Legal
Privacy Policy
Last updated: 12 October 2026 · Version 1.4 · Written to be read, not to be survived.
On this page
1. Who is responsible for your data
The controller for the data described here is Mark Martonfi, who operates Adspenta, in Romania. You can reach us at hello@adspenta.com.
Where you use Adspenta to manage ad accounts for your own clients, you are the controller of that ad-account data and we act as your processor. The subprocessor list is public and dated. The Data Processing Agreement that governs this is being written and will be published with it [DPA: to be published once the company is registered].
2. What we collect
Account and user data
The name and email address of each person on your team who has a login, your agency's name, the tenant they belong to, their role, and the timestamps of their sessions. If you pay us: the billing name, address and VAT number you give at checkout, the email address, and the record of each payment. You enter your card on a page run by our payment processor, Stripe; Stripe holds the card, and we never see or keep the full card number.
Ad account data, read through the Meta and Google APIs
Only what is needed to notice that something is drifting and to propose a fix:
- Structure. Campaigns, ad sets, ads, their names, status and schedules.
- Budgets. Daily and lifetime budgets, bid settings, and their history.
- Performance metrics. Spend, impressions, clicks, results, cost per result, frequency and click-through rate, aggregated by day.
- Creatives. Ad-level metadata and delivery figures, so creative fatigue can be detected.
- Account state. Disapprovals, delivery limits, learning-phase status.
- Who connected it. For each connection, the platform's identifier of the login that authorised it (for Google, the Google account's internal ID, not its email address), so that disconnecting one agency's access never cuts off another connection made with the same login.
We do not receive, request or store individual-level data about the people who see or click your clients' ads. Adspenta reads aggregate ad-account reporting. It has no customer lists, no audience members, no personal data of end consumers.
If you request access
What you type into the request-access form: your name, your agency, your email address, how many ad accounts you manage and on which platforms, with the time you sent it and the consent you gave. It is stored in our own database, on the same servers in the EU as the service, and used only to reply to you. When it arrives, our staff get a short alert with your name, agency and email address, through the alert channel named in section 6. To stop the form being abused, a scrambled (keyed-hash) form of your IP address and of your email address is kept apart from your request for at most two days, and then deleted; your IP address itself is not stored.
If you visit this website
The website’s host, Vercel, receives each request as any web host does: your IP address, the page, your browser’s description and the time. If you accept the cookie banner, Google also receives your visits, as section 9 says. If you choose a theme or colour, or answer the banner, that choice is kept in your own browser, not with us.
Usage and audit logs
What happened in the product: proposals, approvals, declines, take-backs, executions, verifications, blocked actions and setting changes, and every time our staff open something of yours. These carry a timestamp and the person responsible, and they are append-only.
3. Why, and on what legal basis
| What | Why, and the basis under the GDPR |
|---|---|
| Account and user data | To give your team logins and run the service you asked for. Performance of a contract (Art. 6(1)(b)). |
| Ad account data | To read, detect, propose, execute what you approve, verify and report. Performance of a contract, and for your clients' data, on your instructions as processor. |
| Audit ledger and access log | So every change and every access can be accounted for afterwards, by you and by your clients. Legitimate interest (Art. 6(1)(f)) in an accountable, non-repudiable record, and a contractual promise we make to you. |
| Access requests | To reply to the request you sent. Your consent, given on the form (Art. 6(1)(a)). You can withdraw it at any time by writing to hello@adspenta.com, and we delete the request. |
| Advertising measurement on this website | To learn whether our own Google ads lead to free trials or requests for access. Your consent, given in the cookie banner (Art. 6(1)(a), and Law 506/2004 for the cookie itself). You can withdraw it at any time with Cookie settings at the foot of every page. |
| Website requests | Serving this website and keeping it safe. Legitimate interest (Art. 6(1)(f)). |
| Billing records | Invoicing and tax. Legal obligation (Art. 6(1)(c)). |
| Security and error logs | Keeping the service up and finding abuse. Legitimate interest (Art. 6(1)(f)). |
We do not sell data, we do not run advertising of our own on it, and we do not use one customer's data to improve anything another customer sees.
4. How long we keep it
| Category | Retention |
|---|---|
| Ad account data | While your agency uses the service. Disconnecting an account stops any further reading from it; what was already read stays with your agency, so its history still reads correctly, until the agency is deleted: seven days after an owner deletes it in the app, or within 30 days of termination or a deletion request by email. |
| Proposals, findings, reports | Same as above. |
| Account and user data | While you have an account, and deleted with the agency, as above. |
| Audit ledger | As long as your agency exists, append-only. Deleted with the agency. What remains is one line in our operator log recording that an agency of that name was deleted on that date, at its owner's request or by us, and nothing else. See data deletion. |
| Access requests | Until you ask us to delete yours or withdraw your consent; we then delete it within 30 days. It is not deleted on a timer. |
| Your cookie and theme choices | In your own browser, until you change them or clear your browser’s site data. We hold nothing. |
| Google Ads cookie | Set only after you accept. Google’s conversion cookie lasts up to 90 days in your browser; what Google keeps is under Google’s own terms. |
| Website request logs | [to confirm: how long Vercel keeps request logs on our plan] |
| Billing records | As long as tax law requires, then deleted. |
| Backups | Rolling and encrypted: our server keeps the fourteen most recent, and the off-site copy keeps each one for 30 days. |
5. Where it is stored
In the European Union. The service runs on infrastructure operated by Hetzner Online GmbH, in Helsinki, Finland. Backups are encrypted on the server before they are kept, and a copy is stored off the machine that produced them, at Hetzner in Falkenstein, Germany. The key that opens them is not stored there.
Requests to Anthropic's language models, the alerts our staff receive through Telegram, the hosting of this website by Vercel, card payments through Stripe, and, only if you accept it, the Google Ads tag on this website, are the processing steps that may be performed outside the EU; what is sent is described below and in the subprocessor list.
International transfers
Language-model requests to Anthropic PBC, in the United States, leave the European Economic Area. The lawful basis for that transfer is [to confirm: Standard Contractual Clauses under Commission Decision 2021/914, and reliance on the EU-US Data Privacy Framework where the receiving entity is certified]. The transfer mechanism actually signed will be named here, with its date, before the entity starts trading.
What crosses the border in those requests is a snapshot of ad-account metrics, described in section 6. It contains no personal data of end consumers, because we do not hold any.
Our staff's alerts go through Telegram, whose servers are not all in the EEA; what an alert carries is set out in section 6. The transfer mechanism for it is [to confirm: the safeguard Telegram offers for transfers from the EEA]. Everything else stays on EU infrastructure.
This website is served by Vercel Inc., in the United States. The transfer mechanism is [to confirm: Vercel’s Data Processing Addendum, and the EU-US Data Privacy Framework or Standard Contractual Clauses].
If you accept the cookie banner, Google receives data from the Google Ads tag, and may process it in the United States. The transfer mechanism is [to confirm: Google’s EU-US Data Privacy Framework certification and the Google Ads data protection terms].
6. Who else processes it
We use a small number of subprocessors, listed in full and dated on the subprocessors page:
- Hetzner Online GmbH. Hosting and infrastructure, Finland and Germany, and the off-site copies of our backups, which are encrypted before they leave our server; the Storage Box they go to does not hold the key.
- Anthropic PBC. Language-model requests. What is sent is a snapshot of ad-account metrics: campaign names, budgets, spend, results and the other figures you can see on your own screen, so the model can explain them or draft an update. No personal data of end consumers is sent, because we do not hold any. The model cannot call the ad platforms and cannot execute anything.
- Telegram. Delivers alerts to our own staff's phones: a failed backup or job, a new access request, an agency asking to be deleted. An alert can carry an agency's name, an ad account's name and platform ID, and the name and email address of a person who requested access or asked for their agency to be deleted. The sign-up form inside the product, when it is switched on, also sends the sender’s IP address and the note they typed. Never campaign data, access tokens or passwords.
- Stripe (Stripe Payments Europe, Limited, Ireland). Card payments, the subscription and its invoices and receipts: your billing name, address, email, VAT number if you give one, and your card, which Stripe holds and we never see in full. Stripe may process this in the United States. [to confirm: transfer basis, from Stripe’s data processing terms]
- Zoho [to confirm: contracting entity]. The company mailbox, hello@adspenta.com: every email you send us, including deletion requests and privacy questions. [to confirm: data centre and transfer basis]
- Vercel Inc. Hosts this website, adspenta.com, but not the product. It sees each request to the website, as section 2 says.
- [email provider, to be chosen] for transactional email, once chosen.
We name each subprocessor here before it starts processing anything, and the subprocessor page carries the date of every change. Telegram is the exception to that promise: it carried our alerts before it was listed, and was added on 24 September 2026, when we noticed.
7. Platform data from Meta and Google
Data obtained through the Meta and Google advertising APIs is used only to provide this service to you: to read your accounts, detect problems, propose changes, execute the ones you approve, verify them, and report on them.
We do not sell it. We do not share it with advertisers or data brokers. We do not use it to build, enrich or target audiences for anyone. We do not combine one customer's platform data with another's. We do not use it to train models.
Access tokens are encrypted at rest and bound to the connection they belong to. Disconnecting an account deletes our copy of the token; the data deletion page says what is also handed back to each platform.
8. How we protect it
- Each agency's data is separated in the database itself, by row-level security, so a query that forgets to filter returns nothing rather than someone else's data.
- Platform access tokens are encrypted and bound to their connection.
- Data is encrypted in transit, and backups are encrypted before they leave the server that made them, and the key is not on the off-site backup storage.
- From the operator console our own staff cannot see your campaign list, creatives, audiences or per-campaign performance. They can see account names, budgets, month-to-date spend, connection status and your most recent ledger entries, which can name a campaign: the security page lists exactly what, in both directions. For support, an operator may open your own screens read-only, for a limited time; that session and each screen opened are logged. Every such read is logged and shown to you. When a person in your agency, or its owner, asks, an operator may reset that person’s password; the reset, the operator’s name and the reason are recorded in your ledger and access log.
- Seven rounds of review, run by us, have tried to break all of the above; what they changed is in the changelog.
The plain-English version, with more detail, is on the security page.
9. Cookies and tracking
This website sets no cookies and loads nothing from anyone else until you choose. The typefaces are served from this domain, and there are no analytics, social or video embeds, or chat widget. The site’s host, Vercel, sees each request as any web host does (section 2).
One question, asked once. A banner asks whether you accept one advertising measurement tag: the Google Ads tag (Google tag, account AW-18487173979). Accept and Reject are the same size and one click each. Until you choose, and if you reject, nothing is loaded from Google and nothing is sent to it. The site uses Google Consent Mode v2 with every purpose set to denied by default.
If you accept, the tag is loaded from Google, Google may set a cookie in your browser (for up to 90 days) and it receives the page you visited, the ad you came from and your IP address, so that our Google Ads account can count a free trial started, or a request for access sent, from this site. We do not use it for remarketing or personalised advertising. Google processes this under its own terms [to confirm: the Google Ads data protection terms that apply, and whether Google acts as controller or processor].
Your choice is kept in your browser’s local storage, not in a cookie, so the banner does not come back on every page. Change it at any time with Cookie settings at the foot of every page; rejecting after accepting stops the tag at once, and you can clear Google’s cookie in your browser. A theme or colour you pick on this site is kept the same way, only after you pick it.
The product sets one cookie. When you sign in at app.adspenta.com, a single strictly necessary session cookie keeps you signed in. It holds a session identifier and nothing else. It is not used for analytics, profiling or advertising, and it is not shared with anyone. The product also keeps your theme, your accent and the platform you last looked at on Campaigns in your browser’s local storage, after you choose them.
10. Your rights
If you are in the EU or the UK you have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to have it sent to another provider in a portable form. Where we rely on legitimate interest, you can object and we will either stop or explain why we cannot.
Write to hello@adspenta.com. We answer within 30 days. Deleting an account is described step by step on the data deletion page.
If you are unhappy with how we have handled it, you have the right to lodge a complaint with a supervisory authority. You may complain to the authority in the EU country where you live or work, or where you think the problem happened. Ours will be the Romanian authority, the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, telephone +40 318 059 211, dataprotection.ro. It becomes our lead authority once the operating entity is registered in Romania, which is [pending: entity not yet registered].
11. Contact, and whether we have a DPO
We are not required to appoint a Data Protection Officer, and we have not appointed one. Rather than leave that unsaid: privacy questions go to hello@adspenta.com and are answered by the people who built the system, not by a ticket queue.
Postal address for formal notices: given on request by email.
Version history
| Version | Date and what changed |
|---|---|
| 1.0 | [date]. First published version. |
| 1.4 | 12 October 2026. Sections 2, 5 and 6: paying for Adspenta now goes through Stripe, which receives your billing details and card; we never see the full card number. Sections 3 and 9: the Google Ads tag, if you accept it, also counts a free trial started from this site. Sections 1 and 11: the controller is named as Mark Martonfi until the company exists, in place of the bracketed entity fields. |
| 1.3 | 8 October 2026. Section 9 and sections 2 to 6: this website now asks before loading the Google Ads tag, with Accept and Reject equally easy, and nothing is sent to Google before you accept; the tag, its cookie, its purpose and the transfer are described. Sections 2, 5 and 6: Vercel, which hosts this website, and Zoho, which holds our mailbox, are named; they were missing. Section 5: the service runs in Helsinki, and only the encrypted backup copies are in Germany, where this page used to call Germany a secondary region. Section 2: what the usage and audit logs actually hold. Section 8: what our staff see of your ledger, and where the backup key is not. Section 1: the Data Processing Agreement is being written; it was described as available. |
| Editorial | 6 October 2026. Section 8: punctuation only, one dash became a colon. Section 9: "the two typefaces" became "the typefaces", because the site now also serves Lora from this domain. No meaning changed. |
| 1.2 | 30 September 2026. Section 8: an operator may reset the password of someone in your agency when that person or its owner asks; the reset, the operator’s name and the reason are recorded in your ledger and access log. |
| 1.1 | 24 September 2026. Section 8: an operator may open your own screens read-only for support, for a limited time, with each screen opened recorded in your access log. Section 4 and the deletion page: an owner can delete the agency in the app, erased seven days later; the audit ledger is deleted with it, and only a one-line record of the deletion remains, where this page used to say the ledger and access log were kept in anonymised form; data from a disconnected account stays until the agency is deleted, where this page used to say 30 days. Sections 2, 3 and 4: what the request-access form stores, and for how long. Sections 5, 6 and 8: backups encrypted before they leave our server, the off-site copies named (Hetzner, Germany), and Telegram listed for our staff's alerts. Section 7: disconnecting deletes our copy of the token and hands the authorisation back to the platform, except while another connection may still be using the same login. Section 2: the identifier of the login that authorised each connection. |