Draft for review. Not reviewed by a lawyer, and not in force. What is undecided, or does not exist yet, is marked like this: [ADDRESS]

Privacy notice for clients

What Adcato does with personal data when you open a request link from an agency. You see this, together with the terms for clients, before you sign in.

Version 2026-11-15.draft5

The short version

We use your sign-in for at most 30 minutes, then revoke it and delete it.
Your name is kept only until your session ends. The agency never gets it.
We keep which accounts you chose and what was given, for the agency that asked.
No advertising, no tracking cookies, no sale of data. Hosted in the EU.

Who is responsible

Autodash AS, organisation number 937 911 203, Kalfarveien 78C, 5022 Bergen, is responsible for the personal data described here (the controller). Contact: support@adcato.com.

[ROLE TO BE CONFIRMED IN LEGAL REVIEW] We are responsible for your sign-in and the session. The record of what you shared with the agency is kept for the agency, which is responsible for it; we keep it on its behalf. The agency is also responsible for what it does with the access you give it.

What we process

What we process, why, and for how long
What	Why	How long
Who signed in: from Facebook your name and Meta’s ID for you in our app; from Google your email address, Google’s ID for your account, and your name if Google sends it	To show you which account is signed in	Until your session ends: when you choose Finish or Change account, or after 24 hours without activity. The agency never gets it
Your access token from Meta or Google	To read which accounts you can share, to give access when you click, and to check that a step you did on Meta’s own screen worked: in the box, and after you close it, by our server while the token lasts. That check reads only which businesses are partners on the account you chose, and with which tasks	At most 30 minutes, encrypted. Then revoked and deleted
What the agency’s own Meta sign-in reads if a step you did on Meta’s own screen is still waiting when your token is gone: which accounts client businesses have shared with the agency’s Business Manager (their IDs, and the agency’s tasks on them)	To confirm that the step gave the agency access, so that you do not have to come back	Read by our server until the step is confirmed, at most 14 days. Only the answer (given, or still waiting) is kept, with the agency’s record
What you pick while you work: the business and the accounts	So that you do not have to start again between steps	Until your session ends, and at most 6 hours
The accounts you choose to share: name, ID and the business that owns each; what was given, to whom, what is waiting and what failed	To carry out your request, and as the agency’s record of it	Kept for the agency until it deletes this client, or its account. [RETENTION TO BE DECIDED]
What you type when you give access on a platform’s own screen: the address of your store or site, or the ID of an account	So that the agency knows which store, site or account it is	With the agency’s record
A code you paste so that the agency can send you a request to accept, such as a store’s collaborator request code	So that the agency can send that request	Encrypted. Deleted when the agency has sent the request, and at the latest after 14 days
Accounts you do not choose	They are shown so that you can choose	Not kept
Other people with access to a Google account you choose: their email addresses and roles	To see whether the agency’s Google address already has access, and with which role	Read at that moment and compared. Never stored
The name of your business, when the agency left it empty: the name of the Business Manager or the first account you choose	To label the request for the agency	With the agency’s record
Which version of the terms and of this notice you accepted, and when; your language	To show afterwards what you agreed to	With the agency’s record
A keyed hash of your IP address	To limit and investigate misuse	30 days after the session was last used. The same hash is also on the activity log lines your session writes, and is cleared there 30 days after each line was written
One session cookie, and a hash of its secret	So that only your browser can continue your session	The cookie lasts 2 days. The hash is deleted 7 days after the session was last used
What you write if you use “Report this request”: the reason you choose, your line (at most 300 characters), the language, the link and the time. No IP address and no contact details	To stop phishing and misuse. Our staff read it; the agency is not told	Until our staff have handled it, then 180 days
What you write if you use “These steps don’t match what I see”: which step, your line (at most 300 characters), the language, the link and the time. No IP address and no contact details	So that we can correct the steps. Our staff read it; the agency is not told	180 days

On Facebook we read which businesses are partners on an asset, not which people.

What we do not collect

Your Meta or Google password, two-factor codes or passkeys. You enter those on Meta’s and Google’s own pages.
A key that outlives the session.
Ad results, spend, audiences or creative material.
Card or payment details.
Analytics or advertising cookies. The pages you see load no scripts from third parties.

Why we are allowed to

[LEGAL BASIS TO BE CONFIRMED IN LEGAL REVIEW] The basis we propose is legitimate interest (GDPR Article 6(1)(f)):

Yours and ours in carrying out what you ask for through the link.
Ours in preventing misuse of request links.
For the record kept for the agency afterwards, the agency is responsible for the basis.

Who receives the data

The agency that sent the link: the accounts you chose, what was given and the status of each step. Not your name or your email address.
Meta and Google: we call their systems with your sign-in. They already hold the data in your accounts and handle it under their own terms.
Hetzner, which rents us the server in Finland that the service runs on, as our processor.
[MAIL PROVIDER: NOT CHOSEN], which sends the agency its mails about clients. They name your business as the agency’s dashboard does, and carry nothing from your accounts.
Authorities, where the law requires it.

We do not sell personal data, and we do not use it for advertising.

Where the data is

Our servers are in Finland, in the EU. [TRANSFERS OUTSIDE THE EEA TO BE CONFIRMED WHEN THE EMAIL PROVIDER IS CHOSEN] Meta and Google process data in their own systems worldwide, as they already do for your accounts.

Data from Google

Adcato’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. We use it only to show you your accounts and to give the access you choose, never for advertising, and we do not sell it.

Deleting your Facebook data

On Facebook, remove our app and send a deletion request (Settings & Privacy > Settings > Apps and Websites). Meta passes it to us, and we delete your token and your name from every session you signed in to. The agency’s record of what you shared stays: ask the agency to delete it, or write to support@adcato.com and we pass the request on.

Your rights

You can ask us for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict how we use it, or to object to our use of it. Write to support@adcato.com. Once your session has ended we keep no name, email address or platform ID for you, so tell us the agency, the link or the date, and we will look for what we hold.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet), or to the authority in your own country.

How it is protected

Tokens are encrypted and short-lived, each agency’s data is kept apart from every other agency’s, and names are kept out of our logs. The security page describes this in detail, including what is not in place yet.

Changes

This notice carries a version. We store which version you were shown. If it changes, the next link you open shows the new version.