Privacy Policy

1. Who we are

Code Angels Unipessoal, Lda., NIPC 517335735, with registered office at Loures, Portugal, is the controller of the personal data described in this policy ("we", "us"). For any question about privacy or to exercise your rights, contact us at [email protected].

This policy explains how we process personal data when you visit our website, create an account, use adRobin (the "Service") or contact us.

When our business customers upload content that contains personal data, for example images of people or customer information, we process that data on their behalf as a processor. That processing is governed by the Data Processing Agreement, and the customer is the controller.

2. Personal data we process

• Account data: name, email address, password (stored only as a secure hash), language, roles, and identifiers of the social login provider you choose (Google, Microsoft, Apple or Facebook).
• Company and billing data: company name, tax number (NIF or VAT number), billing address, billing contacts, plan, subscription and invoice history, and the result of VAT number validations.
• Payment data: payments are processed by Stripe. We do not receive or store your full card number. We receive limited information such as card brand, last four digits, expiry date, country, and payment and fraud-risk results.
• Usage and technical data: IP address, browser and device information, dates and times of access, actions performed in the Service, credit consumption, error and security logs, and data used to protect accounts (for example login attempts and device information).
• Content: the brand information, texts, images, instructions, campaigns and chat messages you provide, and the content generated for you.
• Social platform data: when you connect Facebook or Instagram, the identifiers of your pages, accounts and ad accounts, access tokens, published posts and ads, and aggregated performance metrics provided by Meta.
• Communications: messages you send to support or through the contact form, emails we send you, and delivery and open events for those emails.
• Cookie choices: a random identifier, the choice you made in the cookie banner, the version of the Cookie Policy, the date, your IP address and browser, and your account if you are signed in.

3. Why we process it and on what legal basis

4. Artificial intelligence

To generate content and analyses, we send the relevant instructions and content to artificial intelligence models operated by third-party providers, through the provider OpenRouter. We send only what is needed for each request, and we record the requests and results to operate, secure and bill the Service.

We do not use your content to train our own models. We choose providers and configurations that do not allow your content to be used to train their models, where the provider offers that option.

5. Automated decisions

To protect payments against fraud, our payment provider Stripe automatically assesses the risk of each payment and may block payments considered high risk. We also apply automatic limits to detect abuse of trials and of the Service. If a decision of this kind affects you, you may ask for human review, express your point of view and contest the decision by writing to [email protected].

6. Who receives your data

We use the following service providers, who process data on our behalf under contracts that protect it:

• Amazon Web Services (application hosting, storage and email infrastructure; United States);
• MongoDB (database; United States);
• OpenRouter and the AI model providers it routes to, such as OpenAI and Google (content generation; United States);
• Stripe (payments and fraud prevention; Ireland and United States);
• Moloni (certified invoicing; Portugal);
• Postmark / ActiveCampaign (transactional email; United States);
• Cloudflare (security, content delivery and bot protection; worldwide network).

Other recipients:

• Meta Platforms receives data when you connect your pages and accounts and publish content through the Service.
• Social login providers receive data if you choose to sign in with them.
• The Portuguese Tax Authority receives the data included in invoices, as required by law.
• Authorities, courts and professional advisers receive data when necessary for legal obligations or claims.

We do not sell your personal data.

7. International transfers

Some providers process data outside the European Economic Area, mainly in the United States. In those cases the transfer is protected by one of the following:

• the recipient's certification under the EU-U.S. Data Privacy Framework;
• the Standard Contractual Clauses approved by the European Commission, with additional measures where necessary.

You can ask us for more information at [email protected].

8. How long we keep it

• Account and content data: while your account is active. After closure, up to 30 days to allow export, then deleted or anonymised, except for backups, which are overwritten within a further 35 days. When you ask us to erase your data, we do it without waiting for the 30 days.
• Invoices and tax records: for the period required by Portuguese tax law (currently 10 years).
• Security and access records (sign-in history, devices, IP addresses, the acceptance of these terms): up to 2 years, also after the account is deleted, to answer payment disputes and claims, which card networks allow for up to about 18 months. Records needed for pending disputes or claims are kept until they are resolved.
• Fraud-prevention data after an account is deleted (the email addresses, device identifiers, card fingerprints, VAT numbers and connected Meta assets the account used): 5 years, only to recognise the account if it signs up again (it does not get a second free trial) and to detect fraud. We use it for no other purpose. Both rely on our legitimate interest in preventing fraud and in establishing or defending legal claims.
• AI request logs: up to 12 months.
• Support conversations: up to 3 years after the request is closed.
• Email delivery events: up to 12 months.
• Cookie choice records: up to 3 years after the choice is replaced or withdrawn.

9. Security

We apply technical and organisational measures appropriate to the risk. These include:

• encryption in transit;
• access control and two-factor authentication for administrators;
• activity logging;
• regular backups.

No system is completely secure. If a breach affects your data, we will notify you and the authorities when the law requires it.

10. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time where processing is based on consent. To exercise these rights, write to [email protected]. We may need to confirm your identity.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

11. Cookies

We use only the cookies and similar technologies needed to run and protect the Service. See the Cookie Policy.

12. Minors

The Service is intended for businesses and is not directed at persons under 18.

13. Changes to this policy

We may update this policy. The version and date are shown at the top of this page. We will inform you of material changes by email or in the app.