AdClast LogoAdClast
Get started

Legal

Privacy Policy

Last updated: September 24, 2026

1. Introduction

This Privacy Policy explains how Adviosis Limited (Company No. 15654545), a company registered in England and Wales with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom("we", "us", "our", "Adviosis", or "the Company"), collects, uses, stores, and protects personal data when you use our software-as-a-service platform AdClast (the "Service"), accessible at adclast.adclast.com and associated subdomains.

Adviosis Limited is the data controller for all personal data processed through the Service. We are committed to protecting your privacy and processing your data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR (where applicable), and other relevant data protection legislation worldwide.

2. Information We Collect

2.1 Account Information

When you register for AdClast, we collect:

  • Full name and email address
  • Password (stored in hashed, encrypted form via Supabase Auth)
  • Organisation/agency name and workspace details
  • Billing address and payment method (processed and stored by Stripe, Inc.; we do not store full card numbers)

2.2 Advertising Platform Data

When you connect your advertising accounts (Meta Ads, Google Ads, TikTok Ads), we access and store the following on your behalf and with your explicit authorisation:

  • Campaign, ad set, and ad-level performance metrics (impressions, clicks, conversions, spend, revenue)
  • Ad account names, IDs, and status information
  • Historical performance data within the date ranges you specify
  • OAuth access tokens and refresh tokens (encrypted at rest) required to maintain your connections

Important: We do not access, store, or process any end-user personal data from your ad campaigns (e.g. names, emails, phone numbers, or demographic details of the people who see or interact with your advertisements). We only access aggregated, anonymised performance metrics provided by the advertising platforms' reporting APIs.

2.3 Client Onboarding Data

If you use AdClast's Client Onboarding Form Builder to collect information from your own clients,you act as the data controller for that information. We act as a data processor on your behalf. You are responsible for ensuring you have appropriate lawful bases and privacy notices for the data you collect through these forms.

2.4 Usage and Technical Data

  • IP address, browser type, operating system, and device information
  • Pages visited, features used, and time spent within the Service
  • Error logs and performance telemetry to maintain service quality
  • Cookies and similar tracking technologies (see Section 8)

3. How We Use Your Data

We process your personal data for the following purposes:

  • Service Delivery: To operate, maintain, and provide the AdClast platform to you, including dashboards, analytics, reporting, and AI-powered intelligence features
  • Authentication & Security: To verify your identity, protect your account, and prevent fraud or unauthorised access
  • Billing & Payments: To process subscription payments, generate invoices, and manage your billing cycle via Stripe
  • Communication: To send service-related notices (e.g. plan changes, security alerts, downtime notifications) and optional marketing communications (with your consent)
  • Product Improvement: To analyse usage patterns, diagnose technical issues, and improve the Service's features and performance
  • Legal Compliance: To comply with applicable laws, regulations, and lawful governmental requests

4. Lawful Bases for Processing

Under the UK GDPR, we rely on the following lawful bases:

  • Contract Performance (Article 6(1)(b)): Processing necessary to fulfil our contractual obligations under your subscription
  • Legitimate Interests (Article 6(1)(f)): Product improvement, fraud prevention, and service security, balanced against your rights and freedoms
  • Consent (Article 6(1)(a)): For optional marketing communications and non-essential cookies; you may withdraw consent at any time
  • Legal Obligation (Article 6(1)(c)): Where processing is required by law (e.g. tax and accounting obligations)

5. Data Sharing & Third-Party Processors

We share personal data only with the following categories of recipients, under appropriate safeguards:

  • Supabase, Inc. (Database hosting and authentication) — Data processed in accordance with Supabase's DPA
  • Stripe, Inc. (Payment processing) — PCI-DSS Level 1 certified; we never see or store full card numbers
  • Vercel, Inc. (Application hosting and CDN) — Infrastructure provider for serving the AdClast application
  • Meta Platforms, Inc., Google LLC, and TikTok (ByteDance Ltd.) — API data access authorised by you via OAuth 2.0, strictly limited to advertising performance data
  • Email service providers (e.g. Resend/SendGrid) — For transactional and marketing communications

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

Where data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the ICO, or transfers to jurisdictions deemed adequate by the UK Secretary of State.

6. Data Retention

  • Account Data: Retained for the duration of your active subscription, plus 30 days after account deletion to allow recovery
  • Advertising Metrics: Retained for the duration of your subscription; deleted within 90 days of account closure
  • Billing Records: Retained for 7 years after the end of the financial year in which the transaction occurred, as required by UK tax law (HMRC)
  • Usage Logs: Retained for up to 12 months for security and debugging purposes, then anonymised or deleted
  • Client Onboarding Submissions: Retained until you delete them; automatically deleted within 90 days of workspace closure

7. Your Rights

Under the UK GDPR, you have the following rights:

  • Right of Access: Request a copy of the personal data we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
  • Right to Restrict Processing: Request that we limit how we use your data
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Object: Object to processing based on legitimate interests or direct marketing
  • Right to Withdraw Consent: Where processing is based on consent, withdraw at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@adclast.com. We will respond within one calendar month as required by law. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies & Tracking Technologies

AdClast uses the following types of cookies:

  • Strictly Necessary Cookies: Required for authentication, security, and core functionality (e.g. session tokens). These cannot be disabled.
  • Functional Cookies: Remember your preferences (e.g. theme, currency, workspace). You may disable these in your browser settings.
  • Analytics Cookies: Help us understand how you use the Service to improve it. We use privacy-respectful analytics. You may opt out at any time.

We do not use advertising or retargeting cookies on the AdClast platform.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • OAuth tokens encrypted before database storage
  • Row-Level Security (RLS) policies ensuring workspace-level data isolation
  • Role-based access controls for team and admin features
  • Regular security reviews and dependency audits
  • Secure payment processing via Stripe (PCI-DSS Level 1 certified)

In the event of a personal data breach, we will notify the ICO within 72 hours where required, and affected individuals without undue delay, in accordance with our legal obligations.

10. Children's Privacy

AdClast is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a minor, we will take immediate steps to delete it.

11. Third-Party Platform Compliance

11.1 Meta (Facebook & Instagram) Ads

Our use of Meta Ads data complies with the Meta Platform Terms, Meta Business Tools Terms, and Meta Marketing API Terms of Service. We access only aggregated campaign metrics via the Marketing API and do not access, store, or process any personal data of ad viewers or clickers.

11.2 Google Ads

Our use of Google Ads data complies with the Google API Services User Data Policy andGoogle Ads API Terms of Service. We access only aggregated reporting data and adhere to Google's Limited Use Requirements.

11.3 TikTok Ads

Our use of TikTok Ads data complies with the TikTok for Business Terms of Service andTikTok Marketing API Terms. We access only aggregated campaign-level metrics and do not store or process personal data of TikTok users.

11.4 Stripe Payments

All payment data is processed by Stripe, Inc. in accordance with the Stripe Services Agreementand applicable PCI-DSS standards. We only receive and store: your Stripe Customer ID, subscription status, plan details, and invoice metadata. We never see, transmit, or store your full credit/debit card number, CVV, or bank account details.

12. International Data Transfers

Adviosis Limited is based in the United Kingdom. Some of our third-party processors (Supabase, Stripe, Vercel) operate in the United States. Where data is transferred outside the UK, we ensure adequate safeguards through:

  • UK-approved Standard Contractual Clauses (SCCs)
  • The UK International Data Transfer Agreement (IDTA) where applicable
  • Transfers to jurisdictions with adequacy decisions

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by email and/or a prominent notice within the Service at least 14 days before changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact:

  • Data Controller: Adviosis Limited
  • Email: privacy@adclast.com
  • General Enquiries: hello@adclast.com
  • Postal Address: 128 City Road, London, EC1V 2NX, United Kingdom
  • Company Number: 15654545 (England & Wales)

Supervisory Authority: If you believe we have not handled your data properly, you may lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk | Helpline: 0303 123 1113