Privacy policy

Who this policy is for

• people who work at an agency that uses Adcato;
• the agency’s clients, who open a request link and sign in with Facebook or Google;
• people who report a request link;
• people we contact about the service;
• partners in our partner programme (not built yet);
• visitors to this site.

Clients also see a short privacy notice before they sign in on a link (/legal/client-privacy). It describes the client’s session in the same way as section 3.3.

1. Who we are

Autodash AS, organisation number 937 911 203, Kalfarveien 78C, 5022 Bergen, Norway, is the controller for the personal data described here, except where section 2 says otherwise.

• Contact for privacy questions: support@adcato.com.
• [DATA PROTECTION OFFICER: NONE APPOINTED. WHETHER ONE IS REQUIRED IS TO BE ASSESSED]
• [REPRESENTATIVE IN THE EU OR THE UK: WHETHER ONE IS REQUIRED IS TO BE ASSESSED]

2. Our role

[ROLES TO BE CONFIRMED IN LEGAL REVIEW]

• Agency accounts, billing, security and preventing misuse: we are the controller.
• The records an agency keeps in Adcato about its clients (its links, which accounts a client chose, what access was given): we act as the agency’s processor. The agency is the controller, and its own privacy notice applies.
• A client’s session on a request link (the sign-in with Facebook or Google, and what we do in the client’s accounts on the client’s click): we are a controller in our own right. The privacy notice for clients says the same.

3. What we collect, why, and on what basis

[LEGAL BASES TO BE CONFIRMED IN LEGAL REVIEW] The bases below are proposals. “Contract” means GDPR Article 6(1)(b), “legal obligation” Article 6(1)(c) and “legitimate interest” Article 6(1)(f).

Where the data comes from. Most of it you give us yourself, or it arises when you use the service. The exceptions:

• a colleague’s email address comes from the person at the agency who invites them;
• the Google address that receives access for an agency (3.1) is typed in by someone at the agency;
• what we read from Facebook and Google (sections 3.2, 3.3 and 4) comes from Meta and Google, with the signed-in person’s own sign-in;
• the client name on a link is typed in by the agency, or taken from the client’s Business Manager or account (3.3);
• data about people we contact comes from the agency’s own website, a public directory or register, or the person (3.5).

3.1 People who work at an agency

Card details are entered on Stripe’s own page. We never see or store them. When an owner chooses a plan, we create the agency as a customer at Stripe with the agency’s name, the owner’s email address, the agency’s ID and the owner’s language. If VAT is collected at checkout, Stripe also asks for the billing address, the legal name and the VAT number. [WHETHER VAT IS COLLECTED AT CHECKOUT: TO BE DECIDED WITH THE ACCOUNTANT]

Mails we send to agency people: confirming your address, resetting your password, changing your address (and a note to the old one), a note when someone tries to sign up with an address that already has an account, the link that finishes a sign-up with Facebook, a note when Google or Facebook is connected to your account, team invitations, the notice that you have become the owner, and, when “Mail about clients” is on for you, one mail when a client has finished and one if a client is stuck. Once billing is switched on, the agency’s owners also get mail about its plan: that billing was switched on, a trial about to end or ended, a failed payment, a subscription that ended, and links about to stop taking new clients. When the agency’s Google sign-in stops working while a Google Ads link is open, the people who can connect it and have “Mail about clients” on get one mail. A mail about a client names the client as your dashboard does, and carries nothing from the client’s Facebook or Google accounts. We send no newsletters and no marketing mail.

The Google address that receives access. When a link asks for Google Analytics or Tag Manager (or Google Ads without a manager account), the agency names the Google address that should receive access. By default it is the Google account the agency connected. We store it with the link and its template, and give it to Google when the client gives access, so the client sees it among the users of their account. It is part of the agency’s record of the link, which we keep as the agency’s processor (section 2), so it stays with the agency’s records when the person deletes their own account.

Who receives access on other platforms. Where a platform adds people by email address or by name, the agency types once who should receive access: an email address, an account ID, or a person at the agency (the address of their LinkedIn profile and the name on it; or a first name, last name and email address). We store it for the agency, with each link that uses it, and show it to the client who opens that link, marked as given by the agency. Anyone in the agency can change it on Connections; it is in the agency’s export and is deleted with the agency.

Who can see it: your colleagues in the agency see your name and email address. The owner can download them in the agency’s export. Our staff can see everything, and use that only to run and support the service and to investigate misuse.

3.2 An agency’s own Facebook and Google sign-in

When someone at an agency connects Facebook or Google under Connections, we keep:

• the access key Meta or Google gives us, encrypted (from Google, a key that can be renewed);
• the platform’s ID for the person, their name, and their email address (from Google, and from Meta only if the person allows it);
• the Business Managers or Google manager accounts the platform listed for that person.

We use it to show who connected, to let the agency choose which business receives access, and for Google Ads to send the agency’s manager-account request to a client’s account and to check later whether it was accepted. For Meta: when a client did a step on Meta’s own screen and closed the box before it was confirmed, and the client’s own sign-in is gone (3.3), our server reads with the agency’s Meta sign-in which accounts, Pages, Instagram accounts and pixels client businesses have shared with the agency’s Business Manager (their IDs, and the agency’s tasks on them), until the step is confirmed or 14 days have passed. Only the answer is kept, with the agency’s record. Basis: as in 3.1.

How long: until the same person connects again (the new sign-in replaces the old one), until the agency’s owner disconnects it (Connections > Disconnect: we delete it, and revoke it at Meta or Google), until they delete their account, until the agency is deleted, or until Meta sends us a deletion request for them (section 4). A sign-in that stops working (Meta’s ran out, the person removed our app, or Google no longer accepts it) is deleted 30 days after it stopped. A sign-in waiting for the agency to choose its businesses is deleted after 15 minutes.

3.3 Clients who open a request link

We do not collect your password, two-factor codes or passkeys (you enter them on Facebook’s and Google’s own pages), your ad results, spend, audiences or creative material, or card details. Accounts you do not choose are shown so that you can choose, and are not kept.

Other people with access to a Google account you choose. To see whether the agency’s Google address already has access, and with which role, we read at that moment the list of users of the Google Ads account, Analytics account or property, or Tag Manager account you chose: their email addresses and roles. We compare it with the agency’s address and keep only the answer (given, already there, or there with a lower role). We do not store the list. On Facebook we read which businesses are partners on an asset, not which people.

If the agency left the client’s name empty, we fill it in with the name of the Business Manager you choose, or of the first account you choose.

For what we keep as the agency’s record, we act for the agency (section 2).

[ADD WHEN BUILT: THE ACCESS SCAN, REMOVALS AND RECEIPTS. THE DATABASE IS PREPARED TO KEEP OTHER PEOPLE WITH ACCESS AS COUNTS AND ROLES ONLY, WITH NAMES ONLY ON A RECEIPT, FOR 12 MONTHS]

3.4 People who report a request

“Report this request” on a link page stores:

• the reason you choose: that you do not know the agency, that it asks for more than you expected, or something else;
• the line you write, if you write one (at most 300 characters);
• the language, the link, the agency and the time.

We do not store your IP address, a hash of it or any contact details with the report. Our staff get a mail that the agency has a report, with none of your words in it. The agency is not told. Basis: legitimate interest in stopping phishing and misuse.

3.5 People we contact about the service

[THE OWNER APPROVES THIS SECTION BEFORE THE FIRST EMAIL]

We tell advertising agencies about Adcato by email: first agencies in the United States, then in the United Kingdom and Ireland. We write to the shared address an agency publishes on its own website, such as hello@ or info@. We write to a named person only after they have written to us or said yes to it. We make no cold phone calls and send no sales messages on LinkedIn or other social networks.

• What we note: the agency’s name and website, its state or country, the shared address and the page where we found it; the date and what happened. The name and role of a person only when they write back to us.
• Where it comes from: the agency’s own website; Google’s Partners directory, read by hand (an agency’s name and website); for agencies in the United Kingdom, the public register at Companies House (a company’s name and line of business); and the person, when they answer. We look at LinkedIn only to see how many people work at an agency, and note nothing about people from it. We buy no lists, add no data from other sources, and never guess a person’s address.
• Why, and the basis: to tell agencies about Adcato and follow up. Legitimate interest in direct marketing (GDPR Article 6(1)(f) and recital 47). GDPR applies to us wherever the agency is, because the company is established in Norway.
• What each email says: that it is an advertisement, who sends it and our postal address, where we found the address, a link to this section, and how to say no.
• How long: [RETENTION TO BE DECIDED: PROPOSED 12 MONTHS AFTER THE LAST CONTACT]. If you say no, we stop the same day, delete what we noted, and keep only what we need to respect the no: the address or the domain, and the date.
• Where it is kept: in [WHERE THE CONTACT LIST IS KEPT], not in Adcato. We give it to nobody else.

Your right to object to marketing

You can object at any time to our use of your personal data for marketing (GDPR Article 21(2)). Reply “no thanks” to our email, or write to support@adcato.com. We then stop using your data for marketing (Article 21(3)), and keep only the note that you said no.

3.6 Partners

[PLANNED: THE PARTNER PROGRAMME IS NOT BUILT. CHECK THIS SECTION AGAINST THE CODE WHEN IT IS]

• What: the name shown with your code; how you promote us; whether you are a business or an individual; legal name, country, organisation number and VAT number; address; payout currency; which version of the partner terms you accepted, and when; your bank details, encrypted; your code, your referrals, commission, payouts and statements.
• Why, and the basis: to run the programme and keep our accounts. Contract; legal obligation (bookkeeping) for payouts and statements.
• What a partner sees about agencies they referred: an anonymous reference, the status and dates. Never the agency’s name.
• The code in a partner’s link is read only to show the visitor the offer they followed. No cookie is set and no clicks are counted.
• How long: commission, payouts and statements for as long as bookkeeping law requires [ACCOUNTANT TO CONFIRM]; bank details until 90 days after you have left and been paid; a code entered at sign-up that was never used for an agency, 30 days.

3.7 Visitors to this site

Public pages set no cookies, store nothing in your browser, and load no scripts, fonts or images from other companies. Our server handles your IP address to deliver the page. Our application does not store it. It counts how often each public page is opened per day, and from which website a visit came, by that website’s name only (such as www.google.com); nothing that identifies you is kept with the count: no IP address, cookie, query string or browser details. [HOST WEB SERVER ACCESS LOG: WHETHER IT IS ON, AND FOR HOW LONG, TO BE SET BEFORE LAUNCH]

4. Data from Meta and Google: what we ask for, and why

We use data from Meta and Google only for these features, which you see on the screen. We do not use it for advertising and we do not sell it. We pass it on only to the agency that sent the link, at the client’s request, to keep the service secure, or where the law requires it. Our staff look at it only to investigate a fault or misuse, or where the law requires it.

Google’s Limited Use requirements. Adcato’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The policy is at https://developers.google.com/terms/api-services-user-data-policy.

4.1 Deleting your Facebook data

• On Facebook, remove our app and send a deletion request (Meta’s page describes this as Settings & Privacy > Settings > Apps and Websites). Meta passes the request to us. We answer at once with a confirmation code and a link to a status page on this site: /data-deletion/ followed by the code.
• What we delete: your Facebook access token; in every client session you signed in to, the working data and your name; an agency sign-in you made with Facebook, and one waiting for its businesses to be chosen; and the Facebook sign-in to your own account, with a sign-up waiting for its mailed link. We keep Meta’s ID for you only until the deletion has run.
• What stays: an agency account you made with your email address (you can delete it in Settings), the Business Managers an agency connected (names of businesses, not of people), the activity log, which never holds Meta IDs, names or email addresses, and the agency’s record of a request you answered: which accounts were chosen (their names and IDs, and the business that owns each), what access was given and when. That record belongs to the agency (section 2). To have it deleted, ask the agency, or write to support@adcato.com and we pass the request on.
• The status page shows “We are deleting it”, “Deleted” with the date, or “Not finished yet”. It never says whose request it is. The code is the only way to it.
• If you only remove the app, without a deletion request, Meta tells us that too. We stop using your sign-in at once and delete any client token from it.
• Access you gave a business on Facebook is not changed by any of this. You manage that in Facebook.
• You can also write to support@adcato.com.

4.2 Google

A client’s Google sign-in is revoked at Google and deleted when the client finishes, and otherwise soon after its 30 minutes run out (section 5 gives the times). An agency’s Google sign-in is deleted when the agency’s owner disconnects it on Connections, when the person deletes their account or the agency is deleted, and revoked at Google at the same time unless the same person’s Google sign-in is still in use in another agency on Adcato. One Google no longer accepts is deleted 30 days later. You can also remove Adcato’s access in your Google Account at any time. To ask for anything else to be deleted, write to support@adcato.com.

5. How long we keep it

When an agency is deleted (Settings > Agency data > Delete agency, or by our staff when they close it), everything that names it goes at once: links, clients, client sessions and tokens, connections, invitations, templates, domains, logo, mail and its record of the accepted terms. Paid invoices stay for bookkeeping, as the table says. Access the agency’s clients gave at Meta and Google is not touched; it lives on those platforms. When the agency deletes one client (the client’s page > Delete client), its link, sessions and tokens, the accounts chosen, what was given and what waits, and its mails’ records go in the same way. So that each Meta business portfolio and Google Ads manager account gets one free trial, we keep, for [2] years after its trial began, a keyed hash of its ID (a code made with our secret key, from which the ID cannot be read back) and the date of that trial, never the ID or a name, also after the agency is deleted.

When you delete your account (Settings > Your account > Delete account), your account, name, email address, your record of the accepted terms, your Facebook and Google sign-ins, the Google and Facebook accounts connected for signing in, invitations to your address, mail to it, and the sign-in service’s log entries about you are deleted at once. An agency you are the only member of is deleted with it.

6. Who receives personal data

• The agency that sent a link: the status of each client, the accounts the client chose and what access was given. Not the name of the person who signed in.
• Meta and Google: when we call their systems with the signed-in person’s token, as described in section 4. They already hold the data in those accounts, and handle it under their own terms.
• Hetzner Online GmbH: rents us the server in Finland that the service runs on, as our processor. We operate the service on it ourselves.
• Stripe, once billing is switched on: handles payments. Stripe acts as our processor, and for some purposes (such as preventing fraud and meeting anti-money-laundering rules) as a controller in its own right, under its own terms.
• [MAIL PROVIDER: NOT CHOSEN]: sends our mail, as our processor.
• Authorities, where the law requires it.

The list of sub-processors (/legal/subprocessors) names each provider, what it does, what data it gets, where, and on what basis.

We do not sell personal data, and we do not use it for advertising.

7. Transfers outside the EEA

• Our servers, with the database and the logs, are in Finland. Hetzner says that data on servers in its EU locations, Helsinki among them, is stored and processed in the EU.
• Stripe: Stripe’s data processing agreement says that personal data goes to Stripe, LLC in the United States. Stripe relies first on the EU-U.S. Data Privacy Framework, under which the European Commission has found that companies on the framework’s list give adequate protection (GDPR Article 45). If that falls away, the EU standard contractual clauses in Stripe’s data transfers addendum apply (Article 46).
• Meta and Google: we send them only what an action needs, on the instruction of the person signed in. They handle it under their own terms, which can include processing outside the EEA. [WHETHER OUR CALLS TO META AND GOOGLE ARE TRANSFERS UNDER GDPR CHAPTER V: LEGAL REVIEW]
• [MAIL PROVIDER: NOT CHOSEN]: [LOCATION AND TRANSFER BASIS DEPEND ON THE PROVIDER CHOSEN]

8. Your rights, and how to use them

You can ask us for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict how we use it, to object to our use of it, and to receive it in a portable form. It costs nothing. We answer within one month. If a request is complex we may need two more months, and if so we tell you within the first month.

Where to do it yourself:

• Export an agency’s data (owner only): Settings > Agency data > Export > Download. One JSON file with the agency, its members’ names and email addresses, its Facebook and Google connections (who connected, never a token), branding, domains, templates, each client and the activity log. It never contains a token, a secret, a hash or the address of a link.
• Delete your account: Settings > Your account > Delete account, with your password (an account made with Google or Facebook and without a password: after signing in with it again).
• Delete an agency (owner only): Settings > Agency data > Delete agency, by typing its name.
• Delete one client and everything recorded about it (owners and admins): open the client, Delete client.
• Disconnect the agency’s own Facebook or Google sign-in (owner only): Connections > Disconnect.
• Change your email address: Settings > Your account (when mail is switched on).
• Turn mail about clients on or off: Settings > Your account > Mail about clients.
• Sign out every browser: Settings > Your account > Sign out everywhere.
• Facebook data: see section 4.1.

Everything else, and anyone without an account (clients, people who reported a link, people we contacted): write to support@adcato.com. Once a client’s session has ended we keep no name, email address or platform ID for the person who signed in, so tell us the agency, the link or the date, and we will look for what we hold.

Objecting. Where we rely on legitimate interest, you can object on grounds relating to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data for a legal claim. You can always object to marketing (section 3.5).

Complaints. You can complain to the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no), or to the data protection authority where you live or work, such as the Information Commissioner’s Office in the United Kingdom or the Data Protection Commission in Ireland. We would like to hear from you first.

Do you have to give us data? An agency account needs a name, an email address and a password, or a Google or Facebook account. A client has to sign in with Facebook or Google to give access through a link. Nothing else is required.

We make no decisions about people by automated means that have legal or similarly significant effects.

9. Cookies

• Scripts cannot read these cookies, and they are sent only to our own site (or to the agency’s link domain, for a link served there).
• No cookie is set on public pages, and we use no analytics or advertising cookies. Nothing is stored in your browser’s local storage.
• We consider all of them strictly necessary for a service you asked for, so they need no consent (ekomloven § 3-15 second paragraph). [CONFIRM FOR THE AGENCY COOKIE IN LEGAL REVIEW]
• Facebook’s and Google’s sign-in pages are theirs. Their cookies and privacy policies apply there.

10. Security

Tokens are encrypted (AES-256-GCM) and short-lived, the database keeps each agency’s data apart from every other agency’s, and our code keeps tokens, names, email addresses and IP addresses out of its logs. The security page (/security) describes this in detail, including what is not in place yet.

11. Changes

This policy carries a date and a version.

• For agency account holders: [HOW AND HOW LONG BEFORE A CHANGE TAKES EFFECT WE TELL THEM. PROPOSED: BY EMAIL AND IN THE APP, 30 DAYS BEFORE, AS FOR THE AGENCY TERMS].
• Clients: we store which version of the client notice was shown. The next link they open shows the current one.
• Before we use data from Meta or Google in a new way, or for a new purpose, we change this policy and ask for consent first.

12. Contact

• Autodash AS, organisation number 937 911 203, Kalfarveien 78C, 5022 Bergen.
• Privacy questions and requests: support@adcato.com.
• Misuse or a security problem: abuse@adcato.com.