Privacy policy | Adbiscuit

1. Who we are

This website and our services are run by [legal name of the business], [registered address], [company number, if any] (“Adbiscuit”, “we”, “us”).

We decide how and why your personal data is used, which makes us the controller under data protection law, including the UK GDPR and the EU GDPR where they apply.

Questions or requests: email [contact email].

2. What we collect

We only collect what we need to answer your enquiry, run your project and keep our records straight.

When you apply through a form on our site: your brand website, work email, the product or campaign you want ads for and, if you add them, a link to existing creative and notes on what you’d like to explore.
When you use our onboarding page: your name, work email, brand website, monthly paid social spend range and which pack size you’re considering.
How you found us: the page you landed on, the site that sent you, campaign tags in the link (such as UTM tags), the button you clicked, your timezone and whether you’re on a mobile or desktop device.
When you book a call: your name, email and the time you choose, plus your onboarding answers so we can prepare.
During calls and projects: our notes from conversations, the assets you send us and our emails with you.
When you become a client: billing contact details, company details and payment records.

Your brand assets may include personal data about other people, such as faces in footage, creator content or customer reviews. Section 8 explains how we handle that.

3. How we use it and why

Data protection law requires a legal reason, called a lawful basis, for each use. Ours are:

Replying to your enquiry, booking calls and preparing a proposal: our legitimate interest in responding to business enquiries, and steps you ask us to take before a contract.
Delivering projects, invoicing and support: performing our contract with your business, and our legitimate interest in working with the people at that business.
Seeing which pages and campaigns bring enquiries: our legitimate interest in improving our marketing. We don’t track you across other websites.
Keeping business, tax and accounting records: our legal obligations.
Protecting our business and handling disputes: our legitimate interests.
Occasional updates about our services: our legitimate interests, or your consent where the law requires it. You can opt out at any time.

We don’t sell your personal data. We don’t make decisions about you using only automated processing that have legal or similarly significant effects. Our onboarding page may show a booking calendar or a message that we’ll review your brand first, depending on your answers. You can always email us instead.

5. International transfers

Some providers, including Google and Cal.com, may process data in the United States. When data leaves the UK or the European Economic Area, we rely on recognised safeguards, such as adequacy decisions (including the EU–US Data Privacy Framework for certified providers) or standard contractual clauses.

6. How long we keep it

Enquiries that don’t become projects: [how long, e.g. 24 months] after our last contact, then deleted.
Client and project records: while we work together, then [how long].
Invoices and accounting records: as long as tax and accounting law requires.

If you ask us to delete your data sooner, we will, unless we need to keep it to meet a legal obligation.

7. Cookies and similar technologies

We don’t use advertising or tracking cookies.

Framer Analytics counts visits without setting cookies.
Our onboarding page saves the campaign details from your link (such as UTM tags) in your browser’s session storage, so we can attach them to your enquiry. They’re cleared when you close the tab.
The booking calendar is provided by Cal.com, which may set cookies it needs to work. Cal.com’s own privacy policy applies to the calendar.
Fonts load from Google’s servers, which means Google receives your IP address.

If we add tools that use cookies for analytics or advertising, we’ll update this policy and ask for your consent first where the law requires it.

8. Client materials

The brand assets you send us may contain personal data, such as people in your footage or photos, creator content or customer reviews. For that data, we act on your behalf as a processor, and your business remains responsible for having the right to share it and use it in ads.

We only use client materials to produce your ads, including with AI tools where they help us produce approved creative. If your company restricts AI-assisted production, tell us before we agree scope. We can sign a data processing agreement on request.

9. Your rights

Depending on where you live, you can ask us to:

give you a copy of your data
correct it
delete it
restrict or object to how we use it, including objecting to marketing at any time
send it to you or another organisation in a portable format
stop using it where we rely on your consent

Email [contact email]. We’ll reply within one month and may need to confirm your identity first.

You can also complain to a data protection authority, such as [your supervisory authority, e.g. the ICO in the UK]. We’d appreciate the chance to sort it out with you first.

10. Keeping it secure

We limit access to the people and providers who need it, and take reasonable technical and organisational steps to protect your data. If a breach puts your data at risk, we’ll tell you and the regulator where the law requires.

11. Children

Our site and services are for businesses. We don’t knowingly collect data from anyone under 16.

12. Changes to this policy

We’ll update this page when our practices change and show the date at the top. If a change materially affects how we use your data, we’ll tell you directly where we can.

13. Contact

[legal name of the business], [registered address]. Email [contact email].