Last Updated: July 17, 2026
Welcome to Adtool.io. This Privacy Policy explains how Adtool.io collects, uses, stores, and protects your information when you use the Adtool.io advertising management platform.
This service is primarily targeted at users in Denmark and the European Union, and complies with the General Data Protection Regulation (GDPR) and other applicable privacy laws.
For personal data contained in your campaigns, ad accounts, and creative assets, Adtool acts as a data processor on your behalf under our Data Processing Agreement. This Privacy Policy covers the data for which Adtool ApS is the data controller: your account and billing information, support communications, platform usage and analytics data, and data about visitors to our website. Where this policy also describes campaign and integration data (Sections 2.2 and 2.3), it does so for transparency, that data is processed on your behalf under the Data Processing Agreement.
Providing account and billing information is a contractual requirement, without it we cannot provide the service. All other information is optional.
• Service Delivery: Provide ad management and campaign creation tools
• Account Management: Maintain your account and process authentication
• Integration Management: Connect and synchronize with Facebook and Google Drive
• Data Synchronization: Keep your campaign and creative data up-to-date
Aggregated Data Analysis: We may use aggregated data that has been anonymised such that it no longer constitutes personal data within the meaning of the GDPR to analyze patterns and improve our services. This data cannot identify individual users or accounts and is used solely to enhance the Adtool.io platform for all users.
Examples of how aggregated, anonymised data may be used:
Note: Your individual account data, campaign details, and creative assets are never sold. We share personal data only with the service providers listed in Section 5 (acting on our instructions under data protection agreements) and, with your consent, the tag providers described in Section 7. Any data analysis for service improvement is performed on aggregated, anonymised datasets; support-related processing of individual accounts is described in Sections 3.3 and 3.4.
We process personal data on the following legal bases under GDPR Article 6, and keep it for the following periods:
| Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|
| Providing the service (account, campaigns, integrations) | Contract (Art. 6(1)(b)) | While your account is active, plus a 90-day grace period after termination (earlier deletion on request) |
| Billing and accounting | Legal obligation (Art. 6(1)(c), Danish Bookkeeping Act) | 5 years from the end of the financial year |
| Product analytics (in-platform) | Legitimate interest (Art. 6(1)(f)) for server-side usage events; consent (Art. 6(1)(a)) for the PostHog cookie and session recordings | As long as needed for the purpose, then deleted or anonymised |
| Support and communications | Contract / legitimate interest | While your account is active, plus the 90-day grace period after termination |
| Marketing emails to existing customers (product updates, similar services) | Legitimate interest (Art. 6(1)(f)) and the existing-customer email exemption (Danish Marketing Practices Act §10(2)); opt-out offered both at sign-up and in every email | Until you opt out |
| Newsletter (non-customers / sign-ups) | Consent (Art. 6(1)(a)), withdraw at any time | Until you unsubscribe |
| Website analytics, marketing and advertising cookies | Consent (Art. 6(1)(a)), via cookie settings | Per the cookie overview in Section 7 |
Your data is stored on secure servers provided by Supabase in the United States. That transfer is protected by Standard Contractual Clauses approved by the European Commission; other providers rely on their EU-US Data Privacy Framework (DPF) certification or SCCs, as listed at https://adtool.io/subprocessors (incorporated into our Data Processing Agreement). See Section 9 (International Transfers).
Data is retained for the periods described in Section 3.4. You may request deletion of your data at any time by contacting support@adtool.io.
Integration with the Meta (Facebook/Instagram) Marketing API is used to manage your advertising campaigns. Meta's own privacy policy applies to data they collect. Only the minimum necessary permissions are requested to provide the services.
Integration with Google Drive is used to access creative assets you choose to connect. Google's privacy policy applies to data they collect. Only folders you explicitly authorize are accessed. Adtool's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The same account-based model will apply to the Microsoft OneDrive integration once launched: it operates on your own Microsoft account, and Microsoft's privacy policy applies to data they collect.
Supabase provides the database and authentication services. All data is stored in their US data center (Ohio) with enterprise-grade security. Transfers are safeguarded by Standard Contractual Clauses approved by the European Commission.
Stripe processes all payment transactions. Payment card details are handled directly by Stripe and never touch our servers. Stripe's privacy policy applies to payment data.
PostHog provides product analytics to help us understand feature usage and improve the platform. Session recordings automatically mask sensitive data.
Upstash provides Redis caching services for improved performance (data hosted in the EU, Frankfurt). Temporary operational data, such as subscription state, billing-reference lookups keyed by user ID, and rate-limit counters, is cached briefly to run the service.
Loops (Astrodon Corporation) is used for email communications, both service-related emails and marketing (product updates and newsletters you can opt out of at any time).
Featurebase (Cordnet OÜ, Estonia) provides our support, live chat, and feedback portal. Support conversations, feedback posts, and basic profile information are stored to provide better customer service. Featurebase is based in the EU.
Vercel hosts the Adtool.io application. Access logs and performance data are processed for security and optimization purposes.
We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to manage analytics tags on our website. Google Tag Manager itself is a tag container; the tags it manages are described in Section 7 (Cookies and Tracking).
Cloudflare (R2 storage, EU data hosting) temporarily stages large video uploads before they are transferred to Meta. Files are deleted after hand-off.
Slack is used for internal operational alerts, which may include limited account and service data.
Cal.com provides the demo-booking widget on our website. When you book a demo, the name and email address you enter are processed by Cal.com (US; the transfer is safeguarded by the Standard Contractual Clauses in Cal.com's data processing terms) to schedule the meeting.
For the complete, current list of sub-processors and the transfer safeguard applying to each, see https://adtool.io/subprocessors (referenced in our Data Processing Agreement).
Under GDPR, you have the following rights:
• Right to Access: Request copies of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how your data is used
• Right to Data Portability: Transfer your data to another service
• Right to Object: Object to the use of your personal data
• Right to Withdraw Consent: Withdraw consent for data processing
To exercise these rights, please contact support@adtool.io
Complaints: If you believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or with the supervisory authority in your own EU member state.
Automated decision-making: We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22).
Essential cookies are used for:
• Authentication and session management (via Supabase auth)
• Security and fraud prevention
User interface preferences (such as sidebar state and content groups) are stored in your browser's local storage. They stay on your device and are not used for tracking.
We use PostHog (product analytics, EU-hosted) in the platform to understand usage and improve the service. Data collected includes user identification (email address, user ID), feature usage events, session recordings with sensitive data automatically masked, technical performance metrics, and navigation patterns. We rely on your consent as the legal basis for session recordings and for the storage of the PostHog cookie on your device. Where we process usage events that do not require storage on your device, we rely on our legitimate interest in improving the service (see Section 3.4). The PostHog cookie itself is set subject to your consent via our cookie settings.
Our marketing website uses analytics and advertising tags managed through Google Tag Manager: Google Analytics 4, the Meta pixel, the LinkedIn Insight Tag, and HubSpot tracking. These run on our public marketing website and not inside the logged-in platform, and measure our website performance and the performance of our own marketing, including key product milestones (for example sign-ups, onboarding completion, and demo bookings), and involve third-party cookies. The legal basis for these cookies is consent, which you can give or withdraw via our cookie settings.
| Cookie / storage | Provider | Purpose | Category | Typical duration |
|---|---|---|---|---|
| sb-*-auth-token | Supabase (Adtool) | Authentication and session | Essential | Session |
| Local storage (UI preferences) | Adtool | Interface preferences | Preferences | Until cleared |
| ph_* | PostHog | Product analytics | Analytics (consent) | Up to 1 year |
| _ga, _ga_* | Google Ireland Ltd | Website analytics (GA4) | Analytics (website, consent) | Up to 2 years |
| _fbp | Meta Platforms Ireland Ltd | Advertising measurement | Marketing | 3 months |
| bcookie, li_sugr, UserMatchHistory | LinkedIn Ireland | Advertising measurement | Marketing | 1-12 months |
| __hstc, hubspotutk | HubSpot, Inc. | Marketing analytics | Marketing | 6 months |
Durations are set by the respective providers and may vary; we review this list periodically.
Your personal information is not sold, traded, or rented to third parties. Data may be shared only in these limited circumstances:
Data is stored in the United States (Ohio data center) and processed by providers in both the US and the EU (for example, data for PostHog, Upstash, and Featurebase is hosted in the EU). Where data is transferred from the EU to the US, the transfer is protected by the recipient's certification under the EU-US Data Privacy Framework or, for recipients that are not certified, by Standard Contractual Clauses approved by the European Commission, ensuring appropriate safeguards for EU data as required by GDPR. The safeguard applying to each provider is listed at https://adtool.io/subprocessors (incorporated into our Data Processing Agreement). You can request a copy of the applicable safeguards by contacting support@adtool.io.
Adtool.io is a business-to-business service and is not directed at children. You must be at least 18 years old to create an account or enter into our Terms of Service. Employees of a customer may use the service under the customer's account and responsibility.
This Privacy Policy may be updated from time to time. Users will be notified of any material changes via email or through the platform. This policy is provided for your information and is not a contract. Where we rely on your consent for a particular processing activity, we will obtain that consent separately.
For questions about this Privacy Policy or data protection matters, please contact:
Email: hello@adtool.io
Service: Adtool.io
Data Controller: Adtool ApS (CVR: 45752577), Vallensbækvej 63, 2625 Vallensbæk, Denmark