Privacy Policy

1. Data controller

This platform (Advetics) is operated by Profaj. For questions about the processing of personal data: hello@profaj.com

2. What Advetics does

Advetics is a software service that lets advertising agencies and businesses manage their Meta (Facebook, Instagram), Google Ads and LinkedIn Ads advertising accounts from a single panel. YouTube channels are connected under the Google connection. It pulls advertising performance data from these platforms, reports on it and takes automated actions according to rules defined by the user.

No advertising network other than these platforms is supported, and no data is sent to any third-party advertising platform.

3. Data processed

3.1 Data about panel users

• Full name, email address, language preference, profile photo link
• Password: never stored in plain text, only hashed irreversibly with argon2id
• Session information: hashes of access and refresh tokens, last sign-in time
• Security and audit records: IP address, browser information, type and time of the action performed

3.2 Data obtained from connected advertising platforms

When a user connects a Meta, Google or LinkedIn account with their own explicit consent, the following data is processed:

• Access tokens (access/refresh tokens): stored encrypted on the server with AES-256-GCM and never displayed in any interface or API response
• The list of permissions granted (scopes) and the platform user ID
• Ad account information: account ID, name, currency, time zone, status
• Campaign, ad set and ad structures and their performance metrics (impressions, clicks, spend, conversions and conversion value)
• Facebook Page and Instagram business account IDs, names, usernames and organic post engagement metrics (for the Auto-Boost feature)

Data not processed: personal data of end users, customers or ad viewers (name, email, phone, address) is not pulled from the advertising platforms and is not stored. Only aggregate performance metrics are processed.

4. Purposes of processing and legal basis

• Providing the service: consolidating and reporting advertising data and running automation rules. Legal basis: performance of a contract.
• Access to advertising platforms: the user's explicit consent (the approval given on the OAuth consent screen). Consent can be withdrawn at any time.
• Security and audit: detecting unauthorised access and keeping actions that change budgets traceable. Legal basis: legitimate interest and legal obligation.

Data is never sold under any circumstances, is not shared with third parties for advertising purposes and is not used for profiling or marketing.

5. Data transfers

To the extent strictly necessary to provide the service, data is exchanged with the following parties:

• Meta Platforms, Inc.: reading advertising data and applying the actions defined by the user through the Marketing API
• Google LLC: for the same purposes through the Google Ads API
• LinkedIn Corporation: reading and reporting advertising data through the LinkedIn Marketing API
• Hosting provider (Hostinger): server infrastructure, located in the European Union (Frankfurt, Germany)

Meta, Google and LinkedIn are companies based in the United States. This transfer is based on the explicit consent the user gives to access their own advertising accounts and is limited to the relevant API calls only.

6. Retention periods

• Access tokens: for as long as the connection is active. When the connection is removed, the tokens are deleted immediately and irreversibly.
• Advertising performance data: for as long as the account relationship continues; at most 37 months (the data retention limit of the advertising platforms).
• User account: until the account is deleted.
• Audit records: 2 years. These records are kept for the accountability of automated actions that change budgets and cannot be modified.
• Session tokens: at most 30 days; revoked when you sign out.

7. Security measures

• All traffic is encrypted with TLS (HTTPS).
• OAuth tokens are encrypted at the application layer with AES-256-GCM; the encryption keys are kept separate from the database and are versioned so they can be rotated.
• Passwords are hashed with argon2id. All active sessions are ended when a password is changed.
• Row Level Security is enforced at the database level: one workspace's data is not visible to another customer even if there is an error in the application layer.
• The database and application servers are closed to the internet; access is local only.

8. Your rights

Under Article 11 of KVKK (Law No. 6698 on the Protection of Personal Data) and the GDPR, you have the right to access your data, to request its correction, to request its deletion, to object to its processing and to receive your data in a portable format.

You can send your requests to hello@profaj.com. Requests are answered within 30 days at the latest.

To delete your advertising account connection and the related data, see the Data Deletion Instructions page.

9. Cookies

Only cookies strictly necessary to keep your session running are used (adv_at, adv_rt, adv_client and a few cookies that hold the selections you make in the panel). The purpose and duration of each are set out on the Cookie Policy page.

No advertising, tracking or analytics cookies are used. There are no third-party tracking scripts.

10. Changes

This policy may be updated. For significant changes, registered users are notified by email and the update date on this page is changed.