HelloAgencyAI Meta App Review Submission Record

Submitted evidence model

Fresh action, returned result, durable receipt

The previous package relied on preloaded proof and a rename-only management action. The corrected reviewer console begins every permission lane empty, requires the reviewer to run the named action, shows loading and success states, and stores a sanitized one-hour receipt. Runtime scope is labeled as capability evidence—not permission approval.

Use case

Business purpose

HelloAgencyAI is an internal agency operations application used by trained advertising staff to work with business assets that the agency owns or a client grants through Meta Business Manager. The app verifies the connected business and assigned assets, lets an operator select the correct Facebook Page, reads Page engagement context, runs advertising reports, and creates a human-authorized campaign in an allowlisted ad account. The separate Ads MCP feature lets the same operator use Meta's hosted Ads MCP tools from an AI-assisted workflow. Reviewer write demonstrations are campaign-only, make no activation call, and report success only after exact-ID status=PAUSED and effective_status=PAUSED verification.

Authorization

System-user and MCP grant explanation

The conventional Marketing API lane is a server-to-server Business Manager/system-user integration using a server-held SYSTEM_USER authorization that a Meta Business administrator assigns to HelloAgencyAI and the allowlisted business assets before review. The separate Ads MCP workflow uses a USER OAuth connection established through Facebook Login for Business with PKCE and the required Ads MCP scopes. That connection is preauthorized before review, so the reviewer does not need Facebook or Business Manager credentials or need to repeat the grant. In the Ads MCP lane, Check preauthorized MCP connection displays a sanitized authorization receipt; Discover Ads MCP tools displays the required tool names; and Run MCP account read displays the allowlisted MO_Maximizer account and masked ID. No access token or app secret is returned to the browser.

Submitted conventional requests

Narrow descriptions that match the app

business_management

Business access description

HelloAgencyAI needs business_management so an authorized agency operator can verify the Meta business portfolio and allowlisted ad account before using Page, reporting, or campaign workflows. Open

https://helloagencyai.com/meta/#business-management

Click Verify business access. The app makes a fresh server-side request using its preassigned SYSTEM_USER authorization and displays a timestamped sanitized receipt containing the connected business, masked business ID, total authorized ad-account count, and the allowlisted MO_Maximizer account with masked ID and verified client-granted relationship. Other client identities are withheld. The browser cannot submit an arbitrary business ID or change an asset assignment.

pages_show_list

Assigned Page list description

HelloAgencyAI needs pages_show_list so an authorized agency operator can load the Facebook Pages assigned to the connected business and select the correct client Page for the next workflow. Open

https://helloagencyai.com/meta/#pages-show-list

Click Load assigned Pages. The app makes a fresh Page-list request, shows the total authorized Page count, and displays one configured review-safe Page with its name, masked ID, category, and assigned tasks. Other client Page identities are withheld. Select the displayed Page and click Use selected Page. That selection controls the pages_read_engagement request below; it is not a decorative selector. The app does not publish or change Page settings.

pages_read_engagement

Selected Page engagement description

HelloAgencyAI needs pages_read_engagement so an authorized agency operator can verify the selected client Page and review current Page and recent-post engagement before planning advertising. The demonstrated asset is the configured New Motion Physical Therapy Inc. PS client Page granted to the connected business.

Reviewer path:
1. Open

https://helloagencyai.com/meta/#coverage

Click Check authorization context and confirm the fresh SYSTEM_USER receipt. The reviewer needs no Meta or Business Manager credentials.
2. Open

https://helloagencyai.com/meta/#pages-show-list

Click Load assigned Pages, select the configured New Motion Physical Therapy Inc. PS Page, and click Use selected Page.
3. Open

https://helloagencyai.com/meta/#pages-read-engagement

Click Read selected Page engagement.

The app makes fresh read-only requests and displays a timestamped receipt with the Page name, masked ID, category, current live follower and fan counts, and talking-about count, which may be 0. Recent Page-post rows show reactions, comments, shares, publication timestamps, and Facebook permalinks. The app does not publish, edit, or delete Page content.

The attached 44-second app-only recording shows: 0:00 fresh authorization; 0:11 load and select the Page; 0:18 run the fresh engagement read; 0:23 Page identity and counters; 0:28 the truthful returned zero; 0:31 the recent-post summary; and 0:35 an engaged post row with its public-post link.

ads_read

Advertising report description

HelloAgencyAI needs ads_read so authorized agency operators can report on and audit campaigns in an agency-owned or client-granted ad account. First open

https://helloagencyai.com/meta/#coverage

Click Check authorization context and confirm the SYSTEM_USER, connected business, and runtime capability receipt. Then open

https://helloagencyai.com/meta/#ads-read

Keep the prefilled January 19-20, 2026 review range for the labeled allowlisted MO_Maximizer account and click Run ads report. The app makes a fresh read-only request and displays the account label and masked ID, requested date range, populated spend, impressions, clicks, reach, delivery rows, and a separate current campaign-object table with masked IDs and statuses. The browser submits only a server-issued account reference and dates; it cannot submit an arbitrary Meta account ID. This action does not create or change an advertising object.

ads_management

PAUSED campaign creation description

HelloAgencyAI uses ads_management in its internal campaign workflow for agency-owned and client-granted ad accounts. Authorized agency operators use the app to create a PAUSED campaign draft in the correct client account and receive an auditable receipt before any downstream configuration or activation. ads_management is required because ads_read cannot create a campaign.

Reviewer console:
https://helloagencyai.com/meta/#ads-management

Each reviewer request creates exactly one campaign in the server-allowlisted MO_Maximizer account. The server controls the account, campaign-name prefix, objective, and status=PAUSED. The browser submits only the private reviewer code and a server-issued idempotency key. Success appears only after Meta returns the new campaign ID and HelloAgencyAI reads that exact ID back as status=PAUSED and effective_status=PAUSED. The sanitized receipt remains visible after an immediate reload.

This workflow does not create an ad set, ad, creative, budget, targeting, placement, destination, activation, delivery, or spend. It uses preassigned SYSTEM_USER authorization, so the reviewer does not need Facebook or Business Manager credentials.

Separate feature request

ads_mcp_management

Ads MCP is a separate evidence lane with its own USER OAuth connection and uninterrupted end-to-end recording. It does not replace the conventional permissions.

ads_mcp_management

Ads MCP allowed-usage description

HelloAgencyAI uses ads_mcp_management so authorized agency operators can use Meta's hosted Ads MCP to inspect a client-granted ad account and, only after explicit human approval, create one PAUSED campaign draft. This feature is separate from the app's conventional SYSTEM_USER Marketing API workflows.

Reviewer console:
https://helloagencyai.com/meta/#ads-mcp-management

The App Review video is a clarity-corrected derivative of one uninterrupted HelloAgencyAI-initiated browser recording. It begins with a fresh Facebook Login for Business authorization-code flow using Meta's "Continue with previous settings" confirmation, not a new interactive asset-selection step. In the same session it shows the HelloAgencyAI callback; the matched USER authorization with all required scopes; the connected business and allowlisted MO_Maximizer account; Ads MCP tool discovery; a real account read; masked reviewer-code entry; explicit human approval; exactly one PAUSED campaign creation; exact-ID status=PAUSED and effective_status=PAUSED readback; the new receipt; and immediate-reload persistence.

The recorder masks unrelated identity during Meta consent. One disclosed post-capture pointer correction moves the final reload highlight onto the matching newly created receipt row; it does not replace or alter workflow evidence. No source frames were cut, joined, inserted, reused, reordered, sped up, or condensed, and no control or current-run result is obscured.

For reviewer reproduction, the connection is preauthorized; no Meta credentials or repeat consent are required. The server fixes the account, name, objective, and PAUSED status, never retries campaign creation, and does not create an ad set, ad, creative, targeting, placement, activation, delivery, or spend.

Reviewer code:
[PRIVATE REVIEWER CODE - INSERT ACTUAL VALUE ONLY IN META'S AUTHENTICATED DESCRIPTION]

Boundary

Ads MCP versus conventional permissions

ads_mcp_management authorizes the HelloAgencyAI AI-assisted experience to use Meta's hosted Ads MCP server through its separate USER OAuth connection. It does not replace ads_read, ads_management, business_management, pages_show_list, or Page permissions used by the conventional SYSTEM_USER workflows. The Ads MCP section separately demonstrates “Preauthorized connection verified,” authenticated tool discovery, a real MO_Maximizer account read, explicit human approval, one PAUSED MCP campaign creation, exact-ID PAUSED/PAUSED readback, and a durable sanitized receipt. It never calls an activation tool or endpoint.

Required feature renewals

Current production use

Marketing API Access Tier

Renewal description

HelloAgencyAI uses the Marketing API for production workflows on agency-owned and client-authorized Meta assets. Authorized internal operators verify business access, load assigned Pages, read Page engagement, run advertising reports, and create server-controlled PAUSED campaign drafts after explicit operator action.

The conventional workflow uses server-held SYSTEM_USER authorization and server allowlists. Tokens are never returned to the browser. The reviewer console at https://helloagencyai.com/meta/ demonstrates each permission as a fresh action with a timestamped sanitized receipt.

Ads MCP is a separate USER OAuth integration and is not used as evidence for this Marketing API renewal.

public_profile

Renewal description

HelloAgencyAI uses public_profile only as standard identity context for the authorized Meta Business user who establishes the separate Ads MCP USER OAuth connection. The app uses the app-scoped user identity and token validation to bind that authorized user to an encrypted server-side connection.

HelloAgencyAI does not use public_profile to build consumer profiles, sell personal data, or personalize unrelated experiences. The conventional SYSTEM_USER Marketing API workflows do not rely on consumer Facebook Login.

Data handling

Reviewer-ready policy answers

Facebook Login

Is Facebook Login integrated?

Yes, for the Ads MCP workflow only. HelloAgencyAI uses Facebook Login for Business with an authorization-code and PKCE flow to establish the separate USER OAuth connection required by Meta's hosted Ads MCP server. The conventional business, Page, reporting, and campaign workflows use preassigned SYSTEM_USER authorization and do not present a login flow. The Ads MCP reviewer connection is preauthorized before review, so the reviewer does not need to enter Facebook or Business Manager credentials or repeat consent.

Processor

Service provider and retention

Cloudflare, Inc. provides hosting, edge delivery, and supporting data processing for the HelloAgencyAI website and reviewer APIs. HelloAgencyAI stores only the minimum operational data needed for authorized agency workflows and security/audit records. Reviewer-facing successful action and campaign receipts display for one hour, while underlying security and audit records are retained according to the published privacy and deletion policies. Meta access tokens and app secrets remain in server-only secret storage and are never returned to the browser.

Legal URLs

Privacy and deletion resources

Privacy Policy
https://helloagencyai.com/privacy-policy/

Terms of Service
https://helloagencyai.com/terms-of-service/

User Data Deletion Instructions
https://helloagencyai.com/user-data-deletion/

Authenticated Meta testing fields

Reviewer instructions

Conventional workflows

Permission-specific testing instructions

The five conventional permissions use the preassigned SYSTEM_USER authorization. Use the matching attached video and steps for the permission under review:

business_management — Open https://helloagencyai.com/meta/#business-management and click Verify business access. Confirm a fresh receipt for the connected business, total authorized ad-account count, and client-granted MO_Maximizer account with masked IDs.

pages_show_list — Open https://helloagencyai.com/meta/#pages-show-list and click Load assigned Pages. Confirm the authorized Page count and configured review-safe Page, then select that Page and click Use selected Page.

pages_read_engagement — Open

https://helloagencyai.com/meta/#coverage

and click Check authorization context. Then open

https://helloagencyai.com/meta/#pages-show-list

Click Load assigned Pages, select the configured New Motion Physical Therapy Inc. PS Page, and click Use selected Page. Open

https://helloagencyai.com/meta/#pages-read-engagement

and click Read selected Page engagement. Confirm the fresh timestamped receipt shows the Page name, masked ID, category, current live follower and fan counts, a talking-about count that may be 0, and recent Page-post rows with reactions, comments, shares, publication timestamps, and Facebook permalinks.

ads_read — Open

https://helloagencyai.com/meta/#coverage

Click Check authorization context and confirm the SYSTEM_USER, connected business, and runtime capability receipt. Then open

https://helloagencyai.com/meta/#ads-read

Keep the prefilled January 19-20, 2026 range for MO_Maximizer, then click Run ads report. Confirm the account, range, populated metrics and delivery rows, timestamp, and separate current campaign-object table.

ads_management — Open

https://helloagencyai.com/meta/#ads-management

Confirm the SYSTEM_USER authorization context, MO_Maximizer account, and server-owned PAUSED policy. Wait until the final preflight is ready and the create button is enabled. Note the current receipt count, then enter the private reviewer code below:

[PRIVATE REVIEWER CODE — INSERT ONLY IN META'S AUTHENTICATED FIELD]

Click Create PAUSED review campaign. Confirm one new masked campaign ID and exact-ID status=PAUSED; effective_status=PAUSED. Confirm the receipt count increases by one and the newest row matches the new campaign and review run. Reload immediately and confirm the same row remains under Created by this app — last 1 hour. Reload proves receipt persistence and does not create another campaign.

Ads MCP workflow

Testing instructions

1. Open

https://helloagencyai.com/meta/#ads-mcp-management

The Ads MCP connection is already authorized. You do not need Facebook or Business Manager credentials or need to repeat consent.

2. Click Check preauthorized MCP connection. Confirm "Preauthorized connection verified" and an Authorization verified receipt showing the matched HelloAgencyAI USER connection, all required scopes, the connected business, and the allowlisted MO_Maximizer account. No token is exposed.

3. Click Discover Ads MCP tools. Confirm the fresh receipt includes ads_create_campaign.

4. Click Run MCP account read. Confirm the fresh read receipt returns MO_Maximizer and its masked ID.

5. Enter the private reviewer code supplied in Meta's dedicated access-code field:

[PRIVATE REVIEWER CODE - INSERT ONLY IN META'S AUTHENTICATED FIELD]

Check the human-approval box and click Create PAUSED campaign through Ads MCP.

6. Confirm one new masked campaign ID and a separate exact-ID readback of status=PAUSED and effective_status=PAUSED. If Meta is still propagating the object, enter the code again and click Refresh Ads MCP receipts once; this is read-only and cannot create another campaign.

7. Confirm the new row appears under "Created through Ads MCP - last 1 hour." Reload immediately and confirm the same row remains visible. Reload does not create another campaign.

The App Review video follows this workflow from fresh OAuth through reload. It preserves one uninterrupted source recording with in-session privacy masks and one disclosed final-row pointer correction only: no cuts, joins, reordered or reused frames, speed changes, or condensed pauses.

Access code

Dedicated reviewer-code field

Open https://helloagencyai.com/meta/ and follow the testing instructions. When the ads_management or ads_mcp_management step requests the private reviewer code, enter:

[PRIVATE REVIEWER CODE — INSERT ONLY IN META'S AUTHENTICATED FIELD]

No payment, membership, Meta App Dashboard access, or Business Manager credentials are required. The Ads MCP reviewer connection is already authorized, so the reviewer is not asked to sign in or repeat consent.

Attached evidence

Final attached recordings

Conventional clips

One focused video per permission

The submitted package includes one focused app-only 1920×1080 clip for each conventional permission: five separate clips in total. Each attached clip begins at its named URL with an empty action state, briefly confirms the SYSTEM_USER authorization context, performs only the named action, and leaves the fresh result fully visible:

business_management — The attached clip verifies business access and shows the connected business, authorized ad-account count, and client-granted MO_Maximizer receipt.

pages_show_list — The attached clip loads assigned Pages, shows the authorized Page count and configured review-safe Page, selects that Page, and uses the selected Page.

pages_read_engagement — The final attached 44-second clip begins with a fresh authorization check, loads and selects the configured New Motion Physical Therapy Inc. PS client Page, runs Read selected Page engagement, and shows its name, masked ID, category, current live follower and fan counts, talking-about count, timestamp, and recent Page-post rows with reactions, comments, shares, publication timestamps, and Facebook permalinks. Timecodes: 0:00 authorization; 0:11 Page load and selection; 0:18 fresh engagement read; 0:23 identity and counters; 0:28 truthful zero; 0:31 post summary; 0:35 engaged post row.

ads_read — The attached clip keeps the prefilled January 19-20, 2026 range for MO_Maximizer, runs the report, and shows populated metrics, delivery rows, and current campaign-object readback.

ads_management — The attached clip enters the masked reviewer code, creates one PAUSED campaign, and shows the masked returned ID, exact-ID PAUSED/PAUSED readback, new receipt row, and the same row after immediate reload.

Captions do not cover controls or returned results. The five permissions remain in separate clips, and the evidence does not claim ad-set, ad, creative, budget, targeting, placement, destination, activation, or spend creation.

Ads MCP clip

Final continuous MCP walkthrough

The submitted package includes the separate 1920x1080 Ads MCP video. It is derived from one uninterrupted source recording; the in-session privacy masks and one post-capture final-row pointer correction are disclosed, and the timeline has no cuts, joins, inserted or reused frames, reordering, acceleration, or condensed pauses.

It begins at the HelloAgencyAI administrator OAuth setup, shows Facebook Login for Business consent through Meta's "Continue with previous settings" confirmation, returns to HelloAgencyAI in the same session, and shows the sanitized matched-app, USER-token, required-scope, connected-business, and MO_Maximizer authorization receipt. It continues through required-tool discovery, a real MO_Maximizer account read, explicit human approval, masked reviewer-code entry, one server-controlled PAUSED campaign creation, separate exact-ID status=PAUSED and effective_status=PAUSED readback, the new receipt row, and the same receipt after immediate reload.

The pointer correction only aligns the final reload outline with the same matching receipt row already visible in the source; it does not hide a control or result. Reviewer reproduction starts at https://helloagencyai.com/meta/#ads-mcp-management and uses the app's current preauthorized connection. HelloAgencyAI never calls an activation tool or endpoint and never retries campaign creation.

Submission verification

Completed submission record

Verified Explicit authorization was received before Submit for review was used.

Verified Meta submission 1765534041106249 now shows Review in progress.

Verified Six new requests are present: business_management, pages_show_list, pages_read_engagement, ads_read, ads_management, and ads_mcp_management.

Verified Marketing API Access Tier and the public_profile renewal are included with the submission.

Verified Each conventional action begins empty and produces a fresh timestamped receipt.

Verified Page and ad-account selectors change the exact downstream request; no control is decorative.

Verified ads_management creates one campaign and proves the exact returned ID as PAUSED/PAUSED.

Verified Conventional receipts and Ads MCP receipts persist after immediate reload.

Verified One uninterrupted Ads MCP source shows previous-settings consent, USER OAuth evidence, tools/list, one real read, human approval, one create, exact-ID PAUSED/PAUSED readback, and reload persistence.

Verified Each conventional permission has its own focused 1080p clip; Ads MCP has a separate clip; captions cover no action or result.

Verified The actual reviewer code exists only in Meta's authenticated fields and server secret storage.

Verified Public site, source, video, manifests, and local context contain zero copies of the actual code.

Verified Conventional permissions and Ads MCP were submitted as separate evidence lanes.

Reviewer submission record

Fresh action, returned result, durable receipt

Business purpose

System-user and MCP grant explanation

Narrow descriptions that match the app

Business access description

Assigned Page list description

Selected Page engagement description

Advertising report description

PAUSED campaign creation description

ads_mcp_management

Ads MCP allowed-usage description

Ads MCP versus conventional permissions

Current production use

Renewal description

Renewal description

Reviewer-ready policy answers

Is Facebook Login integrated?

Service provider and retention

Privacy and deletion resources

Reviewer instructions

Permission-specific testing instructions

Testing instructions

Dedicated reviewer-code field

Final attached recordings

One focused video per permission

Final continuous MCP walkthrough

Completed submission record