Privacy Policy

Last updated: October 24, 2026

1. Introduction and Data Controller

Admazing is an advertising management platform operated by influio s.r.o., ID No. 22238697, with its registered office at Varšavská 715/36, Vinohrady, 120 00 Praha, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague under file no. C 412818 ("we", "us", "our"). We are committed to protecting your privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our advertising management platform at app.getadmazing.com (the "Service").

We act as the data controller for the personal data described in this Policy. Where the Service is used to manage advertising campaigns and ad accounts belonging to your organization, you act as the controller of the personal data contained in those campaigns and accounts, and we act as your processor, processing that data on your documented instructions.

We process personal data in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Czech Personal Data Processing Act (Act No. 110/2019 Coll.), applicable EU/EEA data protection laws, and Meta Platform Terms.

2. Data We Collect

2.1 Account Data

When you register, we collect your email address and organization name, and we store a securely hashed version of your password. We also record whether your email address has been verified, and we maintain session tokens that keep you signed in. This data is necessary for account creation and service delivery (GDPR Art. 6(1)(b) — contractual necessity).

2.2 Meta (Facebook) Platform Data

If you choose to connect your Meta account to the Service via Facebook Login, we access and store:

• Ad account information — account ID, account name, currency settings
• Campaign data — campaign names, budgets, targeting countries, deployment status
• Performance insights — aggregate metrics such as impressions, clicks, spend, conversions, and return on ad spend (ROAS)
• Page and pixel identifiers — used for campaign deployment and conversion tracking
• Meta user ID — used to identify your connection for data deletion and deauthorization callbacks

We do not access your personal Facebook profile data, friends list, photos, private messages, or any data unrelated to advertising management.

2.3 Google Analytics Data

If you choose to connect your Google Analytics account to the Service via Google sign-in, we access your GA4 property through the official Google Analytics API using the read-only analytics.readonly scope, with your explicit consent granted through Google's OAuth consent screen. We access and store:

• Analytics reporting data — aggregated e-commerce performance metrics for the property you select, such as purchases, revenue, and item-level sales figures
• Account and property information — the list of Analytics accounts and properties available to you, used only to let you choose which property to connect
• OAuth tokens — encrypted at rest (AES-256) and in transit (TLS)

See Section 11 for how we use, protect, and delete Google user data.

2.4 Google Ads and Google Merchant Center Data

If you choose to connect your Google Ads account via Google sign-in, we access Google Ads through the Google Ads API (scope https://www.googleapis.com/auth/adwords) and Google Merchant Center through the Merchant API (scope https://www.googleapis.com/auth/content), with your explicit consent granted through Google's OAuth consent screen. We access and store the list of accounts available to you, the performance of campaigns in the connected account (cost, clicks, impressions, conversions, refreshed daily), the approval status of products we submit, and encrypted OAuth tokens.

On your instruction inside the Service, we register a product data source in your Merchant Center with products from your own catalog and create paused Performance Max campaigns in your Google Ads account. You start, fund, and stop them in Google Ads; we do not change campaigns we did not create. Google bills ad spend directly to your Google Ads account.

See Section 11 for how we use, protect, and delete Google user data.

2.5 Payment Data

Subscription payments are processed by Stripe, Inc. We store your Stripe customer ID and subscription status but do not store credit card numbers, bank account details, or other payment credentials. All payment processing is handled directly by Stripe under their Privacy Policy (https://stripe.com/privacy).

2.6 Usage Data

Our infrastructure providers may capture IP addresses, request timestamps, and HTTP metadata in server logs for security monitoring and debugging. Application-level logs contain request context but do not systematically record IP addresses. Infrastructure logs are retained for up to 30 days.

2.7 AI Assistant Conversations

The Service includes an in-app AI assistant. When you use it, we store the messages you send and the assistant's replies so that your conversation history remains available to you. Because you compose these messages freely, they may contain personal data; we ask that you do not enter personal data that you do not wish to be processed in this way. Your messages and recent conversation context are transmitted to our AI provider in order to generate a reply (see Section 6). You can delete any conversation at any time from within the Service.

3. How We Use Your Data

• Campaign management — creating, deploying, pausing, and monitoring advertising campaigns on Meta and Google platforms
• Performance analytics — displaying campaign insights and generating reports to help you optimize your advertising
• Product catalog management — creating and managing product catalogs and Merchant Center product feeds for shopping campaigns
• AI-powered content generation — when you use AI features, we send your brand information and campaign context to our AI provider to generate suggested ad copy. We do not include your Meta access tokens, Google user data, or payment credentials in these requests.
• AI assistant — when you use the in-app assistant, we send the messages you write and your recent conversation context to our AI provider in order to generate a reply
• Service improvement — anonymized, aggregate analytics to improve our platform (no personally identifiable information is used)
• Product analytics — only if you accept analytics cookies, we use PostHog to record how you use the Service (pages viewed, features used, and clicks), linked to your account email address, so that we can understand usage and improve the Service
• Security — detecting and preventing unauthorized access, fraud, and abuse

4. Legal Basis for Processing (GDPR)

• Contractual necessity (Art. 6(1)(b)) — processing required to provide the Service you signed up for
• Legitimate interest (Art. 6(1)(f)) — anonymized analytics to improve our platform, security monitoring, fraud prevention, protecting our rights in case of a dispute
• Consent (Art. 6(1)(a)) — connecting your Meta account via Facebook Login or your Google Analytics or Google Ads account is a voluntary action that constitutes explicit consent for accessing your account data described in particular in Sections 2.2, 2.3, 2.4, and 11; product analytics (PostHog) is used only if you accept analytics cookies, and you can withdraw that consent at any time (see Section 12)

5. Data Retention

We retain your data for as long as your account is active and, for data obtained from a connected Meta, Google Analytics, or Google Ads account, for as long as that connection is established. When you disconnect an integration or request data deletion:

• All personally identifiable Meta data (access tokens, user IDs, account names, campaign names, external IDs) is anonymized immediately — nulled or replaced with non-identifying placeholders
• Google user data (Google Analytics reporting data, Google Ads performance data, account information, and OAuth tokens) is retained for as long as the integration remains connected, unless your consent is revoked (see Section 11 for further details). Upon disconnection, account termination, or consent revocation, this data is deleted within 30 days
• Aggregate performance metrics (impressions, clicks, spend) are retained in anonymized form as they cannot be linked back to any individual
• Database backups containing pre-anonymization data are retained for 7 days and then automatically deleted
• AI assistant conversations are retained until you delete them, or until your account is deleted
• Account data (email, organization) is retained until you delete your account or request erasure

6. Third-Party Sharing and Sub-Processors

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We share data only with the categories of recipients described below.

A current, itemized list of our sub-processors — naming each provider, the purpose for which it processes data, and the region in which it does so — is available at app.getadmazing.com/subprocessors. We will give advance notice of any change to our sub-processors by email or in-app notification.

• Advertising platforms — if you choose to connect your Meta account to the Service, we will send campaign configuration data to Meta Platforms via their Graph API to manage your advertising campaigns. Meta's processing of this data is governed by Meta's Privacy Policy (https://www.facebook.com/privacy/policy/).
• Google Analytics and Google Ads integrations via Google Ireland Limited — if you choose to connect your Google Analytics or Google Ads account, we communicate with Google's servers via the Google Analytics, Google Ads, and Merchant APIs to authenticate the connection and exchange the data described in Sections 2.3 and 2.4. This data flow, and Google's role as the source of Google user data, is described further in Section 11.
• Cloud infrastructure providers — we use cloud infrastructure for hosting, database, object storage, and message queuing. All Service data is stored and processed within the European Union.
• AI service providers — when you use AI-powered features or the in-app assistant, we send brand context, campaign parameters, and the messages you write to our AI provider to generate suggested content or replies. We do not include your Meta access tokens or payment credentials in these requests. Your data is not used to train the provider's models.
• Email delivery providers — we send transactional email (such as account verification, invitations, and password resets) through an email delivery provider, which processes your email address for that purpose.
• Stripe, Inc. (payment processing) — we share your Stripe customer ID and subscription data with Stripe for payment processing. Stripe's handling of payment data is governed by Stripe's Privacy Policy (https://stripe.com/privacy).
• Google LLC (font delivery) — the Service loads font files from Google Fonts so that ad templates and the template editor display the correct typefaces. As a technical necessity of any request your browser makes to a third-party server, your IP address, browser user-agent, and the address of the page you are viewing are transmitted to Google. Google Fonts does not set cookies and we do not send Google any account, campaign, or identifying data of our own. Google's handling of this data is governed by Google's Privacy Policy (https://policies.google.com/privacy).

We may also disclose data if required by law, regulation, or valid legal process.

7. International Data Transfers

Your data is stored and processed within the European Union. When data is transmitted to Meta Platforms, Inc., Stripe, Inc., or Google LLC (each headquartered in the United States), such transfers are governed by the EU-U.S. Data Privacy Framework and the respective service provider's Data Processing Terms. Where required, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission as a supplementary transfer mechanism. Apart from the instances mentioned above and those identified in our sub-processor list, we do not independently transfer your data outside the EU/EEA.

8. Data Security

We implement industry-standard security measures to protect your data:

• All Meta access tokens are encrypted at rest using AES-256-GCM
• All API communication uses HTTPS/TLS encryption
• App secrets are stored server-side only and never exposed to the frontend
• Meta webhook callbacks are verified using HMAC-SHA256 signatures with timing-safe comparison
• Access to production systems is restricted to authorized personnel only

9. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the personal data we hold about you
• Right to rectification (Art. 16) — request correction of inaccurate data
• Right to erasure (Art. 17) — request deletion or anonymization of your data. You can do this directly from the Connections page in your account settings, or by removing our app from your Facebook Settings, or by revoking access in your Google Security Settings (see Section 11).
• Right to restriction of processing (Art. 18) — request that we limit how we process your data in certain circumstances
• Right to data portability (Art. 20) — request your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)) — disconnect your Meta, Google Analytics, or Google Ads account at any time from the Connections page, or revoke Admazing's access in your Google Security Settings (see Section 11)

We do not make automated decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22). Our AI-powered features generate content suggestions that are always subject to your review and approval before use.

To exercise any of these rights, contact us at admin@getadmazing.com. We will respond to your request within 30 days. You also have the right to lodge a complaint with the Czech supervisory authority:

Úřad pro ochranu osobních údajů (ÚOOÚ) — https://uoou.gov.cz/

10. Data Deletion via Meta

When you remove Admazing from your Facebook Settings (Apps & Websites), Meta sends us a data deletion callback. We automatically anonymize all data associated with your Meta user ID and provide a confirmation code you can use to verify the deletion status. The anonymization is performed immediately upon receiving the callback.

11. Google User Data

The Google Analytics, Google Ads, and Merchant Center data we collect when you connect your accounts is described in Sections 2.3 and 2.4. This data is used solely to provide features to you inside Admazing — showing sales and campaign performance for your own products, letting you manage your product feeds based on it, and creating and reporting on the Google campaigns you ask us to create. We do not use Google user data for advertising or ad targeting, and we do not transfer it to any advertising platform. We do not use, transfer, or sell this data to create, train, fine-tune, or improve any AI or machine-learning models. We do not sell Google user data or share it with third parties, except sub-processors strictly necessary to operate the Service (see Section 6), who are bound by data-processing agreements. Aggregated metrics derived from your Google data are stored on our infrastructure in the European Union.

When you disconnect a Google integration, we revoke our access token with Google and stop accessing your data; stored Google-derived data is deleted within 30 days of disconnection or account termination. You can also revoke Admazing's access at any time in your Google Security Settings.

Admazing's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Cookies and Local Storage

The Service uses the following cookies and browser storage:

• Authentication cookies — two HttpOnly, Secure cookies ("access_token" and "refresh_token") used solely for session authentication. These cannot be accessed by JavaScript and are transmitted only over HTTPS.
• Browser local storage — we store your selected brand preference and application settings (theme, layout) in your browser's local storage. This data never leaves your browser and contains no personal information. It also remembers your cookie choice.
• Analytics cookies (optional) — PostHog product analytics, set only if you accept them in the cookie banner shown when you first open the Service. PostHog stores an identifier in a cookie and in local storage and records how you use the Service (see Section 3). The data is hosted in the European Union.

The authentication cookies and local storage are strictly necessary and do not require consent. Analytics cookies are used only with your consent (GDPR Art. 6(1)(a) and Section 89(3) of Act No. 127/2005 Coll. on Electronic Communications, which transposes the ePrivacy Directive 2002/58/EC). If you reject them, the Service works exactly the same. You can change your choice at any time via "Cookie settings" in the navigation menu; withdrawing consent does not affect the lawfulness of processing before it. Your choice is remembered for 12 months, after which we ask again. We do not use advertising cookies, Google Analytics, or the Meta Pixel within the Service.

Our marketing website at getadmazing.com, which is separate from the Service, uses the following analytics and advertising tools, but only if you give your consent through the cookie banner shown on your first visit:

• Google Tag Manager and Google Analytics (Google Ireland Limited) — to measure visits to the website and how visitors use it
• Meta Pixel (Meta Platforms Ireland Limited) — to measure the performance of our advertising on Facebook and Instagram, for example sign-up clicks coming from an ad
• PostHog (hosted in the European Union) — to understand how visitors use the website, including page views, clicks, and session recordings in which all form inputs are masked

These tools set cookies and process your IP address, device and browser information, and your interactions with the website. The legal basis is your consent (GDPR Art. 6(1)(a) and Section 89(3) of Act No. 127/2005 Coll.). Until you accept, none of these tools are loaded. You can withdraw your consent at any time via "Cookie settings" in the website footer; withdrawal does not affect the lawfulness of processing before it. Your choice is remembered for 12 months, after which we ask again.

13. Children's Privacy

The Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at admin@getadmazing.com and we will promptly delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The "Last updated" date at the top indicates when the policy was last revised. Continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact

For any privacy-related questions or to exercise your rights, contact us at: