Privacy Policy

1. Who we are and what this policy covers

AdPlatform ("AdPlatform", "we", "us" or "our") operates the advertising platform available at adplatform.online, including free feed posts, premium dedicated pages, campaign analytics, and the encrypted vault feature (together, the "Platform"). We are the data controller for the personal data described in this policy.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and the rights you have. It applies to our website, our web application, our emails, and any advertising or vault link you open through the Platform.

This policy covers the requirements of the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA, other United States state privacy laws, the Israeli Privacy Protection Law and its regulations, and comparable international regimes.

2. Summary of what we collect

• Account data: your name, email address, password or third-party sign-in identifier, role and plan.
• Advertising data: campaign creatives, headlines, subtitles, destination links, budgets, placements and performance metrics such as impressions (exposures) and clicks.
• Encrypted vault data: only ciphertext and a one-way hash. See the dedicated section below.
• Payment data: handled by our payment processor. We never receive or store your full card number.
• Technical data: IP address, device and browser type, timestamps, referring page and cookie or local-storage identifiers.
• Communications: messages you send to us and support conversations.

3. The zero-knowledge encrypted vault

Media you lock in the vault is encrypted in your own browser using AES-GCM with a 256-bit key derived from the code you choose (1,000,000 PBKDF2 rounds using SHA-256). The encryption key never leaves your device and is never transmitted to or stored by us.

We store only two things: the encrypted payload, and a SHA-256 hash of the unlock code that we use to find the record. We cannot read, decrypt, reconstruct or recover the content you lock, and we cannot reverse the hash to discover your code.

Vault content is destroyed at the moment it is successfully opened: the encrypted payload is overwritten with a permanent destruction marker and the record is marked as destroyed before the media is displayed. Destroyed content is unrecoverable, including by us.

When a vault is opened, the front camera is analyzed locally in your browser by an on-device machine-learning model to detect recording attempts or the presence of more than one person. Camera frames are processed in memory only. They are never recorded, uploaded, analyzed by us, or stored anywhere. If camera permission is denied, protected media cannot be displayed.

4. How we use your data and our legal bases

• To create and manage your account, authenticate you and provide the Platform - performance of our contract with you.
• To publish campaign content, deliver exposures, measure performance and report results - performance of our contract with you.
• To process payments, subscriptions, invoices and refunds - performance of our contract and compliance with tax and accounting law.
• To keep the Platform safe: fraud prevention, abuse and bot detection, integrity of exposure and points accounting, rate limiting and security monitoring - our legitimate interests in protecting the Platform and its users.
• To improve the Platform and understand aggregate usage - our legitimate interests, or your consent where cookies or similar technologies are involved.
• To send service messages (security alerts, billing notices, changes to policies) - performance of our contract.
• To send marketing about our own services - your consent where required, and always with an easy opt-out.
• To comply with legal obligations and to respond to lawful requests from authorities.

5. Cookies and similar technologies

We use cookies, local storage and similar technologies to keep you signed in, to secure the Platform, to remember your preferences (such as light or dark mode) and to remember your cookie choices.

Analytics and marketing technologies are used only after you give consent, and you can accept, reject or change that choice at any time from the Cookie settings link in the footer. Full details, including categories and retention periods, are in our Cookie Policy.

6. Who we share data with

We do not sell your personal data, and we do not share it for cross-context behavioral advertising unless you have opted in. We share data only with the following categories of recipients, under contracts that limit their use of it to providing services to us:

Some of these providers may process data in other countries. Where required, we rely on recognized transfer safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and adequacy decisions.

• Hosting and database infrastructure providers that run the Platform.
• Payment processors, including Stripe, which handle card payments, subscriptions, fraud screening and billing.
• AI model providers used to generate, moderate or analyze campaign content, and to assist with support replies.
• Email delivery providers used to send service and marketing emails.
• Analytics and advertising measurement providers, only where you have consented.
• Professional advisers (lawyers, accountants, auditors) and insurers, where necessary.
• Public authorities, courts and regulators where we are legally required, and parties to a corporate transaction such as a merger or acquisition.

7. Retention

• Account and profile data: while your account is active, then up to 24 months after closure for security and dispute handling.
• Encrypted vault payloads: until the vault is opened or you delete it; once opened, the payload is destroyed immediately and permanently.
• Campaign and exposure records: for the period needed to report results, then in aggregate or anonymized form.
• Payment, invoice and tax records: generally 7 years, as required by accounting and tax law.
• Cookie consent records: for up to 12 months, to demonstrate your choices.
• Security and anti-fraud logs, including IP addresses: up to 24 months.

8. Security

We use encryption in transit (TLS), client-side AES-256-GCM encryption for vault content, one-way hashing of unlock codes and other secrets, strict access controls, per-record access rules in our database, and monitoring and rate limiting to detect abuse.

No system is completely secure. Because vault content is encrypted with a code that only you know, losing your code means losing access to the content permanently - we cannot reset or recover it for you.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights. We do not discriminate against anyone who exercises them.

To exercise a right, use the request form in our Do Not Sell or Share My Personal Information page, or email privacy@adplatform.online. We verify requests by confirming control of the account email. You may use an authorized agent. We respond within 30 days and extend by a further 60 days where a request is complex, telling you why.

• Access: a copy of the personal data we hold about you and information about how it is used.
• Rectification: correction of inaccurate or incomplete data.
• Erasure: deletion of your data, subject to legal retention obligations.
• Restriction and objection: limits on certain processing, including direct marketing.
• Portability: a machine-readable copy of the data you provided to us.
• Withdrawal of consent: at any time, without affecting processing that already took place.
• Opt out of sale or sharing: we do not sell data; you can opt out of any consent-based sharing for advertising.
• Limit the use of sensitive personal information, and appeal a refused request.
• Complain to a supervisory authority: your local data protection authority, the Israeli Privacy Protection Authority, or the California Privacy Protection Agency.

10. Children

The Platform is intended for adults. Premium advertising accounts and the vault feature are not available to anyone under 18, and we do not knowingly collect personal data from children. If we learn that a child has provided us with personal data, we delete it and close the account.

11. Automated processing and AI

AI systems help us generate and moderate content and detect fraud. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Content flagged automatically can be reviewed by a human and appealed.

The camera analysis used when opening a vault runs entirely on your own device and does not involve us at all.

12. Do Not Track and Global Privacy Control

We honor Global Privacy Control (GPC) signals as a valid opt-out of sale and sharing where the law requires it. Where a browser sends a Do Not Track signal, we treat it as an opt-out request for consent-based advertising technologies.

13. Changes to this policy

We may update this policy to reflect changes in our practices or the law. We publish the new version on this page, update the date at the top, and where the change is material we notify account holders by email or in the Platform before it takes effect. Previous versions are available on request.

14. Contact

Privacy questions, data rights requests and complaints: privacy@adplatform.online. You can also reach us through the contact details published on the Platform.

If you are in the EU or UK, you may also complain to your national data protection authority. If you are in Israel, you may contact the Privacy Protection Authority. If you are in California, you may contact the California Privacy Protection Agency.