Privacy Policy

1. In short

• We collect what we need to run your account, bill you, and generate the ads you ask for.
• We run advertising cookies only if you agree to them. If you have not agreed, no analytics or advertising tag loads at all. We never sell your data and we never build a profile of you to target other people. Change your choice whenever you like.
• We do not sell or share your personal information. Not to anyone, for any consideration.
• We do not use your uploads or your generated creatives to train any model.
• Two third parties can run in your browser: an error monitoring tool, always, and the advertising tags above, only with your consent. Both are disclosed in sections 7 and 15.

The rest of this page is the detail.

2. Who we are

AlsterAds, sole trader, owned by Andres Rayo Gomez, of Rückertstraße 7, 22089 Hamburg, Germany, is the controller of the personal data described in this policy. That means we decide why and how it is processed.

Owner: Andres Rayo Gomez

Contact for privacy matters: support@alsterads.ai

This policy covers alsterads.ai, app.alsterads.ai, and cdn.alsterads.ai.

3. What we collect

• Account data. Email address, name, and a hashed password. If you sign in through a third party identity provider, whatever that provider passes to us for that purpose, described next.
• Google sign-in, if you use it. Signing in with Google is optional and you can use an email address and password instead. If you choose it, Google passes us your name, email address, profile picture, and the account identifier Google uses for you. Those come from the three basic profile scopes we request and the only ones we request: openid, userinfo.email and userinfo.profile. We use them to create your account, recognise you when you sign in again, and reach you about billing and support. We store them in our own database with the rest of your account record, keep them for as long as your account exists, and delete them when you delete your account. We never request or receive access to Gmail, Drive, Calendar, Contacts, or any other Google service. We do not sell this data, do not use it for advertising, and do not use it to train any AI model. The only parties that touch it are the processors listed in section 7, which run our hosting, database, billing and email.
• Billing data. Your name, email, our internal user ID, your plan, your subscription and payment status, and your invoice and credit ledger history. We never see or store your card number: card data goes directly from your browser to Stripe.
• Content you give us. Product images, brand assets, logos, product descriptions, brand information, prompts, scripts, ad copy briefs, and any other material you upload or type into the generation tools. Also the creatives the Service generates for you, which we store so you can come back to them.
• Usage data. Which features you use, searches you run, filters you apply, brands you track, ads you save, projects you create, generations you run, and the credit ledger entries those produce. We use this to run your account, enforce plan limits, bill correctly, and understand which parts of the product are worth improving.
• Device and log data. IP address, user agent, browser and operating system, the URL requested, referrer, country as inferred by our hosting edge, and timestamps. This is collected automatically by our hosting provider on every request, the way it is on essentially every website.
• Support communications. If you email us, we keep the message and our reply.
• Error diagnostics. When something breaks, our error monitoring tool captures a report: stack trace, the URL, your user ID, IP address, user agent, and a session replay of the moments around the error. A session replay is a reconstruction of what was on your screen and what you clicked. It is recorded only when an error occurs. Details in sections 7 and 15.

Advertising measurement, with your consent. We advertise on Facebook, Instagram and Google. If, and only if, you accept advertising cookies, Meta and Google tags load and tell us that a visit came from one of our ads and whether it led to a signup or a purchase. Those providers may match that to an account you hold with them. Nothing loads before you accept, and you can withdraw at any time on our cookie page.

What we do not do. We do not sell your personal information. We do not fingerprint your device. We do not use your uploads or generated creatives to train any model. We do not knowingly collect anything from children (section 16).

4. Why we process it, and our lawful basis

Under the GDPR we must state a lawful basis for each purpose. Here they are.

Where we rely on legitimate interests, our interest is protecting and improving the Service for our customers, not building a profile of you. We do not currently run a marketing list. If we start one, it will be opt-in with a one-click unsubscribe.

Special category data.We do not ask for it and the Service is not designed to handle it. Do not upload health data, biometric data, political or religious information, or data about anyone's sex life or sexual orientation. If you upload a photograph of an identifiable person, you are responsible for having the rights and, where required, the consent to do so.

Withdrawing consent. Where we rely on consent, you can withdraw it at any time. That does not affect processing done before you withdrew.

Objecting to legitimate interests. Where we rely on legitimate interests, you can object. See section 10.

5. Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects using automated processing alone. The AI in AlsterAds generates advertising material from your inputs. It does not profile you or decide anything about you.

6. What we do not do with your content

To be explicit, because customers ask:

• We do not use your uploads or your generated creatives to train our own models.
• We instruct our AI processing providers not to use your data to train their models, and rely on their enterprise or API terms for that.
• We do not sell your data.
• We do not share your content with other customers.
• We do not use your creatives in our marketing without separate written permission.

7. Processors: who else touches your data

These are the companies that process personal data on our behalf. We name them because that is what the GDPR requires, and because you deserve to know where your data goes.

Hosting and edge network

Database, authentication, and legacy file storage

Media storage and content delivery

Payments

Transactional email

Error monitoring

AI processing

These providers receive the content you submit for generation: prompts, product descriptions, brand information, scripts, and uploaded product images. They do not receive your name, email, or billing data.

Advertising measurement (only with your consent)

These receive data from your browser ONLY if you accepted advertising cookies. If you refused, or have not answered, they are never loaded and receive nothing.

Public advertising data sources

Sources we read from. They give us data about publicly running advertisements. In normal operation they do not receive your personal data, but our requests to them carry our server's network metadata.

Public web research and enrichment

Used to enrich public information about online stores and to support persona research. These are sources we read, not places we send your account data.

Others. We may also disclose data to professional advisers such as accountants and lawyers, to authorities where legally required, and to a buyer or successor if the business is sold. If the business is sold, we will tell you before your data moves and this policy will continue to apply until it is replaced.

8. International transfers

We are established in Germany. Most of the processors above are established in the United States or transfer data there.

Where we transfer personal data outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, supplemented for UK data by the UK International Data Transfer Addendum, together with the supplementary measures set out in each provider's Data Processing Agreement. Some providers are also certified under the EU-US Data Privacy Framework.

You can request a copy of the safeguards used for a specific transfer by writing to support@alsterads.ai.

9. How long we keep things

10. Security

We take security seriously and have done specific work on it. In summary:

• All traffic is served over HTTPS.
• Passwords are hashed by our authentication provider. We never see them.
• Database access is protected by row level security, so one customer's rows are not reachable from another customer's session.
• Session tokens are short-lived and can be revoked per session.
• Server-side functions that run with elevated privileges have their search path pinned, which closes a known class of privilege escalation.
• API routes are rate limited.
• Card data never reaches our infrastructure.
• Access to production systems is limited to people who need it.

No system is perfectly secure. If you find a vulnerability, please tell us at support@alsterads.ai rather than disclosing it publicly, and we will work with you.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and notify you where the law requires it.

11. Your rights

Under the GDPR and the UK GDPR you have the right to:

• Access. Get a copy of the personal data we hold about you.
• Rectification. Have inaccurate data corrected.
• Erasure. Have your data deleted, where no legal obligation requires us to keep it.
• Restriction. Have processing paused while a dispute about accuracy or legitimate interests is resolved.
• Portability. Receive the data you gave us in a structured, machine readable format, and have it sent to another controller where technically feasible.
• Object. Object to processing based on legitimate interests, and object absolutely to direct marketing.
• Withdraw consent at any time, where consent is the basis.
• Not be subject to a solely automated decision with legal or similarly significant effect. As noted in section 5, we do not make such decisions.
• Complain to a supervisory authority. See section 17.

How to exercise them

In the app. Your account settings let you edit your account details, export your generated creatives, and close your account.

By email. Write to support@alsterads.ai from the email address on your account. Say what you want. A plain sentence is enough. We do not require a form.

Timeline. We will respond within one month. If your request is complex we may extend by two further months and will tell you why within the first month.

Identity. If we cannot tell that a request is from you, we may ask for enough information to be sure. We will not ask for more than is necessary.

Cost. Free, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline, and will explain why.

Export and deletion specifically

Export. Ask at support@alsterads.ai for a full export. You will get your account data, your project and brand records, your credit ledger, and links or files for your uploaded and generated media.

Deletion. Close your account in settings, or ask us. On deletion we remove your account data, content, and generated creatives within 30 days. Two things persist: billing records we are legally required to keep, and backup copies that expire on their normal cycle. Neither is used for anything other than the obligation that requires them.

12. United Kingdom

If you are in the UK, the UK GDPR and the Data Protection Act 2018 apply to you. Your rights are the same as those listed in section 11.

Transfers of your data outside the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on a UK adequacy regulation.

You can complain to the Information Commissioner's Office. Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk. Helpline 0303 123 1113.

13. Canada, Australia, and New Zealand

Canada (PIPEDA)

If you are in Canada, the Personal Information Protection and Electronic Documents Act applies.

• Consent. We collect, use, and disclose your personal information for the purposes described in section 4. By creating an account and using the Service you consent to those purposes. You may withdraw consent, subject to legal and contractual limits, by closing your account.
• Access and correction. You can ask for access to your personal information and ask us to correct it.
• Storage outside Canada.Your personal information is stored and processed outside Canada, including in the United States and the European Union. While it is in another country it is subject to that country's law, and may be accessible to that country's courts and law enforcement under that country's legal process.
• Complaints. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Australia (Privacy Act 1988 and the Australian Privacy Principles)

• What we collect and why. As set out in sections 3 and 4.
• Overseas disclosure (APP 8). We disclose personal information to overseas recipients: the processors named in section 7, located principally in the United States and the European Union.
• Access and correction (APP 12 and 13). Write to us using the address below.
• Direct marketing (APP 7). We do not currently run direct marketing. If we do, it will be opt-in with an unsubscribe in every message.
• Complaints. Write to us first. We will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
• Notifiable data breaches. If a breach is likely to cause serious harm, we will notify you and the OAIC as required by the scheme.

New Zealand (Privacy Act 2020)

• Information privacy principles. We collect only what we need, directly from you, for the purposes in section 4.
• Access and correction (IPP 6 and 7). Write to us using the address below.
• Disclosure outside New Zealand (IPP 12). We disclose personal information to overseas processors named in section 7. We rely on those providers being subject to comparable safeguards through their Data Processing Agreements.
• Complaints. Write to us first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
• Notifiable privacy breaches. If a breach is likely to cause serious harm, we will notify you and the Privacy Commissioner.

14. California (CCPA and CPRA)

If you are a California resident, this section is for you. We use the CCPA's defined terms here.

We do not sell your personal information

We have never sold personal information for money, and we do not sell it now.

Sharing for advertising, and how to stop it

We do want to be precise here rather than reassuring. If you accept advertising cookies, the Meta and Google tags described in section 7 receive identifiers from your browser so we can measure whether our ads work. Under California law that counts as sharing for cross-context behavioral advertising, even though no money changes hands and even though we receive nothing in return but a conversion count.

If you have not accepted, or you have refused, no sharing happens at all: the tags are never loaded.

To opt out, or to change your mind at any time, use the controls on our cookie page. That is our "Do Not Sell or Share My Personal Information" mechanism. It takes effect immediately and we do not ask you to create an account or verify your identity to use it.

We also honour the Global Privacy Control signal. If your browser or extension sends GPC, we treat it as a refusal automatically and no advertising tag loads, whatever is stored on this device and without you having to click anything.

Categories collected

Sources: directly from you, automatically from your device and browser, and from our payment processor. Business purposes: as set out in section 4. Disclosure for a business purpose: to the service providers listed in section 7, each under a contract that restricts them to processing it for us. Retention: as set out in section 9.

Your California rights

• Know. Request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Delete. Request deletion, subject to legal exceptions such as our record-keeping obligations.
• Correct. Request correction of inaccurate personal information.
• Opt out of sale or sharing. Not applicable. We do neither.
• Limit use of sensitive personal information. Not applicable in a meaningful sense. See the table above.
• Non-discrimination. We will not deny service, charge a different price, or give you a worse experience for exercising a right.

How. Email support@alsterads.ai from your account email. We will verify you by confirming control of that address, and respond within 45 days, extendable once by a further 45 days with notice.

Authorized agents. An agent may act for you with written permission. We may still verify your identity directly.

Other US states. If you live in a state with a comparable privacy law, including Virginia, Colorado, Connecticut, Utah, or Texas, we will honor equivalent access, correction, deletion, and opt-out rights on the same basis.

15. Cookies and browser storage

The short version: we do not track you.

• aa_auth. A first party cookie on .alsterads.ai, 90 day lifetime, whose value is literally the character "1". It records nothing about you except that you have signed in before, so that returning visitors are routed to the app rather than the marketing page. Strictly necessary.
• Session data in localStorage. Your authentication session, stored by our authentication provider. Strictly necessary. Clearing it signs you out.
• Theme preference in localStorage. Whether you chose light or dark.
• Error monitoring. The Sentry browser SDK loads on the app and records a session replay only when an error occurs, never on ordinary sessions.

Analytics and advertising cookies are set only if you accept them, and never otherwise. See our cookie page to change that at any time.

16. Children

AlsterAds is a business tool and is not for children. You must be 18 or older to hold an account. We do not knowingly collect personal data from anyone under 16.

If you believe a child has given us personal data, write to support@alsterads.ai and we will delete it.

17. Complaints and changes

Please come to us first at support@alsterads.ai. We would rather fix something than have you escalate it. You also have the right to complain to a supervisory authority, and you do not have to talk to us first:

• Any EU or EEA country: the authority where you live, where you work, or where the alleged infringement happened.
• United Kingdom: the Information Commissioner's Office, ico.org.uk.
• Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca.
• Australia: the Office of the Australian Information Commissioner, oaic.gov.au.
• New Zealand: the Office of the Privacy Commissioner, privacy.org.nz.
• California: the California Privacy Protection Agency, cppa.ca.gov, or the Attorney General, oag.ca.gov.

We may update this policy. If a change is material we will tell you by email or an in-app notice before it takes effect. The date at the top of this page always shows the current state. We keep prior versions on request.

18. Contact

AlsterAds, sole trader, owned by Andres Rayo Gomez
Rückertstraße 7, 22089 Hamburg, Germany
Privacy: support@alsterads.ai

Company details required by German law are in our Impressum.