Last updated: October 20, 2026
This Privacy Policy explains how Adslysuite (“we,” “us” or “our”), the company named in Section 26, collects, uses, discloses and protects information when you use our website at adslysuite.com and the Adslysuite platform (together, the “Service”). It applies to website visitors, account holders, people invited into an account by an account holder, and data that reaches us from an advertising account because a customer connected it.
Adslysuite is a cross-channel advertising management platform. Customers connect advertising accounts they already own, and the Service reads data from those accounts, produces recommendations, and — within limits the customer sets — creates or changes campaigns on their behalf. That shape is the key to this policy: most of the data we handle is our customer's own advertising data, and we handle it on their instructions.
Plain meanings for the terms used in this policy.
| Term | Meaning |
|---|---|
| Adslysuite, we, us, our | Adslysuite, the company that provides the Service and the controller described in Section 3. Its registered address is in Section 26. |
| Service | The Adslysuite website, dashboard, APIs, agent and notifications. |
| Customer | The person or company that holds an Adslysuite account and connects advertising accounts to it. |
| Personal data | Any information relating to an identified or identifiable person. A work email address is personal data; an aggregated campaign spend figure is not. |
| Platform | A third-party advertising platform we integrate with — Google Ads, Meta, LinkedIn, TikTok, Pinterest, Reddit or OpenAI Ads. |
| Platform Data | Data we obtain from a Platform's API about a Connected Account, including campaign structures, spend and performance metrics. |
| Connected Account | An advertising account a Customer has authorised us to access. |
| Controller / processor | The party that decides why and how personal data is processed, and the party that processes it on the controller's instructions. Which we are depends on the data — see below. |
| Sub-processor | A third party we engage to process data on our behalf in order to run the Service. |
| Cookie | A small file a site stores in your browser, used here to keep you signed in and remember settings. |
We wear two hats, and which one applies changes both your rights and who you should contact.
Where we act as a processor, our processing is governed by our agreement with that customer, including a data processing addendum where one applies.
We do not collect special-category data such as health, biometric or political data, and we ask that you do not enter it into the Service.
When you connect a Google Ads, Meta, LinkedIn, TikTok, Pinterest, Reddit or OpenAI Ads account, you authorise Adslysuite through that platform's own OAuth flow to access it through the platform's official API. We request the narrowest scopes the features you use require. Depending on the platform and the permissions you grant, we may access:
What we do with it. We use this data only to provide the Service to the customer who connected the account: to display it, to normalise it across platforms so figures are comparable, to produce recommendations, forecasts and reports, to detect problems such as runaway spend or broken conversion tracking, and — where the customer has authorised it — to create or change campaigns on their behalf.
What we never do with it. We do not sell it. We do not disclose it to other customers. We do not use one customer's advertising data to benefit another, to build cross-customer benchmarks, or to train general-purpose AI models. We do not use it to target advertising at you or anyone else, and we do not pass it to data brokers.
Conversions we send to a platform. If a customer turns on server-side conversion upload, their website or systems send us conversion events — a purchase or a sign-up, with its value — and we forward each one to the platforms the customer chose, so those platforms can measure the customer's ads. An event can carry details about the customer's own visitor: an email address or phone number, which we convert to a one-way SHA-256 hash as it arrives and never store in readable form; an IP address and browser user agent; the platform's click ID; and the page address. We keep these identifiers only when the event says the visitor consented, and store the event without them otherwise. We send an event only to the platforms the customer mapped it to, and use it for nothing else. The customer is the controller of this data and is responsible for collecting it lawfully and for obtaining any consent it needs.
This section describes specifically how we handle data obtained through Google APIs, including the Google Ads API.
Adslysuite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice that means each of the following. We state them individually because the commitment only means something if it is specific.
Your advertising through Google remains subject to the Google Ads policies. You can revoke our access at any time from your Google account permissions page, or by disconnecting the account in Adslysuite; Section 18 says what then happens to the data.
When you connect a Meta (Facebook and Instagram) advertising account, we process Platform Data through the Meta Marketing API in accordance with the Meta Platform Terms and Developer Policies. Specifically:
When you connect TikTok, you sign in on TikTok's own authorisation page and choose which TikTok For Business advertiser accounts Adslysuite may use. We then work through the TikTok API for Business (the Marketing API) under the TikTok API for Business terms. We do not use TikTok Login Kit, and we never see your TikTok password.
We do not access anyone's personal TikTok account, videos, followers, comments, messages or viewing activity, and we receive nothing about the people who see your ads beyond the totals in TikTok's reports.
Only what you or your configured agent ask for: the campaigns, ad groups and ads you publish, the images and video you upload for them, the changes you approve, and — if you turn on conversion upload — conversion events, with hashed email and phone, IP address, user agent and TikTok click ID as described in Section 5.
When you disconnect TikTok in Integrations, we revoke the access token at TikTok, delete it from our systems at once, stop all reading and agent activity on those accounts, and delete the performance data we pulled from them within 30 days. If the same TikTok login is still connected to another of your workspaces, we keep the token for that workspace and tell you so, because revoking it would disconnect that one too. Conversion events stay with the workspace that sent them until the workspace is deleted, or sooner if you ask. Section 17 and Section 18 give the full detail, and your use of TikTok itself remains subject to TikTok's Privacy Policy.
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases under the GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the Service under your plan | Performance of a contract — Art. 6(1)(b) |
| Billing, tax and accounting records | Contract and legal obligation — Art. 6(1)(b), (c) |
| Security, abuse prevention, debugging, product improvement | Legitimate interests — Art. 6(1)(f) |
| Non-essential cookies and marketing email | Consent — Art. 6(1)(a), withdrawable at any time |
| Responding to legal process | Legal obligation — Art. 6(1)(c) |
Where we process advertising data on a customer's instructions, that customer determines the legal basis and we act as their processor — see Section 3.
The Service includes an agent that analyses advertising data and can change campaign settings. We describe it here because you are entitled to know when software is making decisions that move money.
Features such as campaign planning, ad copy generation, image and video generation and the analyst send relevant account, campaign and performance data to third-party AI model providers to produce a response. We use these providers under API or enterprise agreements that prohibit them from using your data to train their general-purpose models, and we send only the context a feature needs. Prompts and outputs are retained as part of your account data, along with the model and prompt version used, so a result can still be explained after the fact. On eligible plans you may supply your own model provider credentials, in which case that data goes to your own account with that provider under your own agreement with them.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose it only:
We use the following categories of sub-processor to run the Service. We remain responsible for how they handle data we entrust to them, and we will post material changes here before they take effect.
| Category | Purpose | Data involved |
|---|---|---|
| Cloud hosting & database | Running the application and storing your data | All categories |
| Object storage & CDN | Storing and serving generated images and video | Creative assets |
| Payment processing | Taking payment as merchant of record, invoicing, tax | Billing data |
| Transactional email | Alerts, digests, password resets, service notices | Name, email, alert contents |
| AI model providers | Generating plans, copy, creative and analysis | Prompt context: campaign and performance data |
| Error monitoring & analytics | Diagnosing faults, understanding product usage | Log, device and usage data |
A current list naming each sub-processor and its processing location is available on request from privacy@adslysuite.com.
We use strictly necessary cookies to keep you signed in, protect against cross-site request forgery, and remember interface settings such as your light or dark theme preference. These are required for the Service to work. We also use a small number of analytics cookies to understand how the Service is used; where consent is required we ask before setting them, and you can withdraw it at any time. We do not use advertising or cross-site tracking cookies on our website, and we do not sell or share what cookies collect. You can control cookies in your browser, though blocking strictly necessary ones will stop parts of the Service working. We honour the Global Privacy Control (GPC) signal where it applies.
The Service links out to places we do not control: each Platform's own dashboard, the help pages and policy documents of the Platforms, your own landing pages, and our sub-processors' sites. Following one of those links takes you to a service with its own privacy policy and its own practices, and we are not responsible for what it collects or how it behaves. Read the policy of any site you are asked to give information to.
Where the Service displays a landing page of yours for checking — for example when validating that an ad's destination works — we fetch it as an ordinary visitor. We do not inject anything into your site, and we do not place cookies on it.
We keep data only as long as we need it, and the periods differ by type because the reasons do:
| Data | Retention |
|---|---|
| Account and profile data | While the account is active; deleted within 30 days of closure |
| Advertising data pulled from connected accounts | While the account is connected; deleted within 30 days of disconnection |
| OAuth access and refresh tokens | Deleted immediately on disconnection or account closure, and revoked at the same time at Google, Meta, Reddit and TikTok. LinkedIn and Pinterest offer us no way to revoke, so there it is a step you take — see Section 18 |
| Action ledger — what was proposed, approved and executed | Up to 24 months. The ledger exists to be readable after the fact, including in a billing or platform dispute, which is why it outlives the metrics behind it |
| Conversion events sent for upload, including hashed email and phone, IP address, user agent and click IDs | While the workspace that sent them exists; deleted with it, or sooner on request. Emails and phones are only ever held as a SHA-256 hash |
| Generated creative and copy | While the account is active, or until you delete the asset |
| Billing and tax records | As required by law, typically 7 years |
| Security and application logs | Up to 12 months |
| Backups | Rolling, overwritten within 35 days |
Where we must keep something longer for a legal, tax or dispute reason, we restrict it to that purpose rather than carrying on using it.
This section is also our data deletion instructions for the advertising platforms we integrate with, including Meta. There are three routes. The first two are self-service in the product; the third is handled by email, to the timeframes stated.
Revoking our access directly with a platform — from your Google account permissions, or Facebook Settings → Business integrations — also stops all further access immediately. On its own it does not delete what we already hold, so use one of the three routes above if that is what you want.
We use administrative, technical and physical safeguards designed to protect your information: encryption in transit (TLS), encryption of OAuth tokens and secrets at rest, scoped least-privilege API permissions, role-based access control, audit logging of actions taken in the Service, separation of customer data, and regular dependency and vulnerability patching. Access to production data by our personnel is limited to those who need it to operate or support the Service, and is logged.
No method of transmission or storage is completely secure and we cannot guarantee absolute security. If a personal-data breach affecting you occurs, we will notify affected customers and the relevant supervisory authorities without undue delay and within the timeframes applicable law requires. To report a suspected vulnerability, email security@adslysuite.com; we will not pursue good-faith security research that respects our customers' data.
Depending on where you live, you may have the right to access a copy of your personal information, correct it, delete it, receive it in a portable format, object to or restrict certain processing, and withdraw consent you previously gave. You may also complain to your local data protection authority.
To exercise any of these, use the self-service routes in Section 18 or email privacy@adslysuite.com. We verify requests — usually by confirming control of the account email — and respond within 30 days, or tell you why we need longer, up to the maximum applicable law allows. We will not charge you or degrade your service for asking. If your data sits inside a customer's advertising account rather than an account of your own, see Section 3.
If you live in California or another US state with a comprehensive privacy law, you have the rights to know, access, correct, delete and port your personal information, to opt out of its sale, sharing and use for targeted advertising, and not to be discriminated against for exercising them.
We do not sell personal information, and we do not share it for cross-context behavioural or targeted advertising. We have not done so in the preceding 12 months, and we do not knowingly process the personal information of anyone under 16 for those purposes. The categories we collect, why, and who receives them are in Sections 4, 8 and 12; retention is in Section 17. We do not use or disclose sensitive personal information for purposes that would carry an opt-out right. You may use an authorised agent if you give them written permission we can verify. Send requests to privacy@adslysuite.com.
If you are an employee, contractor or job applicant of Adslysuite, we process the personal data needed to recruit, pay, manage and support you, and to meet our employment, tax and health-and-safety obligations. We use it for no other purpose, disclose it only to the sub-processors and authorities that those purposes require, and keep it for the periods employment and tax law prescribe. Unsuccessful applicants' data is deleted within 12 months of the decision unless you ask us to keep it on file. The rights in the rights section apply to you too; address requests to privacy@adslysuite.com.
We are established in [country of establishment] and use sub-processors in other countries, so your information may be processed outside the country you live in, including in the United States. Where we transfer personal data out of the EEA, the United Kingdom or Switzerland, we rely on an adequacy decision where one covers the transfer, and otherwise on the European Commission's Standard Contractual Clauses — with the UK Addendum where applicable — together with additional technical and organisational measures. You can request a copy of the relevant mechanism from privacy@adslysuite.com.
The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18, and accounts may only be created by adults. If you believe a child has given us information, contact us and we will delete it.
We may update this Privacy Policy as the Service or the law changes. For material changes we will give notice — by email to account holders, or in the product — at least 14 days before they take effect, unless a change must apply sooner for legal reasons. The “Last updated” date above always reflects the current version, and prior versions are available on request.
For privacy questions or requests, or to reach the person accountable for data protection at Adslysuite:
If you are in the EEA or the UK and are not satisfied with our response, you may complain to your local supervisory authority.