# Privacy notice

For visitors to this site, for customers, and for people who appear in the ads we fetch.

## The short version

- **No tracking cookies, and no banner.** We count visits from our own server logs, nothing else.
- **Customers:** we keep what we need to run your account and bill you, and nothing to sell.
- **People in ads:** ads can name people. We process that only as part of the ad, when a customer
  asks, and you can object.

## 1. Who is responsible

Full Stack Marketing SRL, Rue Beeckman 21, 1180 Brussels, Belgium (BCE 0780.799.718) is the
controller for the data described here. Contact: privacy@adsentinel.eu.

## 2. Visitors to this site

The site's pages set no cookies, and we use no analytics tools; signing in to the dashboard sets one (see below). Our servers log each request: the page, the time, your
IP address and your browser's user agent. We use these logs to keep the site running, count visits
and stop abuse, on the basis of our legitimate interest. Logs are deleted after 30 days.

## 3. Customers

When you create an account we process your email address, your sign-in (email link or Google), your
API keys, your credit, payments and usage, and the results of your jobs.

Signing in to the dashboard sets one cookie, `__session`, which keeps you signed in for up to 30 days.
It is needed for the dashboard to work, so it needs no banner. Signing out deletes it.

- **Why:** to provide the service and bill you (contract), to meet tax and accounting duties (legal
  obligation), and to prevent abuse such as scripted sign-ups (legitimate interest).
- **Payments** are handled by Stripe, which receives your card details directly; we never see them.
- **How long:** job results for 90 days; account data while your account is open; invoices and
  payment records as long as Belgian tax and accounting law requires. When you close your account,
  we keep your email address with those records, and so that free credit isn't given twice.

## 4. People who appear in ads

Meta publishes ads in its public Ad Library. Some of them contain personal data: the name of a
person who runs a page, and for ads shown in the EU, the names of the people or organisations who
paid for the ad and on whose behalf.

- **What we do:** we fetch this data only when a customer asks for a brand's or a topic's ads, as
  part of the ad, exactly as Meta publishes it. We don't build profiles of people and we don't
  combine this data with other sources.
- **Our role and basis:** we act as controller, on the basis of legitimate interest: our customers'
  interest in researching advertising, which Meta publishes for transparency, weighed against yours.
  The data is already public, limited to what appears in the ad, and deleted after 90 days.
- **How long:** delivered results for 90 days; Meta's raw responses, kept to fix processing errors,
  for 90 days.
- **This page is our notice to you.** Contacting everyone who appears in an ad individually isn't
  possible, so we publish this notice instead.
- **To object**, or to exercise any right below, email privacy@adsentinel.eu with a link to the ad or
  page concerned. We honour objections.

## 5. Who else sees data

- **Stripe**, for payments.
- **Google**, if you sign in with Google.
- **Google Cloud**, where the site, the API and its storage run (Belgium).
- **Neon**, our database (Frankfurt, Germany).
- **Resend**, for sign-in links and account emails.

We don't sell data. Where a provider is outside the EU, the transfer is covered by the EU's standard
contractual clauses or an adequacy decision.

## 6. Your rights

You can ask for access to your data, its correction or deletion, a copy in a portable format, or
restriction of its use, and you can object to processing based on legitimate interest. Email
privacy@adsentinel.eu; we answer within one month.

## 7. Complaints

You can complain to the Belgian Data Protection Authority (Autorité de protection des données /
Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be.