Meta App Review preparation

Submission prep archive

This page mirrors the Signal Meta App Review submission pattern drafted on July 8, 2026. Public copy keeps private proof codes redacted while preserving the reviewer workflow.

App Signal

App ID 647183340477512

Drafted July 8, 2026

Reviewer demo https://signal.helloagencyai.com/meta/

Copy controls

Draft reviewer answers, with private proof code redacted from this public page.

Drafted on July 8, 2026

What this page records

This archive reflects the Signal submission draft before Meta form entry. URLs are kept on their own line where this public page controls formatting so punctuation cannot become part of a copied link. The private ads_management proof code belongs in Meta's private reviewer instructions and is intentionally redacted here.

Gate 1

Permission narratives drafted

All requested permission and feature descriptions are staged with reviewer proof links.

Gate 2

Per-permission videos to record

Each requested permission should have a matching walkthrough video in the Meta form.

Gate 3

Reviewer overview planned

The optional supporting MP4 should explain the public console and system-user flow.

Gate 4

Private proof code redacted

Meta should receive the private code; this public archive only records where it belongs.

Reviewer note

Previous rejection lesson to keep in every submission field

Signal is an internal agency operations app that uses Meta Business Manager asset assignment and a system-user token. It is not a consumer-facing Facebook Login app. Because this is a server-to-server/system-user implementation, the reviewer walkthrough shows the Business Manager grant path, the authorized business/Page/ad account readbacks, and the exact app screens where each requested permission is used. The app only works with owned or client-authorized business assets, and any ad-management proof is kept paused or read-only unless a human explicitly approves the change.

Resubmission note

How the prior rejection was corrected

This Signal submission follows the corrected TCM and HelloAgencyAI review pattern. First, Signal has its own scheduled daily clean Marketing API reads, and before submitting the current Meta App Review request/edit page and App Dashboard evidence must show 500+ Marketing API calls in the past 15 days and no active Ads API error-rate warning for the last 500 calls. Second, the submission screencast must demonstrate the end-to-end system-user workflow: Business Manager authorization/asset assignment, the app-scoped system-user token context, the authorized business/Page/ad account readbacks, and the exact Signal UI section where each requested permission or feature is used. Since this is a server-to-server Marketing API app, there is no public consumer Facebook Login button or browser OAuth dialog in the reviewer demo.

Meta form page 1

Use case and app details

Use case

Which use case should be selected?

Create and manage ads with Marketing API.

App purpose

Describe what the app does

Signal is an internal agency operations app for advertising teams that manage authorized client Meta advertising assets. The app helps agency operators validate the connected Meta business portfolio, select the correct Facebook Page and ad account, read campaign and ad performance, prepare campaign/ad set/ad/creative changes, and keep a reviewer-visible audit trail. It supports the agency's day-to-day advertising workflow by using Meta Business Manager asset grants and system-user tokens for server-to-server Marketing API operations.

Who uses it

Who are the app users?

The app is used by trained internal agency operators at HelloAgencyAI and The Contractors Marketing who are responsible for client advertising setup, audit, reporting, and campaign maintenance. It is not available as a public consumer app. Access is limited to authorized staff and authorized client business assets that have been assigned through Meta Business Manager.

Authorization

Explain the login or authorization flow

Signal uses Meta Business Manager and system-user authorization rather than a public consumer Facebook Login flow. The business installs the app, assigns the relevant business assets to an authorized system user, grants the required app permissions and asset tasks, and issues a Signal-scoped system-user token. The reviewer recording shows the Business Manager/admin grant path, asset assignment, masked app-scoped token readback, and the resulting authorized business, Page, ad account, campaign, ad, creative, and insight readbacks. Because this is a server-to-server system-user flow, a frontend Meta Login authentication dialog is not visible in the app UI. Tokens and app secrets are never exposed in the browser.

Reviewer access

Testing instructions or test credentials

Open

https://signal.helloagencyai.com/meta/

This is the Signal reviewer console for the Meta-connected app. No username or password is required.

The app uses Meta Business Manager asset assignment and a system-user token rather than a public Facebook Login flow. The page shows redacted live readbacks from preauthorized business assets and maps each requested permission to a reviewer-visible section:

business_management:

https://signal.helloagencyai.com/meta/#business-management

pages_show_list:

https://signal.helloagencyai.com/meta/#pages-show-list

pages_read_engagement:

https://signal.helloagencyai.com/meta/#pages-read-engagement

ads_read:

https://signal.helloagencyai.com/meta/#ads-read

ads_management:

https://signal.helloagencyai.com/meta/#ads-management

Tokens and app secrets are not exposed in the browser.

Access codes

Payment, membership, or test credential field

No payment, membership, username, or password is required to access the reviewer console.

For the ads_management proof action only, use the private proof access code provided in the Meta submission. The code is redacted from this public archive.

Open

https://signal.helloagencyai.com/meta/#ads-management

Enter the proof access code, and click Run paused proof update. If the panel shows IN_PROCESS, wait and click Open live readback until the campaign, ad set, and ad all show PAUSED/PAUSED before running the proof action.

Download payment

Paid download / app store field

Not applicable. This is a web-based reviewer console, not a paid downloadable app.

Geo access

Geographic restrictions field

Not applicable. The reviewer console is publicly accessible and is not intentionally restricted by geography.

Supporting docs

Uploaded supporting documentation

signal-reviewer-overview-screencast-2026-07-08-1080p.mp4

Facebook Login

Is Facebook Login integrated on this platform?

No

Evidence gate

What must be true before these answers are pasted?

Before submitting, verify the live reviewer demo and API evidence match the submission answers. The /api/meta/signal/review-data endpoint should report ok=true, no blockers, the required permissions present, at least one successful API read for each requested advanced permission within 30 days, usable ads_read insight rows from the configured reporting proof account, and ads.managementProof.readyForReviewerAction=true with campaign, ad set, and ad status=PAUSED and effectiveStatus=PAUSED from the configured paused proof account. The scheduled daily Marketing API reads are the operational proof source, but the same-day Meta App Review request/edit page must still show at least 500 Marketing API calls in the past 15 days and no active last-500-call error-rate warning.

Meta form page 2

Permission and feature answers

business_management

Why does the app need business_management?

Signal needs business_management to validate the Meta business portfolio and assigned assets that an agency operator is authorized to use before campaign setup, reporting, or ad-management workflows. The app reads the authorized business portfolio, assigned Pages, assigned ad accounts, and related asset access state. This prevents operators from preparing work against the wrong business, Page, or ad account, and ties each advertising workflow to assets that were granted through Meta Business Manager. The business_management proof console is available at

https://signal.helloagencyai.com/meta/#business-management

The screencast shows the Signal-scoped system-user grant context, the verified business portfolio, assigned asset table, ad account readback, selected Page readback, and operations evidence log. This permission is used only for authorized business asset validation and ad-management context. The public demo does not claim ad accounts, change asset assignments, expose tokens, or modify Business Manager settings.

pages_show_list

Why does the app need pages_show_list?

Signal needs pages_show_list to read the Facebook Pages assigned to the authorized business/system user and let agency operators select the correct client Page before ad setup, Page engagement checks, and campaign planning. The app uses pages_show_list to display only Business Manager-assigned Pages for the connected business. It reads Page name, masked Page ID, category, and assignment context so the operator can confirm the correct Page identity before the app uses that Page for ad identity, placement planning, pages_read_engagement checks, and ads_management workflows. The pages_show_list proof console is available at

https://signal.helloagencyai.com/meta/#pages-show-list

The screencast shows the Business Manager-assigned Page list, selected Page readback, masked Page ID, assigned asset table, and operations evidence log. This permission is used read-only to list and select authorized Pages. The app does not create Pages, publish Page content, change Page settings, or expose Pages that have not been assigned through Business Manager.

pages_read_engagement

Why does the app need pages_read_engagement?

Signal needs pages_read_engagement to read Page profile and engagement context for an authorized Facebook Page before campaign planning and ad setup. The app uses Page metadata and engagement metrics, such as follower count, fan count, and talking-about count, to confirm that the correct Business Manager-assigned Page is active and usable as the advertising identity. The app uses this permission only for authorized agency workflow needs, including Page validation, ad identity checks, and campaign planning context. It does not publish, edit, or delete Page content, and it does not use Page content for unrelated consumer profiling. The pages_read_engagement proof console is available at

https://signal.helloagencyai.com/meta/#pages-read-engagement

It shows the selected Business Manager-assigned Page, live Page metrics readback, the Page/content signal table, and the operations evidence row for pages_read_engagement. The submission also includes pages_show_list so the app can list and select the authorized Page before reading its engagement context. Open

https://signal.helloagencyai.com/meta/#pages-read-engagement

and confirm the selected Page, live Page metrics readback, Page/content signal table, and operations evidence row for pages_read_engagement.

ads_read

Why does the app need ads_read?

Provide API access to your ad performance data for use in custom dashboards and data analytics. Signal needs ads_read to read authorized Ads Manager ad account data for reporting, auditing, campaign readiness checks, and optimization planning. The app reads ad account metadata, campaigns, ad sets, ads, creatives, and Ads Insights metrics such as spend, impressions, clicks, and reach. This lets authorized agency operators review account health, understand performance trends, and confirm existing campaign state before recommending or preparing changes. The ads_read proof console is available at

https://signal.helloagencyai.com/meta/#ads-read

The screencast shows the app viewing authorized Ads Manager account data from the reporting proof account, including spend, impressions, clicks, reach, campaign-level insight rows, masked campaign IDs, and campaign/ad object readbacks. This permission is used read-only for reporting and audit views. The app does not create, update, or modify ads through ads_read. The ads_management proof may appear separately because write-proof testing is intentionally isolated to a paused proof account, while ads_read uses the account with real historical delivery metrics.

ads_management

Why does the app need ads_management?

Signal needs ads_management so authorized agency operators can create and update campaign, ad set, ad, creative, URL, placement, and draft settings for client-approved advertising workflows. The app uses ads_management to manage ad objects for agency-owned or client-granted ad accounts. In production, these workflows support preparing and updating ads after human approval. For App Review safety, the demo uses a controlled PAUSED proof asset so the permission can be tested without triggering delivery or spend. The ads_management proof console is available at

https://signal.helloagencyai.com/meta/#ads-management

It shows the paused ad setup form, placement controls, live ads_management proof readback, proof access code field, and operations evidence log. The proof-code-gated action uses ads_management to perform a name-only update on the single configured proof ad. Before running, the server verifies that exactly one proof ad exists and that the proof ad, ad set, and campaign are already PAUSED. After the update, the app immediately reads the proof ad back and shows status=PAUSED and effective_status=PAUSED. The demo does not change budget, audience, URL, creative, placement, or delivery status. Open

https://signal.helloagencyai.com/meta/#ads-management

Enter the proof access code provided in Meta's private reviewer instructions. The code must be included in Meta private reviewer instructions and is redacted from this public archive. Click Run paused proof update. Confirm the result shows status=PAUSED and effective_status=PAUSED.

Marketing API Access Tier

Why request Full Access?

Signal requests Marketing API Full Access so the app can reliably support legitimate production-volume Marketing API workflows for authorized agency client ad accounts. The app reads and manages authorized ad assets through server-to-server API calls, including account validation, campaign and ad object readbacks, insights reporting, and human-approved paused campaign/ad changes. Full Access is necessary because the app is used by internal agency operators to manage multiple authorized client advertising workflows, and development-tier limits are not sufficient once these workflows run across authorized business assets and ad accounts. The reviewer demo is available at

https://signal.helloagencyai.com/meta/

It shows the Marketing API workflow, ads_read reporting proof at

https://signal.helloagencyai.com/meta/#ads-read

and ads_management paused-management proof at

https://signal.helloagencyai.com/meta/#ads-management

The app only works with owned or client-authorized business assets granted through Meta Business Manager. Any management proof remains PAUSED and human-approved; the reviewer-gated proof action can only rename one PAUSED proof ad and then read it back as PAUSED.

public_profile

If Meta asks about public_profile renewal or verification

public_profile is used only as the standard identity permission associated with Meta authorization and token validation. Signal does not use public_profile to build consumer profiles, sell user data, or personalize unrelated experiences. In this server-to-server Business Manager workflow, the app uses token debug and app-scoped authorization context to confirm the token belongs to Signal and that the system user has the required business, Page, and advertising scopes.

Meta form page 3

Data handling answers

processor-0

Do data processors or service providers access Platform Data?

Yes

processor-2

Listed processor or service provider

Cloudflare, Inc.

Service category:
IT solutions and services, including cloud storage and processing

Processing country:
United States of America

responsible-1

Responsible person or entity

The Contractors Marketing

Country:
United States of America

requests-3/4

Public authority requests and controls

Have you provided the personal data or personal information of users to public authorities in response to national security requests in the past 12 months?
No

Policies or processes in place:
Provisions for challenging these requests if they are considered unlawful.
Data minimization policy - the ability to disclose the minimum information necessary.
Documentation of these requests, including your responses to the requests and the legal reasoning and actors involved.
Required review of the legality of these requests.

Legal URLs

Privacy, terms, and deletion URLs

Privacy Policy

https://helloagencyai.com/privacy-policy/

Terms of Service

https://helloagencyai.com/terms-of-service/

User Data Deletion Instructions

https://helloagencyai.com/user-data-deletion/

Reviewer Demo

https://signal.helloagencyai.com/meta/

Meta form page 4

Screencast and reviewer walkthrough copy

Overall script

Use for the main screencast description

The screencast opens with the Meta App Dashboard/Business Manager context and shows that Signal is a server-to-server Marketing API app using Meta Business Manager asset assignment and a system-user token rather than a public consumer Facebook Login flow.

It then opens

https://signal.helloagencyai.com/meta/

and shows the Signal internal agency operations console. The walkthrough demonstrates the authorized business portfolio, assigned Facebook Page, Page engagement metrics, permission-specific ad account readbacks, campaign/ad object readbacks, Ads Insights metrics from the reporting proof account, paused ad-management proof from The Contractors Marketing account, the proof-code-gated paused campaign proof update, and the evidence/audit log that maps each requested permission to the app screen where it is used. The recording also shows current Marketing API Access Tier evidence from the same-day Meta request/edit page: 500+ calls in the past 15 days and no active last-500-call error-rate warning.

Recording quality

Use for every uploaded screencast

Record each clip at 1080p or better, in English, with the browser window large enough for reviewers to read the UI. Use visible mouse interactions, show the page URL, and add captions or on-screen notes where the system-user grant path differs from a normal public Facebook Login flow. Do not rely on audio for required context. Each clip should show how the permission or feature is granted through Meta Business Manager/system-user authorization where applicable, then show the exact Signal screen where the app uses that permission and displays the resulting data or paused action. Do not submit a static demo-only video; the recording must show the grant context plus app usage for each requested permission/feature.

Clip 1

business_management recording notes

Start by showing the Business Manager/system-user grant context or a redacted App Dashboard view that explains the app is authorized through a system user rather than public Facebook Login. Then open

https://signal.helloagencyai.com/meta/#business-management

Show the app identity and system-user authorization context, click Refresh assets, and show the connected business portfolio, ad account, Page, and asset access table. Explain that these assets were assigned through Meta Business Manager and that business_management is used to validate the authorized business assets before any ad workflow begins.

Clip 2

pages_show_list recording notes

Open

https://signal.helloagencyai.com/meta/#pages-show-list

Show the system-user authorization context, selected Facebook Page, masked Page ID/category/tasks, and the Page count/readback. Explain that pages_show_list is used to list the Pages assigned to the system user through Meta Business Manager so the operator can bind the correct Page to ad identity and campaign setup. If this is uploaded as a standalone clip, repeat the caption that there is no browser OAuth dialog because this is a server-to-server system-user app.

Clip 3

pages_read_engagement recording notes

Open

https://signal.helloagencyai.com/meta/#pages-read-engagement

Show the selected Page metrics such as followers, fan count, and talking-about count. Then show the evidence row for Page metrics readback / pages_read_engagement. Explain that this read-only engagement context is used to validate Page health before ad setup and that recent Page posts are optional context, not required for the paused ad workflow. If this is uploaded as a standalone clip, include the system-user grant caption before showing the Page metrics.

Clip 4

ads_read recording notes

Open

https://signal.helloagencyai.com/meta/#ads-read

Show the system-user authorization context, ads_read proof account, spend, impressions, clicks, reach, date range, and campaign-level insight rows. Show campaign and ad object readbacks from the same authorized reporting account and the same system-user proof path. Explain that ads_read is used for read-only reporting, audits, and campaign readiness checks before operators prepare any changes. If the paused ads_management proof account is different, point out that the demo labels the split and keeps each permission tied to the account that has the right evidence.

Clip 5

ads_management recording notes

Open

https://signal.helloagencyai.com/meta/#ads-management

Show the system-user authorization context, paused ad setup form, campaign/ad set fields, budget control, placement checkboxes, and creative preview. Enter the private reviewer proof access code from the Meta testing instructions and click Run paused proof update. Show the result message with the proof campaign name update, then show the live ads_management proof panel and evidence log with campaign, ad set, and ad status=PAUSED and effectiveStatus=PAUSED. Explain that the server-side action is proof-code-gated, can only rename the parent configured PAUSED proof campaign, refuses to run unless exactly one proof ad exists and the proof campaign, ad set, and ad are already paused, blocks while Meta shows IN_PROCESS, and does not change status, budget, audience, creative, URL, placements, or delivery.

Clip 6

Marketing API Access Tier recording notes

Show the current Meta App Dashboard/App Review request-edit evidence that Marketing API Access Tier has 500+ Marketing API calls in the past 15 days and no active error-rate warning for the last 500 calls. Mention that the app now has scheduled daily clean Marketing API reads, but do not use the old rejected submission video as the sole evidence.

Then show

https://signal.helloagencyai.com/meta/

Evidence and Ads sections, including the live readback endpoint, campaign/ad object readbacks, insights proof, paused management proof, and audit log. Explain that Full Access is requested for legitimate production-volume agency workflows across authorized client ad accounts.