Going to reprint here for those that are shy about visiting the facebook.com domain:

Effective Date: May 25, 2018. To view the current Custom Audience Terms, click here

Custom Audiences Terms

Facebook’s custom audiences feature enables you to create an audience using your data such as email addresses and phone numbers. When using Facebook’s custom audiences feature, your data is locally hashed on your system before you upload and pass such data to Facebook to be used to create your custom audience (the “Hashed Data”). Without limiting any agreement between you and Facebook, by clicking “I accept,” passing to Facebook the Hashed Data, or using custom audiences or advertising, you agree to the following:

You represent and warrant, without limiting anything in these terms, that you have all necessary rights and permissions and a lawful basis to disclose and use the Hashed Data in compliance with all applicable laws, regulations, and industry guidelines. If you are using a Facebook identifier to create a custom audience, you must have obtained the identifier directly from the data subject in compliance with these terms.

If you are providing Hashed Data on behalf of an advertiser, you must upload the Hashed Data directly into the advertiser’s advertising accounts. You agree to use only that advertiser’s own data to create custom audiences and not to augment or supplement the data with other data except as expressly authorized by Facebook. You represent and warrant that you have the authority as agent to the advertiser to disclose and use such data on their behalf and will bind the advertiser to these terms.

You represent and warrant that the Hashed Data does not relate to data about any individual who has exercised an option that you have, directly or indirectly, committed to honoring or provided to opt out of having that data disclosed and used by you or on your behalf for targeted advertising. To the extent an individual exercises such an opt-out after you have used data relating to that individual to create a custom audience, you will remove that data subject from the custom audience.

You instruct Facebook to use the Hashed Data for the matching process. Facebook will not share the Hashed Data with third parties or other advertisers and will delete the Hashed Data promptly after the match process is complete. Facebook will maintain the confidentiality and security of the Hashed Data and the collection of Facebook User IDs that comprise the custom audience(s) created from your Hashed Data (“your custom audience(s)”), including by maintaining technical and physical safeguards that are designed to (a) protect the security and integrity of data while it is within Facebook's systems and (b) guard against the accidental or unauthorized access, use, alteration or disclosure of data within Facebook's systems.

Facebook will not give access to or information about the custom audience(s) to third parties or other advertisers, use your custom audience(s) to append to the information we have about our users or build interest-based profiles, or use your custom audience(s) except to provide services to you, unless we have your permission or are required to do so by law.

Facebook may modify, suspend or terminate access to, or discontinue the availability of, the custom audiences feature at any time. You may discontinue your use of the custom audiences feature at any time. You may delete your custom audience(s) from the Facebook system at any time through your account tools.

You may not use the custom audiences feature unless you are an advertiser (or an agency acting on behalf of an advertiser), Ads API or Custom Audiences API partner, a data partner uploading an advertiser’s audience on behalf of that advertiser, or have obtained express, written permission from Facebook.

You may not sell or transfer custom audiences, or authorize any third party to sell or transfer custom audiences.

A note to EU and Swiss data controllers: To the extent the Hashed Data contains personal data relating to an individual who resides in the European Union or Switzerland, the parties acknowledge and agree that for purposes of creating the custom audiences, as described above, that you are the data controller in respect of such personal data, and you have instructed Facebook Ireland Limited to process such personal data on your behalf as your data processor pursuant to these terms and Facebook’s Data Processing Terms, which are incorporated herein by reference. You hereby acknowledge and agree that Facebook, Inc. may act as a sub-processor for and on behalf of Facebook Ireland Limited for the purpose of fulfilling Facebook Ireland Limited’s obligations under these Custom Audiences Terms. “Personal data,” “data controller,” and “data processor” in this paragraph have the meanings set out in the General Data Protection Regulation (Regulation (EU) 2016/679).

These Custom Audiences Terms and, to the extent applicable, the Data Processing Terms, govern the provision by you of Hashed Data to us and your use of the custom audiences feature, and your use of custom audiences for advertising. They do not replace any terms applicable to your purchase of advertising inventory from Facebook (including but not limited to the Facebook Advertising Guidelines at https://www.facebook.com/ad_guidelines.php), and such terms will continue to apply to your ad campaigns targeted to your custom audience. The custom audiences feature is part of “Facebook” under Facebook’s Terms of Service (https://www.facebook.com/legal/terms, the “Terms”), and your use of the custom audiences feature (including your use of data) is deemed part of your use of, and actions on, “Facebook.” In the event of any express conflict between these Custom Audiences Terms and the Terms, these Custom Audiences Terms will govern solely with respect to your use of the custom audiences feature and solely to the extent of the conflict. Facebook reserves the right to monitor or audit your compliance with these terms and to update these terms from time to time.

Last Modified April 4, 2018