Privacy Policy

Version: 0.1-draft Effective date: not yet in force (draft)

DRAFT – pending review by a qualified Romanian lawyer before use. This document is not yet in force.

Summary

• 1ads is a business-to-business (B2B) platform for brands and advertising agencies. It is not offered to consumers or to anyone under 18.
• For the data of our website visitors, the people who request access or ask us to email them an ROI estimate, our Customers' contacts and Authorized Users, we are the controller. For the data that Customers bring into the Platform (ad metrics, analytics, ecommerce orders, social comments and messages, and similar), we are a processor acting on the Customer's instructions under our Data Processing Agreement (data-processing-agreement.md).
• We host the Platform on our own on-premises Kubernetes cluster in Romania (EU), which we operate ourselves under our FirstIT brand (FirstIT is a brand of the Company, not a separate company). Sign-in, single sign-on and multi-factor authentication run on our own self-hosted identity provider (Keycloak). Some service providers, mainly AI model providers, are in the USA or belong to U.S. groups. For those transfers we use the EU-US Data Privacy Framework or Standard Contractual Clauses.
• We do not sell personal data. We do not use Customer Data, Google user data or other Third-Party Platform data for advertising, and we do not use them to train generalized AI models.
• AI Features propose changes. A human must approve every change before it runs on an ad account. We do not make decisions about individuals based solely on automated processing.
• You can exercise your GDPR rights by writing to privacy@1ads.net. You can also complain to the Romanian data protection authority (ANSPDCP).

1. Who we are and what this policy covers

1.1. Controller. The controller of the personal data described in this policy is ALTTAB PROFIT SRL, a limited liability company with its registered seat at Str. Doamna Oltea nr. 70, Sector 2, Bucharest, postal code 020231, Romania. It is registered with the Trade Register under no. J2004020548403, with EUID {{EUID}}, sole registration code (CUI) RO17030480 and share capital {{SHARE_CAPITAL}}. In this policy it is called the "Company", "we", "us" or "our". The Company operates the 1ads brand, the website https://1ads.net and the application https://app.1ads.net. Together, the application, its APIs, its MCP server and its related services are called the "Platform".

1.2. Contact. For any privacy question or request, write to privacy@1ads.net or by post to the registered seat above. Data protection officer: {{DPO_CONTACT}}.

[Drafting note: before publication, document an assessment under Article 37 GDPR. If no data protection officer is appointed, {{DPO_CONTACT}} reads: "No data protection officer has been appointed. We have assessed and documented that Article 37 GDPR does not currently require one. Contact: privacy@1ads.net". If one is appointed, publish their contact details here and notify ANSPDCP (Article 37(7) GDPR).]

1.3. Who this policy applies to. This policy applies to:

1.4. Defined terms. Capitalized terms such as "Customer", "Authorized Users", "Customer Data", "Order Form", "Third-Party Platforms", "AI Features" and "Outputs" have the meanings given in our Terms of Service (terms-of-service.md). In short:

• "Customer" is the business that has signed an Order Form with us.
• "Authorized Users" are the people the Customer allows to use the Platform.
• "Customer Data" is the data that the Customer or its Authorized Users submit to the Platform or connect to it, including data retrieved from Third-Party Platforms.
• "Third-Party Platforms" are external services such as ad platforms, analytics tools, ecommerce or CRM systems and social networks.
• "AI Features" are the functions of the Platform that use artificial intelligence models.
• "Outputs" are the content and recommendations that AI Features generate.

1.5. B2B only. The Platform is intended exclusively for businesses and professionals acting for purposes related to their trade, business or profession. It is not offered to consumers.

2. Our two roles: controller and processor

2.1. Where we act as controller. We decide why and how we process the following data, so we are its controller and this policy applies to it:

• website, ROI-estimate and access-request data;
• account and contact data;
• Pilot measurement data (Section 3);
• authentication and security data;
• usage and metering data;
• billing and accounting data;
• support communications;
• marketing preferences;
• the public trend signals described in Section 6.2.

2.2. Where we act as processor. For Customer Data, the Customer is the controller and we are its processor. We process Customer Data only on the Customer's documented instructions, under our Data Processing Agreement (data-processing-agreement.md). The Data Processing Agreement prevails over this policy for Customer Data. Customer Data may include:

• advertising, analytics and ecommerce data;
• order and customer identifiers;
• hashed email addresses or phone numbers of the Customer's end customers;
• social comments and direct messages from third parties;
• content that Authorized Users submit to the AI chat;
• Outputs.

2.3. If your data is in Customer Data. You may be, for example, a shopper of one of our Customers, or a person who commented on a Customer's social page. In that case, please contact that Customer, because it decides how your data is used. If you contact us, we will forward your request to the relevant Customer where we can identify it. We will also help the Customer respond, as required by Article 28 GDPR.

2.4. Third-Party Platforms are not our sub-processors. Customers connect ad platforms, analytics providers, ecommerce and CRM systems and social networks to the Platform. Those providers act as independent controllers or as the Customer's own providers. They are not our sub-processors. Their own privacy policies apply to the data they hold.

3. Personal data we collect as controller

3.1. Data we do not ask for. We do not ask for special categories of personal data, such as health data, political opinions or biometric data. We do not ask for data about criminal offences. We do not ask for national identification numbers (CNP), unless the law requires it, in which case we comply with Law no. 190/2018. Please do not send us such data.

3.2. Is providing data mandatory? Some data is needed to evaluate your access request, conclude the contract, create accounts and issue invoices. This includes your name, business email and company details. Without it we cannot provide the Platform. To email you an ROI estimate, we need your work email, name and company. Optional fields are marked as optional.

4. Purposes and legal bases (Article 6 GDPR)

4.1. Balancing test. Where we rely on legitimate interest, we have balanced our interests against your rights. You can ask us for information about that assessment. You also have the right to object (Section 11).

5. AI Features and how they use data

5.1. AI models we use. The Platform's AI chat and automations use large language models provided by Anthropic PBC (Claude Opus 5.5 by default, and Claude Haiku or Sonnet for some tasks). For image generation, and optionally for some text tasks, they use models provided by OpenAI. These providers act as our sub-processors (see Section 7).

5.2. What is sent to AI models. When you use an AI Feature, we send the model only what the task needs:

• your prompt;
• relevant context from Customer Data, such as campaign metrics, KPI targets, product information or brand guidelines;
• the tools the model may call.

We never send OAuth tokens, passwords or other credentials to AI models. Our LLM observability tool redacts personal data from traces (see Section 7).

5.3. No training. We do not use Customer Data, Google user data or other Third-Party Platform data to train, fine-tune or improve generalized AI or machine-learning models, whether ours or anyone else's. Under their current commercial terms for API customers, our AI providers do not train their models on our API inputs and outputs. We have requested zero-data-retention from Anthropic. Until a provider confirms zero-data-retention, it may keep inputs and outputs for the limited period stated in its commercial terms (Anthropic: up to 30 days by default, longer for content flagged for usage-policy violations or where the law requires it). Models that Anthropic designates as "Covered Models" require retention of at least 30 days and are generally not eligible for zero-data-retention; we will update subprocessors.md and notify Customers before using such a model. The current status for each provider is shown in subprocessors.md.

5.4. Transparency (EU AI Act). We follow the transparency rules in Article 50 of Regulation (EU) 2024/1689 (the AI Act):

• The Platform tells you clearly when you are interacting with an AI system.
• Outputs are labeled as AI-generated in the interface.
• Images generated through the Platform carry machine-readable provenance marking (C2PA content credentials).
• AI-generated text that leaves the Platform through exports, the REST API or the MCP server carries a machine-readable indicator.
• When content is published through the Platform, we set the AI-content labels that the destination social network offers.

Customers decide what they publish. As deployers, they remain responsible for any disclosure the AI Act or a platform's rules require. This includes deciding whether the editorial-responsibility exception in Article 50(4) applies to text that has gone through human review. See ai-transparency-notice.md, terms-of-service.md and acceptable-use-policy.md.

5.5. Human approval. AI Features never execute changes on ad accounts by themselves. "Performance Guardian" compares campaigns with the Customer's KPI targets and proposes changes to budgets, statuses, bids or creatives. "Trend Radar" proposes ad and post concepts and never publishes automatically. A change runs only after an authorized human approves it, or under an auto-approval policy that the Customer configures within the Platform's hard limits. Auto-approval policies are disabled during the Access Program (access-program-terms.md, Section 8.5), without exceptions. Every proposal, approval, rejection and execution is recorded in the audit log.

5.6. No automated decisions about individuals. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Our staff decide on access requests manually. The analyses and proposals that AI Features produce concern campaigns, budgets and content, not decisions about individuals. Customers must not use the Platform to make such decisions about individuals (see acceptable-use-policy.md).

5.7. Political advertising. The Platform does not support political or social-issue advertising in the EU within the meaning of Regulation (EU) 2024/900. We do not process personal data to target or deliver such advertising.

6. Public sources: Trend Radar and Web Intelligence

6.1. What we read. "Trend Radar" detects public trends from public sources:

• Google Trends, through SerpApi;
• YouTube;
• Wikipedia page statistics;
• GDELT;
• news APIs;
• public posts on Bluesky and Mastodon.

"Web Intelligence" reads public web pages. Both features:

• respect robots.txt and text-and-data-mining opt-outs (Article 4 of Directive (EU) 2019/790);
• never access content that requires a login;
• never bypass access controls.

6.2. Our role. When we collect public trend signals for the Platform as a whole, we are the controller. When the Platform reads specific public pages or monitors topics at a Customer's request, we act as that Customer's processor.

6.3. How we minimize. Trend signals are mostly non-personal, such as search interest, topic volumes and news headlines. Public posts and articles may still contain names, usernames or opinions of the people who wrote them or are mentioned in them. To limit this:

• we use public posts only to compute topic-level signals;
• we do not build profiles of individuals;
• we do not target individuals;
• we keep post-level data for no longer than 30 days, then keep only aggregated topic signals;
• trends that touch on sensitive topics, such as health, politics, religion, tragedies or minors, are blocked or require senior human approval through a brand-safety gate (see brand-safety-and-sensitive-content-policy.md).

6.4. Your rights. If you believe your public content was processed, you may object under Article 21 GDPR by writing to privacy@1ads.net. Where possible, we will exclude your account or content from future collection. Because these sources are public, they are numerous and we do not keep contact details, informing each author individually would involve disproportionate effort (Article 14(5)(b) GDPR). This section serves as public information instead.

6.5. Special categories of data. Public posts may reveal political opinions, religious beliefs, health or sexual orientation. We do not seek such data. Where a post reveals it, we process it only transiently and automatically, to compute topic-level signals and to apply the brand-safety gate. We do not link it to an identified person, do not show it to Customers at author level, and delete post-level data within 30 days. To the extent Article 9 GDPR applies, we process only content its author has manifestly made public (Article 9(2)(e) GDPR) and otherwise discard it. We have carried out a legitimate interest assessment and a data protection impact assessment (Article 35 GDPR) for Trend Radar and Web Intelligence. [TBC: complete and keep on file the legitimate interest assessment and the DPIA before launch.]

7. Who receives personal data

7.1. Service providers and sub-processors. We use the providers below. They process personal data on our behalf, for our controller data, or as sub-processors, for Customer Data. Each one that processes personal data is bound by a data processing agreement and confidentiality obligations. DataForSEO, SerpApi and GNews are data suppliers that receive only queries, not personal data; they are not sub-processors. The current list, including changes, is kept in subprocessors.md.

The following run inside our own infrastructure and are not third-party recipients: our databases (PostgreSQL), secrets management (HashiCorp Vault), the background job queue (graphile-worker), our identity provider for sign-in, SSO and MFA (Keycloak), error tracking (Sentry, self-hosted) and LLM observability (Langfuse, self-hosted). We operate this infrastructure ourselves, under our FirstIT brand. If you sign in through SSO, your organization's identity provider (for example Okta, Microsoft Entra ID, Google Workspace or OneLogin) is chosen by your organization and processes your data under its own terms; it is not our sub-processor.

7.1.1. No third-party bot protection. The access-request form and the ROI estimate form are protected against spam and abuse by our own measures only. A hidden honeypot field and a check of how long the form was open filter out simple automated submissions only: both are values the browser sends, so a script that posts to our API directly can pass them. The protection that matters is server-side: rate limits per pseudonymised IP hash and, for ROI estimates, per email address (Section 3), a global hourly ceiling on emails to website visitors, and a list of addresses that asked us not to email them again. We do not use a third-party CAPTCHA (such as Google reCAPTCHA) or any other external bot-protection service, and the forms set no cookies.

7.1.2. ROI estimates stay with us. ROI estimates are computed on our own servers with fixed formulas, without AI models. Apart from the email provider above, which receives your contact details and the email with your estimate, no provider receives ROI estimate data. Our staff use an estimate to review an access request only if you sent the two together. If you asked only for the estimate, we do not use it to contact you again, unless you opted in to product updates.

7.2. Third-Party Platforms you connect. When you connect a Third-Party Platform, data flows between the Platform and that provider at your direction. For example, we read campaign metrics, publish an approved post, apply an approved budget change, or upload conversion events. These uploads may include hashed customer identifiers that the Customer supplies. The provider is not our sub-processor. It processes data under its own terms and privacy policy.

7.3. Within your organization. Your organization's administrators and other Authorized Users of the same workspace may see your name, role, activity and audit-log entries. Where an agency uses the client approval portal, the client's approvers may see the name of the agency user who submitted an item, and the reverse. In white-label setups, the agency's brand is shown, but the Company remains the provider of the Platform.

7.4. Other recipients. We may also share personal data with:

• banks, for payments by bank transfer;
• our accountants, auditors and legal advisers, who are bound by confidentiality;
• the Romanian tax authority (ANAF), through the RO e-Factura system, for invoices;
• courts, public authorities and law enforcement, where the law requires it;
• a successor or acquirer, in a merger, acquisition or asset sale, subject to this policy. Google user data is transferred in that case only with your explicit prior consent (Section 10.1).

7.5. No sale, no data brokers. We do not sell, rent or license personal data. We do not transfer it to data brokers or information resellers. We do not share it for cross-context behavioral advertising. We do not use Third-Party Platform data to serve ads, to retarget or to build interest profiles.

8. International transfers

8.1. We host the Platform in the EU. Some providers in Section 7.1 are in the USA. Where a recipient is certified under the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision of 10 July 2023. You can check certification at dataprivacyframework.gov. Otherwise, we use the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, together with a transfer impact assessment and supplementary measures where needed. Supplementary measures include encryption in transit, minimization and redaction. If the adequacy decision ceases to apply, we will rely on SCCs.

8.2. You can request a copy of the relevant safeguards by writing to privacy@1ads.net. We may redact commercially sensitive terms.

8.3. An "EU-strict" mode, in which AI processing stays in the EU, is planned for Enterprise customers. It is not yet available. We will update this policy and subprocessors.md when it is.

9. How long we keep data

9.1. When a retention period ends, we delete the data or anonymize it irreversibly. If the law requires longer retention, we keep only the data needed and restrict access to it.

10. Data from Third-Party Platforms

This section explains how we handle data received through specific Third-Party Platform APIs, as their developer terms require. It applies in addition to the rest of this policy and to data-processing-agreement.md.

10.1. Google APIs (Google Ads, Google Analytics, Search Console, YouTube, Google Data Manager API, Google sign-in)

Limited Use disclosure: The use and transfer to any other app of information received from Google APIs by 1ads will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

(a) Google user data we access. We request only the scopes needed for the features you enable. The Google consent screen shows them before you agree.

(b) How we use it. We use Google user data only to provide and improve the user-facing features that are prominent in the Platform's interface and that you have chosen to use. We do not use it, or anything derived from it, for any of the following:

• serving advertisements, including retargeting and personalized or interest-based advertising;
• transferring or selling it to advertising platforms, data brokers or information resellers;
• determining creditworthiness or lending;
• training generalized AI or machine-learning models.

Where you use AI Features on Google data, the relevant data is sent to our AI sub-processors (Section 7.1) solely to generate the analysis or proposal you requested. Our contracts with them prohibit using it for their own purposes.

(c) Human access. Our personnel do not read Google user data unless one of the following applies:

• you have given us affirmative agreement to view specific data, for example in a support request;
• it is necessary for security purposes, such as investigating abuse or a bug;
• it is necessary to comply with applicable law;
• the data (including derivations) is aggregated and anonymized and used for internal operations, in accordance with applicable law.

(d) Sharing. We share Google user data only:

• with the Authorized Users of the same Customer workspace, as configured by the Customer;
• with our sub-processors, to provide the Platform;
• where required by law;
• in a merger, acquisition or asset sale, with your explicit prior consent.

(e) Storage and protection. Google user data is stored in our own on-premises Kubernetes cluster in Romania (EU). It is encrypted in transit over public networks (TLS). Traffic between components inside our private cluster network is not yet encrypted; it is restricted by default-deny network policies, and its encryption is planned. Database backups are encrypted; encryption at rest of the servers' disks is [TBC – confirm with infrastructure owner]. OAuth tokens are encrypted with the HashiCorp Vault Transit engine, under a key derived per tenant, connection and provider, can be decrypted only by an isolated token service, and are never sent to AI models. [Drafting note: confirm the encryption at rest status before submitting the app for Google verification or any security assessment that asks about it.]

(f) Retention and deletion.

• Synchronized Google data is kept while the connection is active and the Customer's subscription runs.
• When you disconnect a Google account in the Platform, we delete the tokens immediately and stop synchronizing. We delete the stored Google user data within 30 days, or within 7 days for YouTube API Data.
• You can ask us to delete Google user data at any time by writing to privacy@1ads.net. We will complete the deletion within 7 days for YouTube API Data, and within 30 days for other Google user data.
• Residual copies in encrypted backups are deleted after no more than 14 days.

(g) Revoking access. You can disconnect a Google account in the Platform's Integrations settings. You can also revoke 1ads's access at any time through the Google security settings page at https://myaccount.google.com/permissions (also available at https://security.google.com/settings/security/permissions).

10.2. YouTube API Services

10.2.1. 1ads uses YouTube API Services. By connecting a YouTube channel or using YouTube features in the Platform, you agree to be bound by the YouTube Terms of Service. Google processes data according to the Google Privacy Policy.

10.2.2. What we access, store and use. We access the YouTube API Data described in Section 10.1(a): channel details, videos, playlists, comments and analytics. We access it to show it to you, to publish and schedule videos you approve, to manage comments and to produce reports. Trend Radar may also read public, non-authorized YouTube data, such as trending video statistics. We do not store that data for more than 30 days without refreshing it.

10.2.3. Sharing. We share YouTube API Data internally only with the Authorized Users of the Customer's workspace. We share it externally only with the sub-processors listed in Section 7.1 that are needed to provide the feature. For example, AI models analyze it on your request, and Zernio publishes approved content. We do not allow third parties to serve advertisements in the Platform.

10.2.4. Device storage. The Platform stores and reads information on your device only as described in cookie-policy.md.

10.2.5. Deletion. Our normal procedure for deleting stored data is as follows. When you disconnect YouTube in the Platform, or ask us to delete your data, we delete stored YouTube API Data within 7 calendar days. If you revoke access through the Google security settings page instead, we delete it within 30 calendar days of the revocation. You can revoke access at https://security.google.com/settings/security/permissions.

10.2.6. Contact. For privacy questions or complaints about YouTube data, write to privacy@1ads.net.

10.3. Meta (Facebook, Instagram, Threads, Meta Marketing API, Conversions API)

10.3.1. Data we access. Depending on the features the Customer enables, we access:

• identifiers and names of Pages, Instagram professional accounts, Threads profiles and ad accounts;
• campaigns, ad sets, ads and creatives;
• insights and metrics;
• posts and media;
• comments on the Customer's content, and direct messages sent to the Customer's accounts, where the Customer enables inbox features.

We send conversion events through the Conversions API. These may contain hashed customer identifiers that the Customer supplies.

10.3.2. How we use it. We process Meta Platform Data only on behalf of the Customer that connected it and only to provide the features that Customer uses. We act as a Tech Provider under the Meta Platform Terms, and specifically:

• we keep each Customer's Platform Data separate from that of other Customers;
• we never combine, pool or use one Customer's Platform Data for another Customer or for our own purposes (Meta Platform Terms, Section 5.b);
• we do not sell, license or purchase Platform Data;
• we do not use it to build or augment user profiles;
• we do not use it for advertising outside the Customer's own instructions.

10.3.3. Retention. Comments and direct messages are kept for 30 days by default. The Customer may configure a different period within the limits allowed by Meta's terms. We delete other Meta data when it is no longer needed to provide the Platform, when the Customer disconnects the account, or when the contract ends.

10.3.4. Data deletion instructions. To request deletion of data we received from Meta:

1. In the Platform, go to Integrations, open the Meta connection and choose Disconnect and delete data. Tokens are deleted immediately. Stored Meta data is deleted within 30 days.
2. You can also remove 1ads from your Meta account. On Facebook, go to Settings & privacy > Settings > Business integrations (or Apps and websites). On Instagram, go to Settings > Website permissions > Apps and websites.
3. You can also write to privacy@1ads.net with the subject "Meta data deletion", stating the Page, account or ad account concerned. We will confirm the deletion in writing.

Full instructions for all platforms are at https://1ads.net/en/legal/data-deletion-instructions/ (data-deletion-instructions.md).

When Meta sends us a data deletion request for one of its users through our data deletion callback, we delete the relevant data and give you a confirmation code. You can use that code to check the status of the deletion. If a person who wrote a comment or message to a Customer's account wants their data deleted, we also forward the request to the Customer.

10.4. TikTok (TikTok for Business / Marketing API, Login Kit, Content Posting API)

We access the following, depending on the features the Customer enables:

• advertiser account data, campaigns, ads and performance metrics;
• for organic features: basic profile information (display name, avatar, account identifier), video lists and metrics;
• the content you approve for publishing.

We use TikTok data only to provide the features you use. We do not sell it and do not share it with third parties, except the sub-processors needed to provide the feature. We do not share personally identifiable information without consent. We delete it when you disconnect your account or ask us to: tokens immediately, and stored data within 30 days.

You can revoke access in the TikTok app, under the app permissions in Settings and privacy, or in TikTok Ads Manager.

10.5. LinkedIn (Marketing APIs, Community Management API, Conversions API)

We access:

• organization Page data, posts and analytics;
• ad accounts, campaigns and performance reports;
• the comments on the Customer's posts and the basic profile data of the people who wrote them, where needed to show them;
• conversion events, with hashed identifiers supplied by the Customer.

We follow the LinkedIn API Terms of Use, the LinkedIn Marketing API Terms and LinkedIn's Data Storage Requirements, and specifically:

• we store LinkedIn member data only for as long as necessary, and no longer than 24 hours;
• we do not combine LinkedIn member data with other data to create, supplement or enrich profiles or leads; aggregated advertising and Page reporting data is shown alongside other channels only in the Customer's own reports, as LinkedIn's terms permit;
• we display LinkedIn member data only to the Authorized Users associated with the relevant LinkedIn Page or ad account. We do not send it to AI Providers, make it available through the REST API or the MCP Server, include it in exports, or sell or share it with any third party;
• we keep LinkedIn Page and advertising reporting data for no longer than one year;
• we do not use LinkedIn member data to target ads to individual members;
• we do not try to re-identify de-identified data.

We delete LinkedIn content promptly when you ask us to or disconnect. You can revoke access at https://www.linkedin.com/psettings/permitted-services.

10.6. Microsoft (Microsoft Advertising API, Microsoft Entra ID)

We access Microsoft Advertising account data, campaigns, ads, keywords, budgets and performance reports. We use them for reporting, for proposals and for applying changes you approve, in accordance with the Microsoft Advertising API Terms of Use.

If you sign in through Microsoft Entra ID SSO, our self-hosted identity provider (Keycloak) receives your identity attributes (name, email, object ID, group membership where configured) from your organization's Entra ID tenant.

You can revoke access:

• for work or school accounts, at https://myapplications.microsoft.com, or through your Entra ID administrator;
• for personal Microsoft accounts, at https://account.live.com/consent/Manage.

10.7. Shopify

We access the store data needed for profit and ROI analytics:

• orders, line items, prices, discounts, refunds, cancellations, fulfillment status;
• products and costs;
• customer and order identifiers.

This may include protected customer data. We request only the fields needed for the features the merchant enables. Where an email or phone number is needed for conversion matching, we normalize it and hash it with SHA-256 before storage, as the receiving ad platforms require. We encrypt data in transit over public networks (TLS) and encrypt database backups; encryption of traffic inside our private cluster network is planned, and encryption at rest of the servers' disks is [TBC – confirm with infrastructure owner]. We limit staff access, log access, and process the data under our Data Processing Agreement (data-processing-agreement.md) with the merchant.

We honor Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) and complete the requested action within 30 days, unless the law requires us to retain the data. When the app is uninstalled, the store's data is erased after Shopify's shop/redact request.

10.8. X, Pinterest, Amazon Ads, Adobe Analytics, HubSpot, Salesforce, Pipedrive, WooCommerce and connectors

For these and other Third-Party Platforms, including those connected through Windsor.ai, Unified.to or the Zernio publishing bridge, the same rules apply:

• we access only the data needed for the features you enable;
• we use it only to provide those features to the Customer that connected it;
• we do not sell it or use it for advertising;
• we do not use it to train AI models;
• we follow the provider's developer terms, for example the X Developer Agreement and Policy, including deleting or modifying X content as soon as reasonably possible after it is deleted or modified on X, and within 24 hours after a request from X or the account owner; we send content to X only when you approve its publication;
• we delete tokens immediately when you disconnect, and stored data within 30 days.

10.9. How to revoke access (quick reference)

11. Your rights

11.1. Under the GDPR, you have the right to:

• access your personal data and receive a copy (Art. 15);
• rectify inaccurate data (Art. 16);
• erase your data (Art. 17);
• restrict processing (Art. 18);
• data portability for data you provided to us, where the processing is based on consent or contract and carried out by automated means (Art. 20);
• withdraw consent at any time, without affecting processing that took place before (Art. 7(3));
• not be subject to decisions based solely on automated processing with legal or similarly significant effects (Art. 22). We do not make such decisions (Section 5.6).

Right to object (Art. 21). You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. You may also object at any time to direct marketing, and we will then stop using your data for that purpose. Every marketing email contains an unsubscribe link.

11.2. How to exercise your rights. Write to privacy@1ads.net. If you are an Authorized User, you can also update some data in your account settings. We may ask for information to confirm your identity. We answer within one month. For complex or numerous requests we may extend this by two further months, and if we do, we will tell you why. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

11.3. Customer Data. If your request concerns Customer Data, we will forward it to the relevant Customer, which is the controller, and assist it (Section 2.3).

11.4. Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live, work or where the alleged infringement occurred. In Romania, this is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, Romania Email: anspdcp@dataprotection.ro · Website: https://www.dataprotection.ro

We would appreciate the chance to resolve your concern first. You also have the right to an effective judicial remedy.

12. Security

12.1. We protect personal data with technical and organizational measures appropriate to the risk (Art. 32 GDPR). These include:

• hosting in the EU on our own on-premises Kubernetes cluster in Romania (EU), with a self-hosted identity provider and self-hosted error tracking;
• tenant and workspace isolation enforced by row-level security in the database;
• encryption in transit over public networks (TLS, with HSTS); traffic between components inside our private cluster network is not yet encrypted, is restricted by default-deny network policies, and its encryption is planned;
• encryption at rest of the servers' disks: [TBC – confirm with infrastructure owner];
• encryption of OAuth tokens with the HashiCorp Vault Transit engine, under keys derived per tenant, connection and provider;
• mandatory MFA for users who do not sign in through SSO;
• role-based access control and least-privilege access for staff;
• audit logging;
• redaction of personal data in LLM observability;
• nightly database backups, encrypted before storage and deleted after no more than 14 days [TBC – confirm first successful backup and restore];
• an incident response process.

12.2. Certifications. We do not currently hold SOC 2 or ISO/IEC 27001 certification.

12.3. Personal data breaches. If a breach affects personal data for which we are the controller, we notify ANSPDCP within 72 hours where required (Art. 33). We inform affected individuals where the breach is likely to result in a high risk (Art. 34). For Customer Data, we notify the Customer as set out in data-processing-agreement.md.

12.4. Reporting vulnerabilities. Please report security vulnerabilities to ops@1ads.net. A summary of our security measures is in security-overview.md.

13. Children and B2B only

The Platform and the website are intended for businesses and professionals. They are not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, write to privacy@1ads.net and we will delete it.

14. Cookies

At launch, the website sets no cookies, and the Platform and the sign-in pages use only strictly necessary cookies. We use no website analytics, preference or marketing tools at launch, and the access-request form sets no cookies. [TBC: if we add such a tool later, it will be used only with your consent, which you will be able to withdraw at any time through a "Cookie settings" link in the website footer; we would prefer a self-hosted, cookieless tool.] Details are in cookie-policy.md.

15. Changes to this policy

We may update this policy, for example when we add features, providers or Third-Party Platforms. We will:

• publish the new version with its effective date;
• notify Customers and Authorized Users of material changes by email or in the Platform before they take effect;
• ask for your consent again where the law or a Third-Party Platform's terms require it, for example before using Google user data in a new way.

16. Contact

ALTTAB PROFIT SRL · Str. Doamna Oltea nr. 70, Sector 2, Bucharest, postal code 020231, Romania · CUI RO17030480 · Trade Register no. J2004020548403 · EUID {{EUID}}

• Privacy requests: privacy@1ads.net
• Data protection officer: {{DPO_CONTACT}}
• Security: ops@1ads.net
• Support: support@1ads.net
• Legal notices: support@1ads.net

Related documents: terms-of-service.md, data-processing-agreement.md, subprocessors.md, data-retention-schedule.md, data-deletion-instructions.md, access-program-terms.md, acceptable-use-policy.md, ai-transparency-notice.md, brand-safety-and-sensitive-content-policy.md, security-overview.md, cookie-policy.md, legal-notice.md.