Campaigns

Google requires a Developer Token to access the Google Ads API. Standard access is granted after review and requires demonstrating a working integration. Basic access has lower limits; you must apply for Standard access once ready to scale. The review process takes 2–4 weeks and is not guaranteed on the first submission.

Meta's Marketing API requires app review to unlock advanced features like ad creation and management at scale. Unreviewed apps have significant rate limits and restricted capabilities. App review involves submitting a detailed use-case description and a screencast of the integration. Budget at least 2–4 weeks for approval and potential resubmission.

Each managed client account requires valid billing and must comply with Google's advertising policies. New accounts may undergo automatic policy review before ads are approved to serve. B2B lead generation verticals sometimes trigger additional scrutiny. Prepare compliant landing pages and ad copy before going live.

Cold email at scale requires dedicated sending domains that are never used for primary business communication. Domain age matters for deliverability — providers use domain registration date as a trust signal. Each client campaign should use unique sending domains to isolate reputation. Plan to register domains well in advance of any campaign launch. Annual registration fees apply per domain and scale linearly with your domain portfolio.

New mailboxes must be warmed up gradually to build sender reputation with email providers. Sending too many emails too soon causes immediate deliverability problems and potential blacklisting. A proper warmup runs 6–8 weeks before any real outreach and requires automated warmup tooling. Tooling costs are subscription-based and priced by the number of active mailboxes. Each mailbox tops out at roughly 30–50 sends per day safely.

Every sending domain requires SPF, DKIM, and DMARC records configured correctly. Missing or misconfigured records cause immediate spam filtering or rejection. DMARC policy should be set to quarantine or reject with a reporting address. Cloudflare DNS management makes this repeatable via API or Terraform. Each domain also needs MX records pointed to its mail provider.

Cold email volume is constrained by mailbox count and warmup status. Each warmed mailbox can safely send 30–50 emails per day. To reach 1,000 sends per day you need 20–35 active warmed mailboxes. Each mailbox needs its own domain or subdomain. Plan domain purchases and warmup starts around target go-live volume.

All domains should be added to a single Cloudflare account and organized by purpose: landing page domains, sending domains, and the primary platform domain. Use Cloudflare Workers and Pages for landing page hosting. Zones can be managed programmatically via API, enabling automated provisioning as new client campaigns are onboarded. The Cloudflare free tier covers most DNS needs; paid plans unlock advanced features at usage-based pricing.

Ad platforms require landing page domains to match or be related to the advertiser's business domain. Using unrelated or suspicious domains triggers policy flags. Landing pages for cold email click tracking must use separate domains from email sending domains to avoid triggering spam filters when both are scanned together. Plan a clear domain naming convention before onboarding clients.

Google and Meta use machine learning to optimize ad delivery. New campaigns enter a "learning phase" of 1–2 weeks where performance is unstable. Significant budget, targeting, or creative changes reset the learning phase. The system should surface learning phase status and prevent users from making disruptive edits during this window without warnings.

Both Google and Meta have native A/B (Experiment) features that split traffic in a statistically controlled way. Using native experiments is preferred over manual split-testing because it avoids auction interference. Tests need enough volume to reach significance — low-budget campaigns may take 3–4 weeks to produce meaningful results. The system should manage experiment state and flag when tests reach significance.

Platforms can overspend daily budgets by up to 100% on high-demand days, reconciling over the monthly billing period. This can cause cash flow issues if clients are billed on exact daily spend. The system should track cumulative spend against monthly targets and surface pacing alerts before overspend occurs. Budget changes mid-month can affect pacing calculations.

Ad creatives lose effectiveness as audiences repeatedly see the same content. Meta surfaces a "creative fatigue" signal in the API. Google's frequency data requires manual calculation. The system should track frequency, CTR trends, and fatigue signals to prompt creative rotation before performance drops significantly.

The permission model complexity should scale with user count. At 1–30 users, a simple role system (Admin, Manager, Viewer) is sufficient. At 30–100 users, per-client access scoping becomes necessary. Over 100 users requires full RBAC with custom roles, audit logging, and granular resource permissions. Design the data model to support all tiers from the start, even if only simple roles are exposed initially.

Two users editing the same campaign simultaneously can cause race conditions that result in lost changes or conflicting platform state. Optimistic locking with last-write-wins is acceptable at small scale, but can cause silent data loss. For teams over 10 users, pessimistic locking (claim-to-edit) or operational transform should be implemented. At minimum, show who is currently editing a campaign.

Agency clients often need to approve copy and creative before campaigns go live. Without a built-in approval flow, teams use ad hoc email threads and spreadsheets, creating compliance risk and miscommunication. A lightweight review state (Draft, In Review, Approved, Published) covers most agency use cases without over-engineering.

Google Ads and Meta Ads reporting data is delayed by 2–3 hours and subject to late attribution revisions for up to 28 days (Meta) or 90 days (Google conversions). Users must understand they are not seeing real-time performance. The system should display data freshness timestamps and set appropriate expectations in the UI. Always-on polling is not effective — schedule syncs at sensible intervals.

Apache Iceberg on object storage (R2) is optimized for analytical batch queries, not interactive sub-second responses. Cold queries on large tables can take 30 seconds to several minutes depending on file count and partition pruning efficiency. The dashboard must use pre-aggregated summary tables or materialized views for any data shown on page load. Raw Iceberg tables should be used only for export or deep analysis.

Reply ingestion is not handled by most cold email sending tools by default. Out-of-office replies, unsubscribe requests, and interested leads all arrive in the sending mailbox and require automated parsing to route correctly. Unsubscribes must be processed within 10 days under CAN-SPAM and 2 days under CASL. Implement polling or webhook-based reply ingestion from the sending mailbox provider.

US (CAN-SPAM): B2B cold email is permissible with a physical address, clear sender identification, and working unsubscribe. Canada (CASL): requires express or implied consent — much stricter than CAN-SPAM. EU/UK (GDPR/PECR): requires legitimate interest basis and individual unsubscribe rights for every recipient. Australia (Spam Act): similar consent requirements to CASL. Each client's target geography must be confirmed before campaign launch to apply the correct compliance rules.

Google and Meta have detailed advertising policies covering prohibited content, restricted categories, and destination requirements. Financial services, healthcare, and employment verticals require additional certifications on both platforms. Violations result in ad disapprovals, account suspensions, and in severe cases, permanent bans. Each client vertical should be screened before API credentials are used to create campaigns.

Contact lists and audience data uploaded to ad platforms (Custom Audiences) are subject to Meta's and Google's data use policies, which require confirming the data was collected with appropriate consent. Storing raw PII in the system also creates GDPR/CCPA obligations. Email addresses should be hashed before platform upload. The system should not retain contact data longer than needed for the active campaign.

Cloudflare Workers, R2, D1, KV, and Queues are all usage-based services. At low volume the costs are minimal; as client count and data volume grow, costs scale proportionally. The largest variable costs are R2 storage for Iceberg data (priced per GB stored and per operation) and Workers invocations for data pipeline jobs. Monitor usage via Cloudflare Analytics and set billing alerts. Infrastructure costs should be factored into client pricing to ensure margin.

Key third-party tools include mailbox warmup tooling (subscription-based, priced by active mailbox volume), cold email sequencing software (subscription-based, priced by volume or seats), data enrichment APIs (priced per lookup or per record), and optional AI/LLM services for copy generation (priced per token or per generation). All are variable costs that grow with client campaigns. Evaluate open-source alternatives and batch API calls to manage costs at scale.

Domain registrations are a recurring annual cost that scales directly with campaign count. Each client campaign may require several dedicated sending domains and at least one landing page domain. Annual registration fees apply per domain and should be tracked as a per-client overhead. Consolidate registrations under Cloudflare Registrar to benefit from at-cost pricing and centralized DNS management. Budget renewal costs annually.