Privacy Policy

The controller of personal data collected through the website and the client panel is the administrator of the paidcampaigns.com service. You can reach the administrator about any privacy matter at [email protected].

In this policy "we", "us" and "PaidCampaigns" mean the administrator of the paidcampaigns.com service. "You" means a visitor of the website, a person who creates an account or a person acting on behalf of a client.

We collect only the data needed to run the service.

• Account data: your email address, a hash of your password (we never store the password itself) and the one-time signup code we send to confirm your email address.
• Plan builder inputs: the answers you enter in the campaign plan builder on the homepage, such as industry, goal, channels and approximate monthly budget.
• Website URL: the address of the site you want to advertise, together with what we read from its public pages to prepare the plan or audit.
• Technical data: IP address, browser type, device type and pages visited, recorded in server logs for security and troubleshooting.
• Campaign source data: UTM parameters and the referring page that brought you to the site.
• Ad account access: the partner or agency access you grant from inside each ad platform, and the account identifiers that come with it.
• Briefs and messages: the brief you fill in the client panel, files you upload, panel messages and emails you send us.
• Billing data: plan, billing period, invoices and payment status. Card details are entered directly with the payment operator and never reach our servers.

• To create and run your account, deliver the plan you bought and manage your campaigns. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• To build your campaign plan in the plan builder. Legal basis: steps taken at your request before a contract (Article 6(1)(b) GDPR).
• To issue invoices and keep accounting records. Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR).
• To secure the service, prevent abuse and fix errors. Legal basis: our legitimate interest in a safe and working service (Article 6(1)(f) GDPR).
• To measure which pages and sources bring visitors, in aggregate. Legal basis: our legitimate interest in improving the website (Article 6(1)(f) GDPR).
• To send service emails such as signup codes, invoices, reports and replies to your messages. Legal basis: performance of a contract. We do not sell lists and we do not send third-party marketing.

When you grant us access to your ad accounts, analytics and CRM exports, we process the data inside them (for example audiences, conversion events and customer lists you upload for matching) only on your instructions and only to run your campaigns. For that data you are the controller and we act as your processor.

The terms of that processing are set out in a data processing agreement available in the client panel. It covers the subject matter, duration, security measures, subprocessor categories and assistance with data subject requests.

We share personal data only with service providers that help us run the service, and only to the extent they need it. We name them by category.

• Hosting provider that stores the website, the client panel and backups.
• Payment operator that processes subscription payments and stores card data.
• Email delivery provider that sends service emails such as signup codes and invoices.
• Analytics provider that helps us count visits and sources in aggregate.
• AI model provider that helps draft ad copy variations, which our specialists review and edit before anything runs.
• Advertising platforms you connect, which receive campaign data as part of the work you ordered.

We may also disclose data when the law requires it. We never sell personal data and we never share it for cross-context behavioral advertising.

Some providers process data outside your country, including in the United States. Where GDPR applies, transfers rely on adequacy decisions or standard contractual clauses approved by the European Commission.

• Account data and briefs: for as long as your account is active and up to 12 months after it is closed, so you can come back or request an export.
• Invoices and billing records: for the period required by tax and accounting law.
• Plan builder inputs without an account: up to 12 months.
• Server logs: up to 90 days, unless needed longer to investigate a security incident.
• Client advertising data processed as a processor: for the duration of the contract, then deleted or returned as set out in the data processing agreement.

The website uses only strictly necessary cookies: a session cookie that keeps you signed in, a CSRF token that protects forms and a cookie that remembers interface preferences. They are required for the site to work, so no consent banner is needed.

We do not place advertising pixels or third-party marketing cookies on paidcampaigns.com. Visit statistics are measured without advertising cookies.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format and object to processing based on legitimate interest. You can also lodge a complaint with your local data protection authority.

Residents of California and other US states with consumer privacy laws (including the CCPA as amended by the CPRA) have the right to know what personal information we collect and how we use it, to access it, to correct it, to delete it and to opt out of its sale or sharing. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you.

We will not discriminate against you for exercising any of these rights. You may use an authorized agent to submit a request on your behalf.

Send your request to [email protected] from the email address linked to your account, or describe how we can verify your identity. We reply within one month under GDPR and within 45 days under US state laws, and we tell you if we need more time.

We use encrypted connections, hashed passwords, access limited to the people who need it and regular backups. Access to your ad accounts is granted through the platforms' own partner tools, so we never need your platform passwords and you can revoke access at any moment.

The service is intended for businesses and is not directed to children under 16. We do not knowingly collect their data.

We may update this policy when the service or the law changes. The date at the top shows the latest version, and clients receive an email about material changes. See also our Terms of Service and Refund Policy.