demo should show the paused ad setup form, placement controls, a PAUSED ad-management proof readback, and an audit log explaining the paused/no-active-delivery safety policy. Do not submit this permission while the live proof panel says the paused proof asset is missing.

Marketing API Access Tier

Why request Full Access?

HelloAgencyAI requests Marketing API Full Access so the app can reliably support legitimate production-volume Marketing API workflows for authorized agency client ad accounts. The app reads and manages authorized ad assets through server-to-server API calls, including account validation, campaign and ad object readbacks, insights reporting, and human-approved paused campaign/ad changes. Full Access is needed to reduce development-tier rate limits once the app is used across authorized client accounts. Meta dashboard evidence shows 709 Marketing API calls, which satisfies the 500-call volume gate; the feature remains pending App Review approval.

public_profile

If Meta asks about public_profile renewal or verification

public_profile is used only as the standard identity permission associated with Meta authorization and token validation. HelloAgencyAI does not use public_profile to build consumer profiles, sell user data, or personalize unrelated experiences. In this server-to-server Business Manager workflow, the app uses token debug and app-scoped authorization context to confirm the token belongs to HelloAgencyAI and that the system user has the required business, Page, and advertising scopes.

Meta form page 3

Data handling answers

Data accessed

What data does the app access?

HelloAgencyAI accesses only the Meta business and advertising data needed for authorized agency operations. This can include business portfolio metadata, assigned Page names and IDs, Page profile and engagement metrics, ad account IDs and status, campaign/ad set/ad/creative metadata, placement settings, destination URLs, and Ads Insights metrics such as spend, impressions, clicks, and reach. The app does not request unrelated personal profile data and does not use Meta data for consumer profiling.

Purpose

How is Meta data used?

Meta data is used to validate authorized business assets, confirm the correct Facebook Page and ad account, read campaign performance, prepare advertising recommendations, create or update human-approved paused ad assets, and maintain an audit trail for agency operators and authorized clients. Data is used only for the advertising, reporting, audit, and campaign-management workflows the client or owning business has authorized.

Retention

How long is data retained?

HelloAgencyAI retains Meta platform data only as long as needed for the authorized agency workflow, client reporting, troubleshooting, compliance, and audit history. Operational records may include redacted asset identifiers, campaign/ad names, status, performance summaries, and approval history. If access is revoked or a deletion request is received, retained data is deleted or de-identified unless a legal, security, or accounting obligation requires limited retention.

Sharing

Is Meta data shared or sold?

HelloAgencyAI does not sell Meta platform data. Data is shared only with authorized agency personnel, the client or business that owns or authorized the assets, and service providers that are necessary to operate, secure, host, or support the app. Any service provider use is limited to providing the app workflow and support services.

Legal URLs

Privacy, terms, and deletion URLs

Privacy Policy: https://helloagencyai.com/privacy-policy/
Terms of Service: https://helloagencyai.com/terms-of-service/
User Data Deletion Instructions: https://helloagencyai.com/user-data-deletion/
Reviewer Demo: https://helloagencyai.com/meta/

Meta form page 4

Screencast and reviewer walkthrough copy

Overall script

Use for the main screencast description

The screencast opens https://helloagencyai.com/meta/ and shows the HelloAgencyAI internal agency operations console. It explains that the app uses Meta Business Manager asset assignment and a system-user token rather than a public Facebook Login flow. The walkthrough then shows the authorized business portfolio, assigned Facebook Page, Page engagement metrics, permission-specific ad account readbacks, campaign/ad object readbacks, Ads Insights metrics from the reporting proof account, paused ad-management proof from The Contractors Marketing account, and the evidence/audit log that maps each requested permission to the app screen where it is used.

Recording quality

Use for every uploaded screencast

Record each clip at 1080p or better, in English, with the browser window large enough for reviewers to read the UI. Use visible mouse interactions, show the page URL, and add captions or on-screen notes where the system-user grant path differs from a normal public Facebook Login flow. Do not rely on audio for required context. Each clip should show the permission or feature being granted through Meta Business Manager/system-user authorization where applicable, then show the exact HelloAgencyAI screen where the app uses that permission and displays the resulting data or paused action.

Clip 1

business_management recording notes

Open https://helloagencyai.com/meta/. Show the app identity and system-user authorization context. In the Assets section, click Refresh assets and show the connected business portfolio, ad account, Page, and asset access table. Explain that these assets were assigned through Meta Business Manager and that business_management is used to validate the authorized business assets before any ad workflow begins.

Clip 2

pages_show_list recording notes

Open the Pages section of https://helloagencyai.com/meta/. Show the selected Facebook Page and the Page count/readback. Explain that pages_show_list is used to list the Pages assigned to the system user through Meta Business Manager so the operator can bind the correct Page to ad identity and campaign setup.

Clip 3

pages_read_engagement recording notes

Stay in the Pages section. Show the selected Page metrics such as followers, fan count, and talking-about count. Then show the evidence row for Page metrics readback / pages_read_engagement. Explain that this read-only engagement context is used to validate Page health before ad setup and that recent Page posts are optional context, not required for the paused ad workflow.

Clip 4

ads_read recording notes

Open the Ads section. Show the ads_read proof account, spend, impressions, clicks, reach, date range, and campaign-level insight rows. Show campaign and ad object readbacks from the same authorized reporting account and the same system-user proof path. Explain that ads_read is used for read-only reporting, audits, and campaign readiness checks before operators prepare any changes. If the paused ads_management proof account is different, point out that the demo labels the split and keeps each permission tied to the account that has the right evidence.

Clip 5

ads_management recording notes

Open the Ads section and show the paused ad setup form, campaign/ad set fields, budget control, placement checkboxes, and creative preview. Show the live ads_management proof panel only after it displays a PAUSED proof asset, then show the evidence log. Explain that approved server-side proof creates or updates only paused review assets, public browser pages do not run writes, human approval is required, and no active delivery or budget change is triggered from the reviewer demo.

Clip 6

Marketing API Access Tier recording notes

Show the Meta dashboard evidence that Marketing API Access Tier has 709 API calls, above the 500-call requirement, and that the feature is pending App Review approval. Then show https://helloagencyai.com/meta/ Evidence and Ads sections, including the live readback endpoint, campaign/ad object readbacks, insights proof, and audit log. Explain that Full Access is requested for legitimate production-volume agency workflows across authorized client ad accounts.

Before clicking submit

Final submit gate

Marketing API Access Tier shows 709 calls, above the 500-call gate. Meta request edit page shows no new error-rate warning. At least one successful API call for each requested advanced permission was made within 30 days. /meta/ reviewer demo shows live API status ready. /api/meta/review-data has no blockers, reports usable ads_read rows from the reporting proof account, and reports ads.managementProof as found and PAUSED. ads_management proof panel shows a paused proof asset, not a missing-proof warning. Screencasts are 1080p or better, in English, readable, and do not rely on audio. All screencasts match the live demo and mention system-user authorization. Privacy, terms, and deletion URLs are configured in the Meta dashboard.

Final notes

Paste into any final reviewer notes field

HelloAgencyAI is a private agency operations app for authorized Meta advertising workflows. The app uses Meta Business Manager asset assignment and HelloAgencyAI-scoped system-user tokens. It does not expose tokens in the browser and does not use a public consumer Facebook Login flow. The reviewer demo at https://helloagencyai.com/meta/ shows the business, Page, Page engagement, ad account, ads_read, paused ads_management, and evidence-log workflows that correspond to the requested permissions. All ad-management proof must be paused or read-only, and no active delivery is triggered from the public reviewer page. This final note should be pasted only after the live demo and API evidence show no blockers.