Legal

Privacy Policy

Last updated: 2026-05-01

Beta draft. This notice is provisional and will be reviewed by counsel before public launch. It is not legal advice.

1. Who is the controller

The data controller of AdLib is The Interactive Studio S.L. ("we", "us"). Contact: legal@theinteractive.studio.

2. What we collect

We collect the minimum data needed to operate AdLib:

  • Account data: email address, display name, plan and authentication artefacts (magic-code state, session tokens).
  • Usage data: collections you create, ads you save, brands you follow, search queries, and basic interaction metadata (timestamps, IP, user-agent) needed for security and rate-limiting.
  • Communications: messages you send to support or feedback channels.
  • Operational logs: server logs (IP, request path, status code) retained for up to 30 days for security and debugging.

We do not intentionally collect special categories of personal data (health, political opinions, etc.) and we do not sell personal data.

3. Why we use it (legal bases)

  • Performance of contract: to provide the Service you signed up for (account, search, collections).
  • Legitimate interest: to keep AdLib secure, prevent abuse, debug and improve the product, and to communicate operational notices.
  • Consent: for non-essential cookies and product newsletters where applicable; you can withdraw consent at any time.
  • Legal obligation: to respond to lawful requests from competent authorities.

4. Third-party advertising content

AdLib surfaces advertising creatives that originate from public sources such as the Meta Ad Library. We process the creatives, brand pages and metadata exposed by those sources in line with their terms. Where the originating platform exposes demographic or audience information, we limit our storage to what their terms allow and we never reconstruct personal profiles of viewers from that data.

5. Cookies & similar technologies

AdLib uses the minimum cookies needed to operate the Service:

  • Essential: an authentication token (e.g. auth_token) and CSRF state used to keep you signed in. These are strictly necessary and cannot be turned off.
  • Preferences: small storage entries that remember UI choices (e.g. theme).
  • Analytics: not enabled by default during beta. If we add privacy-friendly analytics (e.g. Plausible or self-hosted) we will update this notice and surface a consent banner where required.

You can clear cookies and local storage from your browser at any time. Removing the authentication cookie will sign you out.

6. Sub-processors & transfers

We rely on a small set of vendors:

  • Hetzner Online GmbH (Germany / EU) — application and database hosting.
  • Cloudflare, Inc. (EU/US) — DNS, CDN and Pages hosting for the front-end.
  • Resend (US/EU) — transactional email (magic codes, notifications).
  • Meta Platforms, Inc. — origin of public Ad Library data we ingest (we do not transfer your personal data to Meta).

Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses or equivalent safeguards.

7. Retention

  • Account data: while your account exists and up to 30 days after deletion.
  • Backups: encrypted, retained per backup schedule (currently 30 days daily, 6 months weekly).
  • Server logs: up to 30 days.
  • Auth events: up to 90 days for security audit purposes.

8. Your rights

Subject to applicable law (GDPR for users in the EEA / UK), you have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to lodge a complaint with your supervisory authority. To exercise any of these rights, email legal@theinteractive.studio from the address on your account. We aim to respond within 30 days.

9. Children

AdLib is not directed to children under 16, and we do not knowingly collect their data.

10. Security

We use TLS in transit, encrypted backups and least-privilege access. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authority as required by law.

11. Changes

We will post material changes to this notice on this page and, when significant, notify you in-product or by email at least 14 days before they take effect.

12. Contact

Privacy enquiries and rights requests: legal@theinteractive.studio.