Privacy policy

This policy explains which personal data AdLupe processes, why, on what legal basis and for how long.

• We only process what sign-in, operation, billing and security of AdLupe require.
• AdLupe uses no analytics, tracking or advertising tools and builds no user profiles. That is why there is no cookie banner.
• We only set cookies that a feature you use needs, such as signing in.
• Video ads load YouTube's player only after you click play.

Christian Schmitt, Performance Web Development, Konsul-Smidt-Straße 8C, 28217 Bremen, Germany

Phone: +49 156 78813100, Email: info@christianschmitt.dev

For questions about data protection and to exercise your rights under section 14, write to info@christianschmitt.dev.

AdLupe runs entirely on Cloudflare's platform: website, dashboard, API, MCP server, database and background jobs (Cloudflare Workers, D1, KV, R2 and Queues). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

With every request, Cloudflare processes technically necessary data: IP address, date and time, the address requested, browser identifier (user agent) and status code. We use Cloudflare's logs (Workers Logs) to find errors and fend off attacks. They are deleted after 7 days at most.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR) and, when you are signed in, the contract (Art. 6(1)(b) GDPR). Cloudflare processes the data on our behalf (Art. 28 GDPR). For transfers to the USA, see section 12.

For your account we process your email address, your name and your preferred language. You sign in without a password:

• Code by email: we send a six-digit code that is valid for 10 minutes. We only store it as a hash.
• Passkey: we store the public key, an identifier and technical details of the passkey, such as the device type. The private key and biometric data such as your fingerprint or face never leave your device.
• Session: you stay signed in until you sign out or have not used AdLupe for 30 days. With the session we store your IP address and browser identifier.
• Abuse protection: we limit sign-in attempts per IP address, for example to three codes per minute.

We send sign-in codes and invitations through Cloudflare's email service from login@adlupe.com.

The legal basis is the contract for using AdLupe (Art. 6(1)(b) GDPR) and, for session data and abuse protection, our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR). We keep account data for as long as the account exists.

Your company is your team's shared workspace. We store the company name, who is a member and which role each person has (owner, admin or member).

When you invite colleagues, we process their email address and send them an invitation with your name and the company name. The invitation is valid for 7 days.

The legal basis is the contract (Art. 6(1)(b) GDPR) and, for invited people, your company's legitimate interest in working as a team (Art. 6(1)(f) GDPR).

In AdLupe you enter your competitors' domains and names, keywords for industry monitoring, markets and, if you like, your own website. Only your team can see this. We also store who in the team added a competitor.

To fetch ads, we send domains, keywords and countries to the data service DataForSEO, which queries the Google Ads Transparency Center. Once Meta grants access, we will also query Meta's Ad Library. Your name, email address and IP address are not sent to these services.

So that your competitors appear with their logo in the dashboard, our server loads the site icon (favicon) of each domain you enter from that website and stores it at Cloudflare. Your browser connects neither to these websites nor to any other service, and the competitors do not learn who is watching them.

The legal basis is the contract (Art. 6(1)(b) GDPR). We keep this information until you remove it or your account is deleted.

This section is for advertisers (Art. 14 GDPR). AdLupe stores ads that platforms make publicly available: today from the Google Ads Transparency Center and, once access is granted, from Meta's Ad Library. This includes the advertiser's name and, where published, who paid for the ad, as well as ad copy, images and videos, landing pages, run time, countries and reach. If an advertiser is a natural person, for example a sole trader, this is personal data.

The purpose is market and competitor analysis for our customers. The legal basis is our and our customers' legitimate interest in this analysis (Art. 6(1)(f) GDPR). The platforms publish this information so that advertising can be scrutinised, among other things under Article 39 of the Digital Services Act. We store preview images with Cloudflare. We keep ads as a history, so that it stays visible when an ad ran.

You can object to this processing (section 14).

When you connect AdLupe to an AI assistant, the assistant signs in to AdLupe via OAuth and you confirm access. We store this authorisation with your user account, your company and the app's name and redirect address in Cloudflare KV. We delete expired authorisations automatically every day.

When the assistant requests data, AdLupe sends the results to the assistant's provider, for example Anthropic (Claude) or OpenAI (ChatGPT). What happens to the data there is governed by your contract with that provider and its privacy notice. You disconnect AdLupe in your AI assistant's settings.

The legal basis is the contract (Art. 6(1)(b) GDPR).

You take out the subscription through our payment provider Stripe: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

We send Stripe the company name and internal identifiers. You enter payment details, email address and billing address directly on Stripe's checkout page. We never receive card details. From Stripe we store the customer and subscription identifiers and the status and term of the subscription.

The legal basis is the contract (Art. 6(1)(b) GDPR). We keep invoicing and accounting records for as long as tax and commercial law requires, usually ten years (Art. 6(1)(c) GDPR together with Section 147 AO and Section 257 HGB).

Stripe processes data partly on our behalf and partly as a controller in its own right, for example for fraud prevention and legal obligations. Data may be transferred to Stripe, Inc. in the USA. See Stripe's privacy policy for details.

We first show video ads as a still image served from our own server. Only when you click play does YouTube's player load (youtube-nocookie.com). Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, then receives your IP address and browser details, among other things, and YouTube may store information on your device.

The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It applies to that one video only: after you reload the page, the player is off again. Google may transfer data to the USA. See Google's privacy policy for details.

AdLupe only sets cookies that are strictly necessary for a feature you use (Section 25(2) no. 2 TDDDG). AdLupe does not use local storage or similar storage.

• adlupe.session_token and adlupe.session_data: keep you signed in. Valid for 30 days from your last visit and 5 minutes respectively. Over HTTPS the names carry the prefix __Secure-.
• adlupe.better-auth-passkey: secures setting up and signing in with a passkey. Valid for 5 minutes.
• __Host-oauth-consent-…: secures your confirmation when you connect an AI assistant. Valid for 10 minutes.
• adlupe_lang: remembers the language when you switch it. Valid for 1 year.
• adlupe_theme: remembers the light or dark appearance when you choose it. Valid for 1 year.
• sidebar_state: remembers whether the dashboard sidebar is shown or hidden. Valid for 7 days.

Stripe's checkout page sets its own cookies. Stripe's privacy policy applies to them.

Personal data only goes to the parties named in this policy: Cloudflare as our processor for hosting, database, sending email and logs, Google as our processor for our mailbox (section 13), Stripe for payments, Google when you play a YouTube video, and your AI assistant's provider when you connect it.

Cloudflare, Stripe and Google are based in the USA or may transfer data there. The basis is the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which these providers' US companies are certified. Where it does not apply, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).

When you write to us or call, we process your details to answer your enquiry. The legal basis is the contract or steps towards one (Art. 6(1)(b) GDPR), otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR). Our mailbox runs on Google Workspace (Google Ireland Limited) as our processor. We delete the enquiry once it is settled and no retention obligation applies.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). We delete your account on request to info@christianschmitt.dev, unless a retention obligation prevents it.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen, Georgstraße 122-124, 27570 Bremerhaven, Germany, office@datenschutz.bremen.de, www.datenschutz.bremen.de

Without an email address, name and company name we cannot create an account or enter into a contract. Everything else is optional.

We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR.

We update this policy when AdLupe or the law changes. The version published here applies.