Legal — Legal & Privacy Policy

Publisher & data controller

Data we collect

We collect only what is needed to run the service:

• Account data — email address and authentication identifiers, managed by our authentication provider when you sign up or sign in.
• Billing data — subscription status and billing period, synchronized from Stripe, our payment provider. We never see or store your card number.
• Ad platform connections — OAuth access tokens for the ad accounts you choose to connect, stored encrypted (AES-256-GCM). We never know your platform passwords.
• Paused campaigns created on your explicit request — their IDs, status and date, and the review of their ads by each platform (Google, Microsoft, Pinterest, Reddit, Snapchat and TikTok: approved, under review or disapproved, with the reason given by the platform), read automatically for 30 days after sending, as long as your access to AdsFellow is open.
• Content you generate — briefs, Campaign Plans, ad copy and visuals you choose to save.
• Technical data — error logs and anti-abuse counters (rate limits, daily limits). Your email does not appear in our logs.
• Audience measurement — analytics statistics (Google Analytics), only if you accept it via the cookie banner.

We do not sell or rent any personal data, to anyone, ever.

Purposes & legal bases (GDPR art. 6)

Each processing activity relies on a legal basis:

• Providing the service (account, generation, exports, metrics, paused creation of campaigns in your ad accounts on your request, and checking how the platform reviewed their ads) — performance of the contract.
• Billing and subscription management — performance of the contract and legal obligations.
• Security, fraud and abuse prevention (rate limits, encryption, monitoring) — legitimate interest.
• Reminder emails after a subscription ends (2 at most, to remind you that your Plans are waiting) — legitimate interest; each reminder, like the welcome email, contains a link to stop receiving them.
• Audience measurement — your consent, which you can withdraw at any time via the cookie banner.

Processors (named sub-processors)

We share personal data only with the technical sub-processors required to run AdsFellow. All are bound by GDPR data processing agreements. No personal data is sold or rented, to anyone, ever.

• Clerk Inc. (USA) — account creation, sign-in and session management.
• Stripe Inc. (USA) and Stripe Payments Ireland Ltd. (Ireland) — our payment provider: it collects subscription payments on our behalf and keeps, for your invoices, your business address and its VAT number if you give it. We never see or store your card number.
• Vercel Inc. (USA) — hosting of the site and its functions (run in the European Union, in Frankfurt) and global delivery; transient processing of all incoming and outgoing requests; storage of the images and videos of your Kits.
• Neon Inc. (USA; database hosted in the European Union, in Frankfurt) — managed PostgreSQL database; persistent storage of your account data, encrypted OAuth tokens, Campaign Plans and saved assets.
• Upstash Inc. (USA; data in the European Union, in Ireland) — Redis cache, rate limiting and webhook idempotency. No persistent personal data.
• Functional Software Inc., dba Sentry (USA; data hosted in the European Union, in Germany) — error monitoring. We add neither your name nor your email address to reports; reports from our servers are stripped of sign-in codes, tokens and secret keys before sending.
• Google LLC (USA) — paid Gemini API: generation of your ad copy and visuals from your briefs and, when you run an “AI Flash Audit”, analysis of the figures of a Google Ads or Meta account (spend, impressions, clicks, conversions), without its name or number. Google keeps these requests and their responses for 55 days, solely to detect abuse, and does not use them to improve its products. Google Analytics for audience measurement, only with your consent.
• Resend Inc. (USA; emails sent from the European Union, in Ireland) — sending AdsFellow's emails (welcome, reminders, cancellation confirmation, expired connection, account deletion confirmation, free Campaign Plan, and the alert sent to our support when you click “Alert support” on a send): your email address and the message content (for the alert: the platform, the send concerned and the error).
• GitHub Inc. (USA) — hosting of AdsFellow's code and, every night, an encrypted backup copy of our database, kept for 14 days: without the encryption passphrase, which only we hold, no one can read it, not even GitHub.

How we use Google API user data

AdsFellow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the minimum scope required to deliver the feature you opt into (https://www.googleapis.com/auth/adwords). Google user data is used exclusively to provide and improve user-facing features of AdsFellow; no other use is permitted.

What Google user data we access

• OAuth access token and refresh token issued by Google when you connect your Google Ads account. Stored encrypted at rest (AES-256-GCM).
• Google Ads account identifiers (customer ID, account name, currency, time zone) that you choose to connect.
• Campaign performance metrics (impressions, clicks, spend, conversions) read from your connected ad accounts and displayed inside your AdsFellow dashboard.
• Metadata for paused campaigns created on your explicit request (IDs, status, date), and the review of their ads by Google (approved, under review or disapproved, with the reason given by Google), read automatically for 30 days after sending, as long as your access to AdsFellow is open.

How we use Google user data

• Display your Google Ads campaign metrics inside your AdsFellow dashboard so you can monitor performance alongside your other ad platforms.
• When you explicitly request it from the Kit, create PAUSED campaigns, without starting, modifying or deleting existing live campaigns.
• Tell you, in the send history, whether Google approved or disapproved an ad created from AdsFellow, and why (read-only: AdsFellow never modifies the ad).
• Maintain the OAuth connection (refresh tokens as needed) so you do not have to reconnect at each session.
• Detect and prevent abuse, fraud and security incidents on our service (legitimate interest, GDPR art. 6.1.f).

With whom Google user data is shared

• Vercel Inc. (USA) — transient processing of API responses as they pass through our application server.
• Neon Inc. (USA; database hosted in the European Union, in Frankfurt) — encrypted storage of the OAuth tokens and the campaign metadata you save inside AdsFellow.
• Functional Software Inc., dba Sentry (USA; data hosted in Germany) — only if an error occurs; we add neither your name nor your email address, and tokens and sign-in codes are removed.
• Google LLC, paid Gemini API (USA) — only when you run an “AI Flash Audit” on a Google Ads account: its figures (spend, impressions, clicks, conversions), without its name or number, to write 3 recommendations. Google keeps the request and the response for 55 days, solely to detect abuse, and does not use them to improve its products.
• GitHub Inc. (USA) — the encrypted backup copy of our database, made every night and kept for 14 days: unreadable without the encryption passphrase, which only we hold.
• No other third party: we do not share Google user data with other connected ad platforms, with analytics, or with any advertising network.

How we protect Google user data

• OAuth access tokens and refresh tokens are encrypted at rest using AES-256-GCM before storage in our PostgreSQL database. Encryption keys are rotated and held in environment secrets, never in source code.
• All data is transmitted over HTTPS (TLS 1.2 or higher). Our domain is HSTS-protected.
• Access to production data is restricted to authorized employees of LBF Initiatives Limited and is logged and monitored. We require strong authentication for all administrative access.
• Our application enforces rate limiting, webhook idempotency and per-user authorization on every API route handling Google user data, to prevent unauthorized cross-account access.
• Error reports sent by our servers to our monitoring provider are stripped of access tokens, refresh tokens and sign-in codes; we add neither your name nor your email address.

What we never do with Google user data

• We do not sell, rent or transfer Google user data to any third party.
• We do not use Google user data for advertising, retargeting, personalized ads, interest-based ads, or to build user profiles for advertising purposes.
• We do not use Google user data to train AI or machine-learning models, ours or anyone else's.
• We do not use Google user data for credit-worthiness assessment, lending, or to determine eligibility for any service unrelated to AdsFellow.
• We do not allow humans to read your Google user data, except (1) with your explicit consent for support, (2) to comply with applicable law, or (3) to investigate suspected abuse.

Google user data retention and deletion

• OAuth tokens are kept only as long as your Google Ads account is connected. When you click “Disconnect” on AdsFellow's Connections page, AdsFellow removes its permission at Google, then the access and refresh tokens are deleted from our database immediately (if another AdsFellow connection may use the same Google account, AdsFellow keeps the permission so as not to cut it, and the screen tells you where to remove it). 30 days after your access to AdsFellow ends, it does so by itself.
• Saved campaign metadata (Campaign Plans, links to the campaigns created paused) is retained while your AdsFellow account exists. You can delete any individual campaign at any time from the dashboard.
• Account deletion permanently removes all Google user data we hold about you within 30 days, except for billing records that we are legally required to keep at Stripe.
• You can also revoke AdsFellow's access from your Google Account at any time at https://myaccount.google.com/permissions, independently of any action inside AdsFellow.

To request a copy or deletion of any Google user data we hold about you, contact us at contact@adsfellow.app. We respond within 30 days as required by GDPR.

International transfers

Some providers process data outside the European Economic Area, mainly in the United States. These transfers are governed by the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework certifications of the providers concerned.

Data retention

Your data is kept for as long as your account exists. As soon as your access to AdsFellow ends (subscription ended), no automatic task reads your ad accounts anymore; 30 days later, AdsFellow removes its permission on the platforms that allow it (Google, Meta, Reddit, TikTok) and deletes its access keys; your Campaign Plans, Kits and files stay in your account. On Microsoft, LinkedIn, Pinterest and Snapchat, which do not let AdsFellow do so, the screen tells you where to remove its permission yourself. When you delete your account, your Stripe subscription is cancelled first, AdsFellow removes its permission on the platforms that allow it, then your platform connections (tokens), Campaign Plans, saved assets, imported images and videos and profile are permanently deleted; an email confirms it. The statistics read from your ad accounts are kept for 90 days. If you use the free plan, your email address and your answers are kept for 30 days (long enough to resend your plan if needed), then deleted. Billing records are kept by Stripe for the duration required by accounting law. Error logs are retained for 90 days.

Your GDPR rights

Under the GDPR you have the following rights over your personal data:

• Access — obtain a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — delete your account and all associated data (also available directly from your account settings).
• Restriction — limit the processing of your data in certain cases.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest, and withdraw consent at any time.

You also have the right to lodge a complaint with a supervisory authority: the Irish Data Protection Commission (dataprotection.ie), our lead authority, or your local authority such as the CNIL (cnil.fr) in France.

Cookies

We use two categories of cookies and similar technologies:

• Essential (no consent required) — authentication cookies from our sign-in provider (keeping you signed in), Stripe cookies during payment (security), the record of your cookie choice itself, and, if you do the free plan, your answers (website address, audience, objective, budget; never your email), kept in your browser to prefill the “Quick” form: they are used for 30 days at most, then erased on your next visit. You can erase them yourself at any time: “Don’t reuse” in the “Quick” form, or the adsfellow.app site data in your browser settings.
• Audience measurement (consent required) — Google Analytics cookies (_ga, _ga_*), loaded ONLY if you click Accept in the banner. If you decline, nothing is sent to Google.

Your choice is stored for 6 months and can be changed at any time:

Payments

Subscriptions (€99/month excl. VAT, no free trial and no commitment) are for professionals only, under our Terms of Service. They are paid by card through Stripe, our payment provider: the first month at signup, then every month. Card data is entered exclusively on Stripe's secure pages and never transits through our servers. You can cancel at any time from your account (“Cancel my subscription”); access remains until the end of the paid period, and an email confirms it. Your invoices are in “Manage subscription”: they show your business address, and its VAT number if you give it; AdsFellow charges no VAT. If a payment fails, Stripe retries it for 2 weeks; a customer who has already paid at least once keeps access for 7 days to update their card.

Read the Terms of Service

Security

Ad platform tokens are encrypted at rest (AES-256-GCM). All traffic is encrypted in transit (TLS). Access controls are fail-closed: if a security check cannot be performed, access is denied. AdsFellow creates campaigns paused: it never launches a campaign and cannot spend anything unless you activate it yourself.

Artificial intelligence

Campaign Plans, ad copy and visuals are generated through the API of a leading AI provider (Google Gemini). Your briefs are sent to this API solely to produce your content; the “AI Flash Audit” of a Google Ads or Meta account also sends it that account's figures, without its name or number. Under the provider's paid API terms, this data is not used to train its models; the provider keeps it for 55 days, solely to detect abuse. Generated content is yours; you remain responsible for reviewing it before any advertising use. Visuals created by AI carry a machine-readable label that says so: Google's (the C2PA standard, plus an invisible watermark, SynthID); when AdsFellow rewrites an image (your logo added, the size a platform requires), it puts back a label of the IPTC standard, and a Plan's PDF carries the same. Do not remove these labels; if a visual could pass for real when it is not, say so in your ad (EU AI Act, Article 50).

Applicable law & changes

This site and these terms are governed by Irish law and applicable EU regulations (GDPR, ePrivacy). We may update this page as the service evolves; the date below always reflects the latest version. Material changes will be announced in the app.