Privacy Policy

At Adstyr ("we", "us", "our"), we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

This Privacy Policy is administered by Adstyr Ltd., a company registered in Israel (Tel Aviv-Jaffa), and complies with the Israeli Privacy Protection Law 5741-1981 as amended by Amendment 13 (effective August 14, 2025). Where you are an EU/EEA resident, EU Regulation 2016/679 (GDPR) also applies. All requests, inquiries, or complaints may be sent to admin@adstyr.com. EU/EEA residents may also lodge complaints with their local supervisory authority; Israeli residents may lodge complaints with the Israeli Privacy Protection Authority.

1. Data Controller

Adstyr Ltd. is the data controller responsible for your personal data. If you have questions about this policy or our data practices, contact us at:

• Email: support@adstyr.com
• Address: Tel Aviv, Israel

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and company name. You sign in with Facebook or Google, so we never receive or store a password.
• Payment Information: Billing address and payment details (processed securely by our payment provider)
• Communications: Messages you send us via support or contact forms
• Company details: For each company you set up, its name, website and logo, and, if you enter them, the business address and map location we use to target ads around your business.

2.2 Information from Facebook/Meta

When you connect your Facebook Ads account, we access:

• Ad account IDs and names
• Campaign, ad set, and ad performance data
• Audience insights and demographic data (aggregated)
• Creative assets (images, videos, ad copy)
• Comments on your Facebook Page and Instagram posts: the comment text, the commenter's name and ID, and the time it was posted
• Messenger and Instagram Direct messages for the Pages you connect: the message content, the sender's name and Facebook or Instagram ID, and timestamps
• Lead form submissions from your lead ads: the contact details people enter, such as name, email address, phone number, and answers to your custom questions

How we use it: We never sell this data, and we do not use it for advertising, profiling, or building audiences. We process it only for the features you use: showing it to you in your Adstyr dashboard, sending the replies you write, emailing each new lead to the address you choose when you turn on lead notifications (through our email provider, Resend), sending new leads to a webhook address you set up, saving whether you marked a lead as a customer or not a fit, and exporting your own leads when you ask us to.

2.3 Automatically Collected Information

• Usage Data: Pages visited, features used, and actions taken
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times
• Cookies: See our Cookie Policy for details
• Activity Tracking (with consent): When you accept analytics cookies, we record page paths and page titles to understand how people use the platform. With that consent, this activity is also shared with our analytics providers PostHog and Google Tag Manager (see section 5.1). Without it, neither is loaded. You can withdraw consent at any time in cookie settings.
• Public chat assistant: If you use the chat assistant on our login or landing page, the messages you type are sent to Google Gemini to write the answer. Please do not type sensitive personal information there. We keep these messages for 90 days to see what visitors ask and improve the answers. They are not linked to you unless you are signed in.
• Security monitoring: Once a day we automatically review account activity (such as sign-ins, page views and connected accounts) for signs of abuse or account takeover. We do this on the basis of our legitimate interest in keeping the service and your account safe. Only your user ID and activity counts are sent to our AI provider for this, never your email address.

2.4 Information from Google Ads (per OAuth scope)

When you authorize Adstyr through Google OAuth 2.0, we request the following scopes. Each row lists the exact data the scope grants us and the specific feature it powers.

We do not request or use the YouTube Data API, Gmail, Calendar, Drive, or any other Google API. Display, Video/YouTube, and Shopping ads are managed entirely through the Google Ads API.

In addition to the Google scopes above, we also store a refresh token (encrypted at rest) used to call the Google Ads API on your behalf, your selected Google Ads customer ID, your saved date-range and metric preferences, and a session ID stored in a server-side authentication cookie.

3. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Contract Performance: To provide our services as agreed in our Terms of Service
• Legitimate Interests: To improve our services, prevent fraud, and keep the service and your account secure, including a daily automated review of account activity
• Consent: For marketing communications and non-essential cookies
• Legal Obligation: To comply with applicable laws and regulations

4. How We Use Your Information

• Provide, maintain, and improve our platform
• Generate AI-powered insights and analytics
• Process payments and manage subscriptions
• Send service-related communications
• Respond to support requests
• Detect and prevent fraud or abuse
• Comply with legal obligations

4.1 Google API Services & Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Adstyr commits to:

• Use Google Ads API data only to provide and improve user-facing features within the Adstyr dashboard.
• Not transfer Google user data to third parties unless required for the user-facing feature, ordered by law, or as part of a merger/acquisition (with notice).
• Not use Google user data to serve advertisements, including retargeting, personalized, or interest-based ads.
• Not allow humans to read Google user data, except with the user's explicit consent, for security investigations or legal compliance, or when the data has been aggregated and anonymized.
• Not use Google user data to train generalized AI or ML models. This applies to raw, aggregated, anonymized, and derived data alike.
• Not sell, license, or share Google user data with data brokers, aggregators, or any third party for resale or onward marketing.
• Not use or share Google user data for credit, employment, insurance, housing, or eligibility assessments of any kind.

Google API Services User Data Policy

5. Data Sharing and Disclosure

We may share your data with:

• Service Providers: Hosting (Railway) and database (Supabase), content delivery and security (Cloudflare), payment processing, email delivery, and analytics providers
• AI Providers: Google Gemini API for generating insights and for answers from our public chat assistant, and Anthropic Claude API for the account manager that reviews your ad account and answers your questions about it (data is processed under each provider's terms)
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with mergers, acquisitions, or asset sales

We never sell your personal data to third parties.

5.1 Sub-processors

We use the following sub-processors to provide our services (GDPR Article 28):

Last updated: September 29, 2026. We will notify you of material changes to this list.

6. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including the United States. We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all processors
• Compliance with EU-US Data Privacy Framework where applicable

6.1 Data Processing Agreement (DPA)

Our Terms of Service include a Data Processing Annex (GDPR Article 28(3)) that covers the personal data you bring to Adstyr, such as your leads, messages and comments. It applies automatically. If you need a signed copy, contact us at support@adstyr.com.

7. Data Retention

We retain different categories of data only for as long as needed to operate the service.

• Account profile and OAuth integrations: Retained while your account is active. Profile data and OAuth refresh tokens are deleted within 7 days after you disconnect, delete your account, or are removed under section 7.1.
• Ad analytics data (Facebook Ads, Google Ads, Merchant Center): Up to 24 months from collection, to enable year-over-year comparisons. Older data is deleted automatically.
• Application logs: 30 days, with email addresses and other identifiers masked.
• Audit logs and consent records: 24 months, then automatically deleted. We keep security records this long because account takeovers, fraud and disputed changes are often discovered months later, and these records are how we investigate them. Some records are kept longer where the law requires it (typically 7 years for billing-related records) or to defend an actual or threatened legal claim, for as long as that proceeding lasts.
• Support communications: 2 years from your last interaction.
• Billing and tax records: 7 years, as required by the Israeli Income Tax Ordinance and equivalent obligations elsewhere.
• Messenger and Instagram Direct messages, and Page and Instagram comments: Not retained. We do not store this content on our servers or in our database. Each time you open your inbox, we fetch it from Meta's API, show it to you, and discard it when you leave the page.
• Lead form submissions: We fetch your leads from Meta each time you open your lead list. If you turn on lead notifications, each new lead's contact details are emailed to the address you choose (through Resend) and, if you set up a webhook, sent to that address. We keep which leads were already sent, the funnel stage you assign, and whether you marked a lead as a customer or not a fit. These are kept until you remove the ad account from Adstyr or delete your account, and then deleted.
• Your own moderation actions: Which comments you replied to, hid or deleted. Kept for 90 days as a record of your own actions, and deleted sooner if you delete your account or disconnect the Page.
• Home to-do actions: The changes you apply or undo from the to-do list and the suggestions you dismiss. Kept for 12 months.

7.1 Inactive Account Deletion (GDPR Article 5)

In accordance with the GDPR principle of data minimization (Article 5(1)(e)) and the Israeli Privacy Protection Law, we automatically delete accounts that show no sign of life. The schedule depends on whether you have paid for the service.

• Free and trial accounts: After 60 days without logging in, we send a warning email. You have a 30-day grace period to log in or reconnect. If you do not, your account and all associated data are permanently deleted at 90 days of total inactivity.
• Paid accounts (current or past paying subscribers): After 90 days without logging in, we send a warning email. You have a 90-day grace period to log in or reconnect. If you do not, your account and all associated data are permanently deleted at 180 days of total inactivity.
• Disconnected accounts: If you revoke the Adstyr app from Facebook or Google, or your access token otherwise stops working, we pause data collection immediately and email you to reconnect. If you do not reconnect within 30 days, your account enters the inactivity schedule above.

Logging in to the dashboard, reconnecting an OAuth integration, or contacting our support team all reset the inactivity timer. Billing, tax, and audit records subject to legal retention obligations (Israeli Income Tax Ordinance, EU and Israeli AML rules) are retained for the periods required by law, typically 7 years, regardless of account deletion.

8. Your Rights (GDPR & CCPA)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time for consent-based processing
• Non-Discrimination: Exercise your rights without discriminatory treatment (CCPA)

To exercise these rights, email us at support@adstyr.com.

9. Security Measures

We implement industry-standard security measures including:

• TLS/SSL encryption for data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Access controls and authentication
• Employee security training

10. Children's Privacy

Adstyr is built for businesses and is not directed to anyone under 18. You must be at least 18 to create an account (see our Terms of Service). We do not knowingly collect personal data from anyone under 18. If we learn we have, we will delete it promptly.

11. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or prominent notice on our platform. Continued use after changes constitutes acceptance.

13. Contact Us

For privacy-related inquiries:

• Email: support@adstyr.com
• Security concerns: security@adstyr.com
• Billing inquiries: billing@adstyr.com

You also have the right to lodge a complaint with your local data protection authority.