Privacy policy

Last updated 27 October 2026

Draft. Have a lawyer check it before you rely on it.

1. Who we are

[Company legal name, e.g. Example Sh.p.k.], [Street and number], [Postcode City], [Country] (“we”) runs adthief.ai and is the controller for your data under the GDPR. Contact: [hello@adthief.ai].

2. What we collect about you

• Account: email (we sign you in with a one-time code sent there), name, company, what you do and your niche.
• What you do in the app: saved ads, boards, tracked brands, alerts and searches.
• Technical: IP address and browser details in server logs, kept up to 30 days for security.
• Cookies: only what the service needs: your sign-in session, and your last country filter on Ads. No advertising or analytics cookies, so we don’t show a cookie banner.

3. Why, and on what legal basis

• To run your account and the service you asked for (Art. 6(1)(b) GDPR).
• To keep it secure and fix problems (legitimate interest, Art. 6(1)(f)).
• To email you about your account. Product news only if you agree (Art. 6(1)(a)); you can opt out any time.

4. Advertising data we show

The ads, page names and reach figures in adthief.ai come from Meta’s public Ad Library, which Meta publishes under the EU Digital Services Act for transparency. We process this under our legitimate interest in offering market research (Art. 6(1)(f)). If a page shown is yours and you want it removed, write to [hello@adthief.ai].

5. Who processes data for us

• Supabase (database, sign-in, file storage): servers in Ireland, EU.
• Fly.io (app hosting): servers in Amsterdam, EU; Fly.io is a US company, covered by the EU Standard Contractual Clauses.
• Resend (account emails): under the EU Standard Contractual Clauses.
• Google (Gemini), OpenAI and Higgsfield (AI ads creative): only the images and text you send when you make an ad with them; under the EU Standard Contractual Clauses.

We have data processing agreements with each. We don’t sell your data or share it with advertisers.

6. How long we keep it

Account data: while you have an account, then deleted within 30 days of closing it. Server logs: up to 30 days. Backups roll over within 30 days.

7. Your rights

You can ask to see, correct, delete or export your data, object to or restrict processing, and withdraw consent. Write to [hello@adthief.ai]; we answer within a month. You can also complain to your data protection authority.

8. Changes

If we change this policy in a way that matters, we’ll tell you in the app or by email first.