Privacy Policy
This explains what personal data TheAdHook collects and how we use it. TheAdHook is operated by Simon Košir s.p. (see our imprint). We are the controller for your account and billing data. For the content you submit to generate ads (product and service data, page data read from the URLs you submit, and uploaded images) we act as a processor on your behalf; where that content contains personal data, our Data Processing Agreement applies automatically.
What we collect. Account details (email, optional name, country), the product and service information and images you upload, the ads you generate, and basic usage and security logs. If you sign in with Google, Google shares your email address and basic profile with us so we can create or open your account; Google processes the sign-in itself as an independent controller under Google's privacy policy. Payment details are collected by Dodo Payments, not by us (see Payments below).
Why we use it, and our legal basis. To provide the service, including adding your free credits when your account is activated (performance of our contract with you); to keep the service secure and prevent abuse through security logs and content checks (our legitimate interest); to send account holders emails about TheAdHook - news, tips, reminders and offers - each with a one-click unsubscribe (our legitimate interest); and, only with your consent, marketing to anyone else. Account and billing notices are part of the service and are always sent. You can unsubscribe or withdraw consent at any time.
Payments. Dodo Payments is the seller of record for paid plans and credit packs and acts as an independent controller for the payment data it collects: your billing name, email, address, country and payment details, under its privacy policy. It sends us your customer, subscription, payment and refund identifiers, the amounts and their status, which we keep as our financial record. Dodo Payments stores payment data in India and may transfer it to the United States and the United Kingdom, under Standard Contractual Clauses and the UK International Data Transfer Addendum.
Cookies. TheAdHook uses strictly necessary cookies: a session cookie that keeps you signed in and a security (CSRF) cookie that protects forms. The session cookie is set only when you sign up or log in; the security cookie may be set on any page so that the forms you submit are protected. If you agree to analytics, Google Analytics sets its own cookies to recognise returning visits; you can decline, and the site works identically either way. Where analytics is on - in the EEA and the UK only after you choose Accept, elsewhere by default - a small cookie remembers where your first visit came from (the website, search engine or campaign that linked to us) for up to 30 days, so we can attach it to your workspace if you sign up. In the EEA and the UK you can change your choice at any time with Cookie settings at the bottom of our pages. When you open checkout on the Billing page, the embedded Dodo Payments checkout may set its own cookies needed to complete the purchase, under Dodo Payments' cookie policy.
Analytics. We measure website traffic two ways. The first is a self-hosted, cookieless tool running on our own EU server; it keeps aggregated statistics (pages viewed, referrer, browser, country), stores no IP addresses and does not track visitors across sites. The second is Google Analytics 4, which does set cookies. In the EEA and the United Kingdom it stays switched off until you agree: nothing is stored and nothing is sent to Google unless you choose Accept, and declining costs you nothing. Google Analytics is operated by Google LLC in the United States, certified under the EU-US Data Privacy Framework; advertising and personalisation signals are permanently disabled. On pages behind the login we replace the address and the page title before anything is sent, so your product URLs and brand names never leave our systems. Links in our emails carry a tag that names the email (for example the welcome email), never you. When you sign up we note where your first visit came from - the website, search engine or campaign that linked to us - and keep it with your workspace, so we can see which channels bring customers. It is never used for advertising or shared. Inside the product we record coarse usage events (for example that a signup or a generation completed) as statistics with no personal data attached. We also note which steps your workspace has reached - confirmed the email, downloaded an ad, opened billing or checkout - with no content, only the step and when, so we can see where people get stuck. We also note how your workspace uses the product and where it gets stuck - for example a generation that failed or was blocked by our content checks, a failed payment, an edit to ad copy, a product you saved, and which of our emails we sent you and whether you opened a link in them - with no content, only the event and when.
Comments on our social posts. When you comment on a TheAdHook post on Instagram or Facebook, Meta sends the comment to us. If it is the keyword the post asks for, we automatically send you one direct message with a link to TheAdHook and reply under your comment. We read the comment and the post only for this (our legitimate interest in answering a request for our link). We keep the comment's ID, the post, the keyword and whether the reply was sent for 90 days, never your name, username or the comment text. Meta processes your comment and the message as an independent controller under Meta's privacy policy. To have this record deleted, email privacy@theadhook.com with a link to your comment.
Automated content checks. Before we generate ads, an automated check screens your request against our content policy. A declined request is never charged, we tell you which category applied, you can change and resubmit it, and you can ask us to review the decision by email; a person then reviews it.
Sub-processors. We use service providers that process data to run TheAdHook on our behalf: the AI model providers that generate briefs, images, and copy, our page-fetching provider, our email provider, and our hosting provider. Each is bound by a data processing agreement. Our payment provider, Dodo Payments, acts as an independent controller for payment data (see Payments). See the current sub-processor list.
International transfers. Some sub-processors are outside the EU (in the USA and the United Kingdom), and payment data is also stored in India (see Payments). Google is certified under the EU-US Data Privacy Framework and additionally bound by Standard Contractual Clauses; our other US providers (Anthropic, Firecrawl) are bound by Standard Contractual Clauses under their data processing agreements; the United Kingdom is covered by an EU adequacy decision. The transfer basis per provider is on the sub-processor list.
Retention. We keep data only as long as needed:
- Generated creatives and ad copy: while your account is active; you can delete individual ads, and everything is hard-deleted when you delete your account.
- Product and service data: only the structured fields extracted from your page, kept while the product exists in your account; raw page content is never stored by us.
- Product images: while the product exists in your account.
- Uploaded reference images: transient, deleted as soon as the generation job finishes.
- Account details and invitations: until you delete your account.
- Sign-in sessions: 7 days.
- Credit-ledger entries and payment identifiers: retained after account deletion for 10 years after the end of the year they relate to (statutory accounting retention) as our financial record; they no longer link to any content.
- Server access and security logs: rotated automatically and kept for up to 90 days.
- Error reports (technical details with personal data removed): 90 days.
- Analytics: aggregated statistics with no personal data.
- Records of automatic replies to comments on our social posts: 90 days.
- Where you first came from: kept with your workspace and deleted with it.
- Steps and usage events of your workspace: kept with your workspace and deleted with it.
- To make sure free credits are given only once per person, we keep a one-way coded fingerprint of your email address - never the address itself - for 24 months after your account is deleted.
- To prevent abuse of free credits, we keep a scrambled form of your signup IP address until you confirm your email, and at most 30 days.
- Backups: database backups are kept for up to 30 days and then deleted, so data you delete disappears from backups within that window. Generated images are not included in database backups.
Your rights. You can request access, correction, deletion, portability, or a copy of your data, and you can object to or withdraw consent for marketing at any time. To exercise these rights, contact privacy@theadhook.com. We answer within one month (extendable for complex requests) and may ask you to confirm the request from your account email.
Security and breaches. We use reasonable technical and organizational measures to protect your data and will notify you and the supervisory authority of a personal data breach where the law requires it.
Complaints. You may lodge a complaint with the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblascenec, IP-RS), or with the data protection authority in your country of residence.
United Kingdom. We will appoint a representative in the United Kingdom under Article 27 UK GDPR once we have customers there, and will name them here.
Changes to this policy. We may update this policy as the service evolves; the "last updated" date above always reflects the current version, and we will announce material changes, for example by email or in the app.
Contact. Privacy questions and data-subject requests: privacy@theadhook.com.