Privacy Policy

What we collect

• Account details: your name, email address, workspace name, and your password stored only as a one-way (bcrypt) hash.
• Billing details: handled by Stripe. We receive your plan, subscription status and invoices from Stripe; we never see or store your card number.
• What you do in the app: saved shops and ads, folders, tracked brands, recently viewed items, API keys you create (stored hashed), AI-connector authorisations, and an activity log of workspace actions such as invitations and plan changes.
• Usage counters: how much of your plan’s allowances you have used (for example store dossiers opened this week).
• Technical data: IP address and browser user agent with each sign-in session, and in server logs kept for security and rate limiting.
• Where you came from: the page that referred you to sign up, kept with your account to understand which pages bring customers.

The store and advertising information shown in the app is about businesses and their public ads, gathered from public sources; it is not data about you as a user.

Cookies

• ml_session: keeps you signed in. Essential; removed when you sign out or it expires.
• als_ref: remembers the first page that referred you, so a later signup can be attributed to it.

We do not use third-party analytics, advertising or tracking cookies.

Why we use it

• to provide the Service: accounts, sign-in, workspaces, billing and the features of your plan (performance of our contract with you);
• to send service emails: sign-in links, address confirmation, invitations, receipts and important account notices;
• to keep the Service secure: preventing abuse, enforcing rate limits and investigating misuse (our legitimate interests);
• to improve the product using aggregated usage, and to meet legal and accounting obligations.

We do not sell personal data and do not use it for advertising.

Who processes it for us

• Vercel (website and app hosting, United States);
• Supabase (database, United States, us-east-1);
• Stripe (payments and invoices);
• Resend (sending our emails);
• Anthropic (AI labels of public ad text; no personal data of users is sent).

These providers process data only on our instructions. Because they are in other countries, your data may be transferred outside your own; we rely on their contractual safeguards for such transfers.

How long we keep it

Account and workspace data is kept while your account is open. When you ask us to close your account we delete it within 30 days, except invoices and records we must keep for tax and accounting (usually 7 years). Session records and security logs are kept for up to 12 months.

Your rights

Depending on where you live (including under the GDPR, UK GDPR, Hong Kong’s PDPO and US state laws), you can ask to access, correct, export or delete your personal data, or object to some uses. You can update your name, email and password yourself in Settings. For anything else, email hello@adtrendlab.com from your account address; we answer within 30 days. You may also complain to your local data-protection authority.

Security

Traffic is encrypted with HTTPS, passwords and API keys are stored hashed, database access is restricted, and sign-in attempts are rate limited. No system is perfectly secure; tell us at once if you suspect a problem.

Children

The Service is for businesses and is not directed at anyone under 18.

Changes

We will post any update here with a new date, and email account owners about material changes.

Contact

Privacy questions or requests: hello@adtrendlab.com.