Privacy Policy

1. Introduction

Adlio ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Adlio, our SaaS platform for bulk-uploading ads into Meta Ads Manager. We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Information We Collect

We collect information that you provide directly to us, including:

• Account Information: Your email and name when you create an account or sign in with Facebook or Google
• Meta / Facebook Data: The access token, identifiers and selections described in the section below
• Ad Content & Settings: The media you upload (images, videos), together with ad copy, naming, UTM parameters and advertiser identity
• Payment Information: Billing details processed securely through our PCI-DSS certified payment processor (we do not store full payment card details)
• Usage Data: Information about how you interact with the Service, including features used and upload history

Automatically Collected Information:

• IP address and approximate location
• Browser type and device information
• Pages visited and time spent on the Service
• Referring website or source

Connecting Your Facebook / Meta Account

Adlio integrates with Meta (Facebook & Instagram) so you can bulk-upload ad creatives into Meta Ads Manager. When you connect your account, we receive and store the following data from Meta:

• An encrypted, long-lived Facebook access token, plus your Facebook user ID, name and the permissions you granted.
• The Facebook Page, Instagram account and Meta Pixel you choose for your ads.
• Your ad-account identifiers and the defaults you configure (ad copy, naming, UTM parameters and EU advertiser identity).
• A history of your uploads (campaign, ad set, creative and ad IDs, media references, the ad name and UTM parameters we sent, and Meta's error details when an ad could not be created), a per-file upload log, and a workspace activity feed of who changed which settings and launched which batch.

We use this data solely to create and manage the ads you upload through Adlio; we never sell it. Your Facebook access token is encrypted at rest (AES-256-GCM) and is only used to call Meta’s Marketing API on your behalf. If you work in a Team workspace, the members you invite create ads through your connection: they never see the token itself, but they can see the settings and launch history of the ad accounts you grant them, and everyone in the workspace can see each other's name and email address in the activity feed.

You can disconnect Meta or delete all of your data at any time: see our Data Deletion page.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain and improve our ad-upload service
• Ad Creation: To build and manage the campaigns, ad sets, creatives and ads you upload, by calling the Meta Marketing API on your behalf
• Account Management: To create and manage your account, process payments, and communicate with you
• Service Improvement: To analyze usage patterns and improve our Service
• Security: To detect and prevent fraud, abuse, and security issues
• Legal Compliance: To comply with legal obligations and enforce our Terms of Service

4. How We Handle Your Media and Ad Data

When you use Adlio, your uploaded media and settings are used to create ads in your Meta ad account. Important information about this processing:

• Media you upload is staged briefly in our secure cloud storage so it can be handed to Meta; that copy is removed as soon as Meta has accepted the file, and in any case within 24 hours. If you leave a batch unfinished, it is kept as a draft (the files, a small preview, the copy and URLs you typed, and the Meta ids once a file was handed over) for up to 7 days after your last change, so you can pick it up later or let a connected assistant fill it in; clearing the batch removes it at once
• We do not use your media or ad content to train any AI models
• Your upload history remains in your account until you delete it or close your account; the media itself lives in your Meta ad account, not with us
• Ads are always created in a paused state; we never publish or spend on your behalf, and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you
• If you connect an AI assistant (for example Claude, ChatGPT or Perplexity) to Adlio through our MCP connector, that assistant acts for you with a token issued by Adlio: it can read the batch you staged (file names, previews, copy, URLs, batch choices) and your Adlio settings for the ad account, and launch paused ads only after you confirm. Your Facebook token never reaches the assistant, and it never receives performance or spend data. What the assistant's provider does with the data it reads is governed by your agreement with that provider. You can disconnect an assistant at any time in Settings; we keep a record of each connection (which assistant, when, from which IP address) as proof of your consent

5. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Service to you
• Legitimate Interests: For security, fraud prevention, and service improvement
• Legal Obligation: To comply with applicable laws and regulations
• Consent: Where you have given consent, for example for the advertising cookie set by the Meta Pixel

6. Information Sharing and Sub-processors

We do not sell, trade or rent your personal information. We share data only with the trusted providers that help us run the Service, and only as needed:

• Infrastructure & Processing: Supabase (database, authentication and media staging), Vercel (application hosting), Stripe (payments, PCI-DSS certified), Resend (transactional email), DataFast (website analytics) and Anthropic (an AI model that summarises the free-text feedback you may leave when cancelling, so we can read it in aggregate)
• Meta Platforms: We send the media and ad data you choose to upload to Meta in order to create your ads
• Advertising: the Meta Pixel, which helps us measure and improve our own advertising and only loads after you consent (see Cookies below); with that same consent, when you create an account our server also reports that sign-up to Meta, with your email address and account id in hashed (SHA-256) form, so Meta can link it to the ad you came from; and DataFast, a lightweight analytics service that counts page views, sign-ups, Facebook connections and launches so we can see which pages and channels work; it is not used to build advertising profiles
• Legal & Business Transfers: When required by law, court order or government request, or in connection with a merger, acquisition or sale of assets

7. Data Retention

We retain your personal data only as long as necessary. Your encrypted Facebook access token is deleted when you disconnect Meta or remove Adlio in Facebook; connections whose access has lapsed are purged 30 days later (Meta keeps a token valid while you use Adlio and ends its data access about 90 days after your last Facebook sign-in). Your account data and upload history are kept while your account is active and are deleted when you delete your account. Unfinished upload drafts are deleted 7 days after their last change. Per-file upload logs and the technical log of failed Meta API calls are kept for 90 days, the workspace activity feed for 12 months and cookie-consent proof records for up to 12 months. Invoices and payment records are retained for 7 years to meet Dutch tax-law obligations. We run automated daily clean-up to enforce these limits.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including encryption in transit and at rest, access controls and regular review. Your Facebook access token is encrypted at rest using AES-256-GCM. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us at privacy@adlio.ai

10. International Data Transfers

Our database and uploaded media are hosted in the United Kingdom, which the EU recognises as providing an adequate level of data protection. Some of our providers, including Meta (which processes data to create your ads), may process data in the United States; where this happens we rely on appropriate safeguards, namely EU-U.S. Data Privacy Framework certifications and/or the EU Standard Contractual Clauses.

11. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

• Essential: sign-in and session cookies, plus small functional cookies that remember your language, your currency and your cookie choice. These are required for the Service to work. Analytics: DataFast sets a first-party visitor cookie so repeat visits are counted once; it holds a random id, not your name or email address.
• Advertising: the Meta Pixel, which sets cookies and shares activity with Meta to measure and improve our own advertising, including the moment you create an account. It only loads after you opt in via the cookie banner, and without that opt-in we do not report your sign-up to Meta either.

Essential cookies are necessary for the Service to function and are always on. The Meta Pixel is non-essential and loads only with your consent; you can change or withdraw your choice at any time via the Cookie settings link in the footer.

12. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

14. Data Controller

Adlio is operated by:

• Company: Brodaro
• KvK Number: 87989700
• VAT Number: NL004519220B66
• Address: Klaproos 21, 7483AR Haaksbergen, Netherlands