Who we are#
[to be completed: company name], registered in [to be completed: country of registration] under number [to be completed: registration number], [to be completed: registered address] ("AdTomato", "we") is the controller of the personal data described in this policy, except the data of your leads, which we process for you (see Your leads).
- Privacy contact: [to be completed: privacy contact]
- Representative in the EU (GDPR art. 27): [to be completed: EU representative]
- Representative in the UK (UK GDPR art. 27): [to be completed: UK representative]
- Person in charge of data protection for Brazil (encarregado, LGPD art. 41): [to be completed: Brazil data protection officer (encarregado)]
This policy applies to the website adtomato.ai and the dashboard at app.adtomato.ai. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, Brazil's LGPD, the data protection laws of Mexico, Argentina, Colombia and Chile, and Hong Kong's Personal Data (Privacy) Ordinance (PDPO). In Colombia it is our data processing policy under Ley 1581 de 2012; in Mexico it is our privacy notice (aviso de privacidad).
What data we collect#
- Account data: your name, email address, password (stored only as a hash), language and settings.
- Business data: the brief about your business, products, sites, texts and images you add or approve.
- Billing data: your plan, payment history, billing name, address and tax ID. Card details are collected and stored by Stripe; we receive only limited information such as the card type, the last four digits and the expiry date.
- Ad platform data: when you connect an advertising account, the identifiers and access tokens needed to work with it, your campaign settings and performance data such as spend, clicks and conversions.
- Usage and device data: IP address, browser and device type, pages and features used, log and error data, collected when you use the site or the dashboard.
- Website choices: the answers you give in the plan builder on our website, your cookie choice, colour scheme and language. They are kept in your browser. When you continue to registration, your plan travels in the link so the dashboard can prefill your brief; the words you typed yourself travel in the part of the link that browsers do not send to servers.
- How you found us: the campaign parameters of the link you arrived by (such as
utm_sourceor an ad click id), the first page you opened and the referring site (its address only, without the page). They travel in the registration link and are kept with your account, so we know which of our pages and ads bring customers. Your browser stores them only if you allowed analytics or ads cookies. - Communications: messages you send to support and our replies.
- Your leads: data your visitors and customers submit through your sites and ad forms. We process it for you, see Your leads.
We do not ask for special categories of data (for example health data) and ask you not to upload them.
Why we use it and on what legal basis#
| Purpose | Data | Legal basis (GDPR / UK GDPR) | Legal basis (LGPD) |
|---|---|---|---|
| Create and run your account; provide the Service | Account, business, ad platform data | Contract, art. 6(1)(b) | Contract, art. 7, V |
| Take payments, issue invoices, keep accounting records | Billing data | Contract; legal obligation, art. 6(1)(b), (c) | Contract; legal obligation, art. 7, II and V |
| Keep the Service secure, prevent fraud and abuse | Usage and device data | Legitimate interests, art. 6(1)(f) | Legitimate interest, art. 7, IX |
| Answer support requests | Communications, account data | Contract; legitimate interests | Contract; legitimate interest |
| Improve the Service with aggregated statistics | Usage data | Legitimate interests | Legitimate interest |
| Website analytics and measuring our own ads (cookies) | Usage and device data | Consent, art. 6(1)(a) | Consent, art. 7, I |
| Know which of our pages and ads bring customers | How you found us, account data | Legitimate interests, art. 6(1)(f) | Legitimate interest, art. 7, IX |
| Service emails (receipts, security, changes to terms) | Account data | Contract; legal obligation | Contract; legal obligation |
| News and offers by email | Email address | Consent, or legitimate interests where the law allows for existing customers; you can opt out at any time | Consent, art. 7, I |
| Establish or defend legal claims | Any relevant data | Legitimate interests; legal obligation | Regular exercise of rights, art. 7, VI |
When we rely on legitimate interests, we have weighed them against your rights; you can object at any time (see Your rights).
Mexico. The first five purposes in the table are necessary for the relationship with you (primary purposes). Analytics, ad measurement and news by email are secondary purposes: you can refuse them at any time by writing to [to be completed: privacy contact], and refusing them does not affect the Service.
Hong Kong. We will not use your personal data for direct marketing without your consent (PDPO Part 6A).
Your leads: we act for you#
When your sites and ad forms collect data from your visitors and customers, you are the controller (in Brazil, the controlador) and we are your processor (operador). We use lead data only to provide the Service to you, under your instructions and the Data Processing Agreement. If you are one of those people, please contact the business whose site or form you used; we will help it answer you.
Where the data comes from#
From you; from the advertising platforms and other services you connect; from our partner advertising agencies, if you run ads on an account they provide; from Stripe about your payments; and automatically when you use the site and the dashboard.
Who receives it#
- Service providers who process data for us under contract: hosting ([to be completed: hosting provider]), email ([to be completed: email provider]), payments (Stripe), AI model provider ([to be completed: AI model provider]) and error monitoring ([to be completed: error-monitoring provider]). The current list is in Subprocessors.
- Advertising platforms and social networks you connect, when you ask the Service to create, change or read campaigns or posts. They handle the data under their own terms and privacy policies.
- Partner advertising agencies, only if you choose to run ads on an ad account provided by one of them: the data needed to run your campaigns on that account and report on them, such as your business and campaign details, your ads and their results. They are listed in Subprocessors.
- Analytics and ad tools on our website (Google Analytics 4, Meta Pixel, TikTok Pixel), only if you allow them in the cookie settings.
- Professional advisers, authorities and courts when the law requires it or to protect our rights.
- A buyer or successor if our business is reorganised or sold, under the same protections.
We do not sell personal data.
International transfers#
The dashboard's data is hosted in [to be completed: where data is hosted]. Some providers process data in other countries, including the United States. When data leaves the EU/EEA, the UK, Brazil or another country that restricts transfers, we rely on an adequacy decision where one exists, or on standard contractual clauses: the European Commission's clauses (Decision 2021/914), the UK Addendum to them, the ANPD's standard contractual clauses in Brazil, and the equivalent instruments recognised in Argentina, Colombia, Mexico and Chile. You can ask us for a copy of the safeguards at [to be completed: privacy contact].
How long we keep it#
- Account and business data: while your account is open; after it is closed we delete or anonymise it within [to be completed: retention period], except what the law requires us to keep.
- Billing and accounting records: as long as tax and accounting law requires.
- Logs and security data: [to be completed: retention period].
- Lead data: until you delete it or your account is closed, as set out in the Data Processing Agreement.
- Support messages: [to be completed: retention period].
- Your cookie choice: in your browser until you change it or clear it; see the Cookie Policy.
How we protect it#
We use technical and organisational measures appropriate to the risk, such as encryption in transit, access control on a need-to-know basis and confidentiality obligations for our staff and providers. No method is completely secure. If a breach puts your rights at risk, we will inform you and the authorities as the law requires.
Your rights#
Depending on where you live, you have the right to:
- know whether we process your data and get a copy of it (access);
- have inaccurate data corrected and incomplete data completed;
- have data deleted, anonymised or blocked when it is no longer needed or was processed unlawfully;
- receive your data in a portable format;
- object to processing based on legitimate interests and to direct marketing at any time;
- restrict processing in certain cases;
- withdraw consent at any time, without affecting what was done before;
- know who we share your data with and what happens if you refuse consent (LGPD);
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects (see Recommendations);
- complain to a supervisory authority.
By market. In the EU and the UK these are the rights of GDPR arts. 15–22. In Brazil, the rights of LGPD art. 18. In Mexico, the ARCO rights (access, rectification, cancellation and opposition), plus revoking consent and limiting use. In Argentina, the rights of access, rectification, update and deletion of Ley 25.326; access is free at intervals of six months unless you show a legitimate interest. In Colombia, the rights of art. 8 of Ley 1581 de 2012, including knowing, updating and correcting your data and revoking authorisation. In Chile, the rights of Ley 19.628 and, once in force, Ley 21.719. In Hong Kong, the rights to access and correct your data under the PDPO.
How to use them. Write to [to be completed: privacy contact] from the email address of your account, or tell us how we can verify it is you. We answer within the time the applicable law sets (for example, one month under the GDPR). Using your rights is free, unless a request is clearly unfounded or excessive.
Supervisory authorities. You can complain to the data protection authority where you live or work, for example: in the EU, your national authority; in the UK, the Information Commissioner's Office; in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD); in Mexico, the authority competent under the federal law on personal data held by private parties; in Argentina, the Agencia de Acceso a la Información Pública (AAIP); in Colombia, the Superintendencia de Industria y Comercio (SIC); in Chile, the competent data protection authority; in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD).
Argentina. The AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, as the supervisory authority of Law No. 25,326, has the power to hear complaints and claims from anyone whose rights are affected by a breach of the rules on personal data protection.
Recommendations and automated processing#
The Service calculates recommendations, for example a platform, a daily budget and an estimated range of weekly leads, from your brief and goal using fixed rules. They are suggestions: you decide whether to use them. The optimizer changes budgets automatically only under rules you switch on. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. More in the AI notice.
Children#
The Service is not for people under 18. We do not knowingly collect their data; if you believe a child has given us data, write to [to be completed: privacy contact] and we will delete it.
Cookies#
Our website uses necessary browser storage and, only with your consent, analytics and advertising cookies. Details are in the Cookie Policy, and you can change your choice at any time in the .
Changes to this policy#
We will publish each new version of this policy with its date. If a change is material, we will tell you by email or in the dashboard before it applies.
Contact#
Privacy questions and requests: [to be completed: privacy contact]. Company details: Imprint.