‹ Caitlin's SandboxCONCEPT · NOT BUILT · FIGURES ARE ILLUSTRATIVE

Lead forms are reusable, so they belong to the client, on a new Forms tab beside Library and Targeting. A form is just questions and wording, not personal data. The people who fill it in never pass through Snifferdog™.

Clients › Calderbrook UniversityFacebook Page: Calderbrook University · lead ads terms accepted
ProfileProjectsLibraryTargetingFormsSettings
✓Leads go straight to you. Snifferdog™ builds your forms and tells you how many leads you've had. The leads themselves go from Meta, TikTok and Google directly to you, and we never see them.

Lead forms

FormPlatformsQuestionsLeads go toUsed in
January intake enquiry
Version 2 · version 1 locked after leads came in
Meta, Google5Tested2 campaigns
Open evening sign-up
Created 3 Oct
Meta, TikTok4Not tested yetNot used yet

One builder, sent to each platform in its own format: a Meta Instant Form on the client's Facebook Page, a Google lead form, and a TikTok instant form where TikTok allows it. The preview shows Meta's version.

Intro
QuestionsFewer questions, more leads
Prefilled by Meta
Prefilled by Meta
This question asks for health information, which is special category data. Platforms restrict sensitive questions on lead forms, and it's the kind of data the client would need a specific legal basis to collect. Ask about it after they've enquired, not in an ad form.
Privacy and thank-you screen
The privacy link must be the client's own, because they're the ones collecting the data.
Once a form has received leads, Meta won't let it be edited. Changes create a new version, and the old one keeps working until it's swapped out.
Calderbrook University · Sponsored

Start your Masters in January

Full name
Email
Which course are you interested in? ▾
When would you like to start? ▾
By submitting, you agree to Calderbrook University's privacy policy.
Submit

Part of the pre-launch checklist for any campaign with a lead form. Snifferdog™ helps the client point each platform's leads at their own inbox or CRM, then checks it with a test lead. The leads never touch our servers.

Calderbrook - January Intake › Pre-launch checks › Where leads go1 of 3 platforms still to test
Meta✓ Test lead received
✓Leads appear in Meta Leads Center for the Calderbrook University Page, and can be downloaded there.
✓Connected to HubSpot through Meta's own CRM integration. Manage in Meta
GoogleNot tested yet
Google sends each lead straight to this address. Snifferdog™ only saves the address so it can set it up for you; it never receives the leads.
TikTok✓ Test lead received
✓Leads download from TikTok Ads Manager. Connect a CRM in TikTok
Download windows are limited on some platforms, so leads left there too long can be lost. If the client doesn't connect a CRM, Snifferdog™ reminds them to download leads regularly.

Snifferdog™ can still tell the client when leads come in, using the lead counts from normal reporting. The email has numbers and links, never names or answers. Counts can lag a few hours behind, so this is a nudge, not a live feed.

From: Snifferdog™ · To: admissions@calderbrook.ac.uk

4 new leads for January Intake today

Meta3
Google1
Cost per lead this week£14.80

Open them where they arrived: Meta Leads Center · your CRM

For your privacy, Snifferdog™ never sees lead details, so they aren't in this email.

Lead alerts
Send to
Campaign or adPlatformLeadsCost per lead
January Intake · Campus videoMeta41£12.90
January Intake · ScholarshipsMeta17£18.20
January Intake · Lead formGoogle9£21.40

Lead counts in the Analytics tab come from each platform's normal reporting (API-09), with no personal data. Understanding analytics

Read this first: GDPR

Lead generation is the one concept that brings Snifferdog™ close to personal data. Even with the platform-direct approach, nothing here should be built until it has been through the solicitor, and that will be a long and detailed conversation, not a quick sign-off. Expect it to take weeks, cover the privacy policy, terms, a data processing agreement and the Security & Trust page, and to need decisions from the board. Budget for that before promising lead features to anyone, including Cubed.

Decisions so far

  • Leads go straight from each platform to the client. Snifferdog™ does not receive, store, forward or email lead details.
  • Snifferdog™ builds the forms (API-21, 22), which are questions and wording, not personal data, and shows lead counts from normal reporting (API-09).
  • Lead alerts use counts only: “4 new leads, open them in Meta”. No names, no answers.
  • Out of this concept: the lead inbox (API-41) and CSV export (API-08). They need Snifferdog™ to hold personal data and should only come back with a decision from the board.
  • Forms live on the client, on a new Forms tab beside Library and Targeting.

Why counts-only matters

Sending an email that contains a lead's name means the data has passed through us. That is processing under UK GDPR even if nothing is stored. It would also require Meta's lead retrieval permission, which goes through Meta's app review. Counts come from ordinary reporting, so they avoid both.

For the solicitor (even the platform-direct version)

  1. Our role. Confirm that building forms and setting up delivery, without ever receiving leads, keeps Snifferdog™ out of processing lead data. Where exactly is the line?
  2. Webhook details. We'd store the client's CRM webhook address and key to set up Google delivery. Is that a security matter only, or more?
  3. Sensitive questions. What must Snifferdog™ stop clients asking? Health (including disability), ethnicity, religion and the like are special category data. Cubed's healthcare clients make this real, not theoretical.
  4. Privacy policy links. Every form needs the client's own policy. Do we check it exists, or just require a link?
  5. Terms of Service. Wording that makes the client the controller of their leads and responsible for their lawful basis.
  6. Marketing claims. Can we say “we never see your leads” on the site and in sales, and what must be true for that to hold?

If the inbox ever comes back

  • Meta's lead retrieval permission through app review, plus Page access. Approval can take weeks, so it would need applying for well ahead.
  • Meta only keeps leads retrievable for a limited time (90 days per the sheet), so leads must be pulled promptly and reliably.
  • Snifferdog™ becomes a processor holding personal data: a data processing agreement with every client, retention and deletion rules, subject access and erasure requests, breach procedures, encryption, access logging, and checking the ICO registration covers it.
  • The “we don't store your ad data” position, and the Security & Trust page, would need rewriting.

Platform notes

MetaGoogleTikTok
Build the formInstant Form on the client's Facebook Page. Needs Page access and the Page's lead ads terms accepted. Forms can't be edited once leads arrive.Lead form asset on the campaign.TO CONFIRM whether forms can be created through the API, or only picked once built in TikTok.
Where leads goLeads Center and Meta's own CRM integrations, set up in Meta. TO CONFIRM how much can be set up through the API.Webhook straight to the client's CRM, configurable on the form. Also downloadable in Google Ads for a limited time.Download in Ads Manager, plus TikTok's CRM options. TO CONFIRM details.
Lead countsStandard reporting result types on all three. No personal data, no special permission.

Open questions for the devs

  • TikTok instant forms through the API.
  • How much of Meta's lead delivery setup is possible without sending the user into Meta.
  • How fresh lead counts are on each platform, to set expectations for alerts.
  • How to send a test lead on each platform and confirm it arrived.

Help Centre

  • To write: “Where your leads go (and why we never see them)”, “Building a lead form”, “Questions you shouldn't ask on a lead form”.

Written 9 Oct 2026. This is not legal advice; it's a list of what the solicitor needs to look at.