Privacy Policy

Last updated: 8 October 2026

adup turns a product page into finished ad creatives and publishes them to your own advertising accounts. Doing that means handling three sensitive things: access to your ad accounts, information taken from your website, and the performance data your ads produce. This policy describes each of them specifically rather than in general terms.

1. Who we are

Societatea cu Răspundere Limitată “NICKTIM SOLUTIONS” (IDNO 1024600084676), bd. Traian 1/1, ap. 110, MD-2060, Chișinău, Republic of Moldova (“adup”, “we”) is the controller of the personal data described here. Contact us at privacy@tryadup.com.

Our representative in the European Union. Because adup is established outside the European Union, we have appointed a representative under Article 27 GDPR. Anton Zaharov, Str. Laminoriștilor nr. 2, sc. 1, et. 3, ap. 63, 800640 Galați, județul Galați, Romania, contactable at gharfat222@gmail.com, may be addressed on all matters relating to the processing of personal data of people in the EU. You may contact our representative instead of, or in addition to, us.

2. What we collect

Account information

Your email address, name and profile picture, and — depending on how you sign in — an identifier from Google or Facebook, or a hashed password. We never store a password in readable form.

Advertising-platform credentials

When you connect Meta or Google Ads we store the OAuth access and refresh tokens that authorise us to act on your behalf. These are the most sensitive items we hold: they permit reading and writing in your advertising account, including creating ads that spend your money. We store one token per connected platform, plus the Meta token issued when you sign in with Facebook.

Advertising-account metadata

The account's name, time zone, currency, whether it is a test or manager account, and its minimum daily budget. Reporting days belong to your ad account's time zone, so we need it to report your numbers correctly.

Performance data

For each ad you publish through us, one record per reporting day: impressions, clicks, spend, conversions, revenue, reach and the rates derived from them. Both platforms restate this data for weeks after the fact, so we refresh a trailing window rather than storing it once.

Brand and product information from your website

If you give us your website address, we fetch that site and use an AI model to extract your brand identity (colour palette, description) and a catalogue of your products, including product names and image URLs. We only fetch pages that are publicly accessible.

Creatives you generate

Generated images, the editable text layers on them, and the flattened exports. These are held in a private storage bucket and are readable only through short-lived signed links.

Technical records of AI usage

For each call we make to an AI provider we record the provider, model, timing, token counts and cost. These records currently include the request and response content sent to the model, which can contain material extracted from your website and the creative brief you wrote.

Visitors to our website

Everything above describes data you give us as a customer. Separately, if you accept cookies on this website, we load the Meta Pixel and the Google tag (Google Analytics and Google Ads) on our homepage and these policy pages. Google Analytics also runs inside the adup app itself; that is described under How you use adup below. They tell Meta and Google that a browser visited a page here — and which step it reached: clicking through to the box where you paste your store link, seeing it, starting to type, or continuing into adup — along with that browser’s IP address, user-agent string and any Meta or Google cookies it already carries, so that we can measure whether our own ads work. They never receive the store link you type, or anything else you enter.

Nothing is loaded unless you accept it. Until you choose, we do not contact Meta or Google at all — no script is fetched, no cookie is set, and no request leaves your browser. If you decline, none of it is ever loaded. Your choice is stored in your own browser, not on our servers. One choice covers both this website and the adup app, so you are asked once rather than twice. You can change your mind at any time with Cookie settings at the bottom of any page here, or under Profile inside adup: withdrawing stops the tags sending anything further and deletes the cookies they set, and from then on they are not loaded at all. Clearing this site’s data in your browser has the same effect.

Starting from our homepage

Our homepage does not collect your contact details. When you paste your store link there, it is not sent to our servers from the homepage: it is passed to the adup app in the address of the page you land on, together with which advertising link brought you (the campaign tags in that link), the page that referred you, and which page of ours you started from. The app uses them once you sign in — the store link to set up your brand, the rest to know which of our own ads and pages bring people who stay.

Until 7 October 2026 the homepage carried a demo-request form. If you sent a request through it, what you entered is still held and handled as it was described when you sent it, and is deleted on the schedule in section 7.

Getting started inside adup

After you sign in, adup asks a few questions so it can set itself up for you: your role, roughly how many ad creatives you need each month, where you advertise, which platform your store runs on, what costs you most time today, which tools you use now, and how you heard about us. We keep your answers.

Two further things are optional, and each is asked for separately. If you would like a short setup call, you can give us a way to reach you (for example a Telegram handle or a phone number); we ask for your explicit consent before we keep it, and use it only to arrange that call. And you can choose to receive marketing email from us. Saying no to either changes nothing about the service.

We also keep the feedback you give inside the product: ratings, answers to short surveys, and anything you write to us in free text.

How you use adup

If you accept cookies, Google Analytics runs inside the app as well as on this website. It records how you move through it: which screens you open, which steps of setting up and generating a creative you reach and finish, which ones you skip, whether a generation finished, whether a publish was accepted, and whether you were shown an error. We use it to find where the product gets in your way.

It is tied to your account by the account’s own identifier — never your email address or your name — so that the same person on a phone and on a laptop reads as one journey rather than two. Alongside it we record which plan you are on, and your credit balance as a broad band rather than a figure.

What it never receives: your email address, your name, your store address, your brand or product information, your creatives or any text in them, your advertising performance, the wording of any error message, and the one-time links we email you. These are removed before anything is sent.

This is the same single choice described above, not a second one: until you accept, Google Analytics is not loaded in the app either, and if you decline it is never loaded at all. You can change it under Profile inside adup, or with Cookie settings at the bottom of any page here.

Separately from this, and whether or not you accept cookies, we count how far accounts get through setting themselves up — on our own servers, from the answers you have saved. That is how we know whether setup works at all, rather than only how it looks to the people who accepted cookies. It is covered by the same record of your onboarding answers described above, and is deleted with them.

3. Why we use it, and on what basis

4. Who we share it with

We do not sell your personal data. Nothing you entrust to us as a customer — your creatives, your brand and product information, your advertising performance — is ever used for advertising of our own. There are two narrow exceptions, and both happen only if you accept cookies. First, the Meta Pixel and the Google Ads tag described in section 2 report your visit to this site, so we can measure our own ads. Second, Google Analytics records how you move through the app — which screens and setup steps you reach, and whether what you asked for worked. Neither ever carries your creatives, your brand or product information, your advertising performance, or your contact details. We share data with the processors below, each of which acts on our instructions:

We also send data to Meta and Google Ads — but as your agents, at your instruction, to publish into your own advertising accounts. What those platforms then do with it is governed by their own terms and privacy policies, not ours.

Paddle is not in the table above, because it is not our processor. Paddle is the merchant of record for purchases: it sells the subscription to you, takes the payment and handles the tax, as its own controller under its own privacy policy. We never receive or store your card details. What reaches us is the fact of a purchase and the identity attached to it, so that we can apply credits to the right account and keep the accounting records we are required to keep.

International transfers

Several of our processors operate outside the European Economic Area, in the United States. Transfers to them rely on the Standard Contractual Clauses approved by the European Commission, incorporated into each processor’s data processing agreement, or — where that processor is certified under it — the EU–US Data Privacy Framework. The UK Addendum to those clauses covers transfers subject to United Kingdom law.

Two of the processors handling your onboarding answers are worth naming specifically, because they are not alike. Brevo, our email and contact list, is hosted inside the European Union — so what you tell us does not leave the EEA on its way there. Telegram is a different matter: the notification telling our founder that you have signed up, or asked for a setup call, carries your answers and any contact you gave for the call to a service established outside the EEA, relying on the Standard Contractual Clauses. We accept that tradeoff for one reason, and you should know what it is: it is what lets a real person get back to you within minutes instead of the next working day. If you would rather we did not, write to privacy@tryadup.com and we will delete the notification.

5. Google Ads data

If you connect Google Ads, you grant us the https://www.googleapis.com/auth/adwords scope. We use it for exactly two things: creating and managing the ads you ask us to publish, and reading back their performance so we can show it to you in adup. We do not use Google user data to train any model, we do not transfer it to third parties for their own purposes, and we do not allow humans to read it except where you ask us for support, where the law requires it, or to investigate abuse or a security incident.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke our access at any time in adup's Connections screen or from your Google account permissions.

6. Meta data

If you connect Meta, we request the permissions needed to list your ad accounts and Pages, publish ads and read their performance. You can disconnect in adup at any time, which revokes our authorisation with Meta, or remove the app from your Facebook settings. Removing it there tells us to delete your data, and we act on that automatically.

7. How long we keep it

While your account is open, we keep your data for as long as you use the service. Advertising performance data is refreshed on a rolling window and retained so that your historical reporting remains available.

When you delete your account, we delete your personal and content data — see Deleting your data for exactly what that covers. We retain de-identified advertising-performance and billing records: the account reference is replaced with a random value that is not stored anywhere alongside your identity, so the remaining rows cannot be traced back to you. We keep them to understand which creative formats perform, what our costs are, and to maintain the accounting records we are legally required to keep.

We should be straightforward about the limit of that: de-identification is strong but not absolute. An account with a very distinctive advertising history could in principle be recognised by someone who already holds matching records from an ad platform. We remove every direct identifier, every ad and campaign identifier, your website address and all ad copy specifically to make that as difficult as possible.

Your onboarding answers, the contact you gave for a setup call, your marketing-email choice and your in-product feedback are kept for the life of your account, and deleted when you delete it. You can withdraw consent for the call contact or for marketing email at any time without deleting anything else.

The website-visit and in-app usage records held by Google Analytics are kept for 14 months and then deleted automatically. What the Meta Pixel reports is held by Meta under its own terms. Withdrawing consent stops anything further being sent and removes the cookies from your browser; it does not delete what was already received, which you can ask Google and Meta to do directly, or ask us to pass on.

A demo request sent through our former homepage form is kept for 24 months from the last time we were in contact — not from when you sent it, so a conversation that is still going is never deleted out from under itself. After that it is deleted automatically. The copy held in Brevo is removed before our own record is, so that a copy of you cannot outlive the record that says it exists. If you would like it gone sooner, write to privacy@tryadup.com and it will be — you do not need an account to ask.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or object to our processing of your personal data, and to erase it. You can delete your account and data yourself from your profile page in adup, or ask us at privacy@tryadup.com. You may also complain to your local data protection authority.

9. Security

Data is transmitted over TLS, our storage bucket is private and served only through short-lived signed links, and access to production systems is restricted.

In the interest of accuracy: advertising-platform tokens are currently stored without additional encryption at rest beyond the protections provided by our database host. We are working to change this. We mention it because a policy that claims more than the system does is worse than one that is candid.

10. Children

adup is a business tool and is not directed at anyone under 18.

11. Changes

We will update this page when our practices change and revise the date at the top. If a change materially affects you, we will tell you directly.