Privacy Policy

Server logs

When you open a page, our hosting providers automatically process technical data that your browser sends: IP address, date and time of the request, the page requested, referrer URL, browser type and version, and operating system. We need this data to deliver the website and to keep it secure, for example to detect attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Server logs are deleted after 30 days at the latest unless they are needed to investigate a specific security incident.

Cookies and similar technologies

We use cookies and similar technologies (local storage, pixels). Strictly necessary cookies, for example to keep you signed in or to complete a checkout, are set on the basis of § 25(2) TDDDG and Art. 6(1)(b) or (f) GDPR. All other cookies, such as those for analytics, marketing and affiliate tracking, are only used with your consent where the law requires it (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future and delete cookies in your browser settings.

Analytics and marketing tools

We use the following tools on adspends.com and app.adspends.com:

• PostHog (PostHog Inc., EU cloud hosted in Frankfurt): product analytics such as page views, clicks and feature usage, so we can understand how AdSpends is used and improve it. When you are signed in, events are linked to your account ID.
• Google Tag Manager, Google Analytics and Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): Tag Manager loads our tags. Google Analytics measures website usage, and Google Ads conversion tracking measures whether our ads lead to sign-ups and purchases.
• Meta Pixel and Meta Conversions API (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland): measures whether our Facebook and Instagram ads lead to sign-ups and purchases and helps us show our ads to relevant audiences. For sign-ups and purchases we also send these events from our server, together with hashed (pseudonymised) identifiers.
• Affonso: affiliate tracking. If you arrive through a partner link, a referral cookie stores the partner reference for 30 days so we can pay the right partner commission when you subscribe.

Live chat

On some pages we offer a live chat by Crisp (Crisp IM SAS, France). If you use the chat, Crisp processes your messages, any contact details you enter, and technical data such as your IP address so we can answer you. Legal basis: Art. 6(1)(b) GDPR for pre-contractual questions, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Registration and sign-in

To create an account we process your email address, name (if provided), password or the sign-in data of the provider you choose (for example Google), and sign-in metadata such as IP address, device and time of sign-in. Authentication is handled by Clerk (Clerk, Inc., USA). Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Using the app

While you use AdSpends we store the content you create in your account, for example tracked brands, saved boards, folders, collections and tags, plus your settings, plan and credit balance. We use this data to provide the service. Legal basis: Art. 6(1)(b) GDPR.

Payments

Payments are processed by Stripe (Stripe Payments Europe Ltd., Ireland). Stripe receives your payment details directly. We do not see or store your full card number. We receive your name, email, billing address, subscription status and invoices. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for keeping invoices and accounting records as required by German tax and commercial law.

AI features in the app

Some features in the app, such as AI ad analysis and ad generation, send the ad content you select and your instructions to AI model providers (OpenAI, Anthropic or Google) to generate the result. We only send what is needed for that feature. Under their business terms these providers do not use API data to train their models. Legal basis: Art. 6(1)(b) GDPR.

Emails

We send emails that are needed to run your account, for example sign-in codes, receipts and important service notices (Art. 6(1)(b) GDPR). We only send newsletters or marketing emails if you have opted in or if the law otherwise allows it. You can unsubscribe at any time using the link in every such email.

What we collect

Authentication data. You connect either through OAuth 2.0 (you sign in to AdSpends and approve the connection) or with an API key that you create in your AdSpends account. For OAuth connections we store which application you connected (the OAuth client ID). We only store API keys as a one-way hash plus a short prefix for display, never the full key.

Tool call data. For every request (each tool call) we record:

• your AdSpends user ID and the credential used (OAuth client or API key ID)
• the name of the tool or API endpoint called, for example search_ads
• the arguments of the call, for example a search term, brand name, market or filter. Text values are shortened to 200 characters, and fields that look like credentials or email addresses are removed before storage.
• the result: success or error, error code, response time, number of results and credits charged
• the name and version of the client application, as reported by the client (for example "claude-ai")
• your IP address and the time of the request

What we do not collect

The AI assistant decides when to call one of our tools and which arguments to send. We only receive those tool calls. We do not receive or store:

• your conversation with the assistant, your prompts or the assistant's replies
• the assistant's memory, your chat history or conversation summaries
• files you upload to the assistant
• your credentials or the account you hold with the AI provider

Our MCP server and API are read-only: they can read public ad data and your own saved data, but cannot create, change or delete anything in your account.

How we use it

• to authenticate you and return the requested data to your AI assistant
• to count usage against your plan's credits and quotas
• to protect the service through rate limiting and abuse prevention, for example blocking IP addresses after repeated failed sign-in attempts
• to investigate errors and support requests
• to show you your own usage history and connected applications in your AdSpends account
• to improve our tools based on aggregated usage statistics

We do not use tool call data for advertising, do not sell it, do not use it to train AI models and do not use it to build profiles of you beyond your own usage history. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in a secure, stable and fairly billed service (Art. 6(1)(f) GDPR).

Where it is stored and who receives it

Tool call data is stored in our database hosted by Hetzner Online GmbH in Germany. Short-lived rate-limiting counters are kept in an in-memory store on the same infrastructure. Error reports may be processed by our error monitoring provider, Sentry (section 8). We do not share tool call data with any other third party.

The results of a tool call (ad data, brand data, landing pages or your saved items) are returned to the AI application you use, for example Anthropic for Claude or OpenAI for ChatGPT. That provider processes the results under its own privacy policy and your agreement with it. Please review the provider's privacy policy, for example the Anthropic Privacy Policy.

How long we keep it

Tool call records are kept for 12 months and then deleted. Rate-limiting counters expire after one minute. OAuth connections and API keys stay active until you revoke them or delete your account.

How to disconnect

You can disconnect AdSpends at any time in your AI assistant's settings (in Claude: Settings → Connectors) and revoke connected applications and API keys on the MCP page of your AdSpends account at app.adspends.com/mcp. After you revoke a connection, it stops working within about a minute.