Privacy Policy
This explains what personal data Adhook collects and how we use it. Adhook is operated by Simon Košir s.p. (see our imprint). We are the controller for your account and billing data. For the content you submit to generate ads (product and service data, scraped page data, and uploaded images) we act as a processor on your behalf; where that content contains personal data, our Data Processing Agreement applies automatically.
What we collect. Account details (email, optional name, country), the product and service information and images you upload, the ads you generate, your requests for demo credits, and basic usage and security logs. If you sign in with Google, Google shares your email address and basic profile with us so we can create or open your account; Google processes the sign-in itself as an independent controller under Google's privacy policy. Payment details are collected by Paddle, not by us (see Payments below).
Why we use it, and our legal basis. To provide the service, including reviewing your request for demo credits (performance of our contract with you); to keep the service secure and prevent abuse through security logs and content checks (our legitimate interest); and, only with your consent, to send you marketing. We do not currently send marketing email; account and billing notices are part of the service. You can withdraw marketing consent at any time.
Payments. Paddle is the seller of record for paid plans and credit packs. Paddle collects your billing name, address, country and payment details itself, under Paddle's privacy policy, and sends us your customer, subscription and transaction identifiers and their status.
Cookies. Adhook uses strictly necessary cookies: a session cookie that keeps you signed in and a security (CSRF) cookie that protects forms. The session cookie is set only when you sign up or log in; the security cookie may be set on any page so that the forms you submit are protected. If you agree to analytics, Google Analytics sets its own cookies to recognise returning visits; you can decline, and the site works identically either way. When you open checkout on the Billing page, Paddle sets its own cookies needed to complete the purchase, under Paddle's cookie policy.
Analytics. We measure website traffic two ways. The first is a self-hosted, cookieless tool running on our own EU server; it keeps aggregated statistics (pages viewed, referrer, browser, country), stores no IP addresses and does not track visitors across sites. The second is Google Analytics 4, which does set cookies. In the EEA and the United Kingdom it stays switched off until you agree: nothing is stored and nothing is sent to Google unless you choose Allow, and declining costs you nothing. Google Analytics is operated by Google LLC in the United States, certified under the EU-US Data Privacy Framework; advertising and personalisation signals are permanently disabled. On pages behind the login we replace the address and the page title before anything is sent, so your product URLs and brand names never leave our systems. Inside the product we record coarse usage events (for example that a signup or a generation completed) with no personal data attached.
Automated content checks. Before we generate ads, an automated check screens your request against our content policy. A declined request is never charged, we tell you which category applied, you can change and resubmit it, and you can ask us to review the decision by email; a person then reviews it.
Sub-processors. We use service providers that process data to run Adhook on our behalf: our payment provider, the AI model providers that generate briefs, images, and copy, our page-fetching provider, our email provider, and our hosting provider. Each is bound by a data processing agreement. See the current sub-processor list.
International transfers. Some sub-processors are outside the EU (in the USA and the United Kingdom). Google is certified under the EU-US Data Privacy Framework and additionally bound by Standard Contractual Clauses; our other US providers (Anthropic, Firecrawl) are bound by Standard Contractual Clauses under their data processing agreements; the United Kingdom is covered by an EU adequacy decision. The transfer basis per provider is on the sub-processor list.
Retention. We keep data only as long as needed:
- Generated creatives and ad copy: while your account is active; you can delete individual ads, and everything is hard-deleted when you delete your account.
- Product and service data: only the structured fields extracted from your page, kept while the product exists in your account; raw page content is never stored by us.
- Product images: while the product exists in your account.
- Uploaded reference images: transient, deleted as soon as the generation job finishes.
- Account details, demo requests and invitations: until you delete your account.
- Sign-in sessions: 7 days.
- Credit-ledger entries and payment identifiers: retained after account deletion for 10 years after the end of the year they relate to (statutory accounting retention) as our financial record; they no longer link to any content.
- Server access and security logs: rotated automatically and kept for up to 90 days.
- Error reports (technical details with personal data removed): 90 days.
- Analytics: aggregated statistics with no personal data.
- Backups: database backups are kept for up to 30 days and then deleted, so data you delete disappears from backups within that window. Generated images are not included in database backups.
Your rights. You can request access, correction, deletion, portability, or a copy of your data, and you can object to or withdraw consent for marketing at any time. To exercise these rights, contact privacy@theadhook.com. We answer within one month (extendable for complex requests) and may ask you to confirm the request from your account email.
Security and breaches. We use reasonable technical and organizational measures to protect your data and will notify you and the supervisory authority of a personal data breach where the law requires it.
Complaints. You may lodge a complaint with the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblascenec, IP-RS), or with the data protection authority in your country of residence.
United Kingdom. We will appoint a representative in the United Kingdom under Article 27 UK GDPR once we have customers there, and will name them here.
Changes to this policy. We may update this policy as the service evolves; the "last updated" date above always reflects the current version, and we will announce material changes, for example by email or in the app.
Contact. Privacy questions and data-subject requests: privacy@theadhook.com.