Privacy Policy

1. Who we are and what this Policy covers

1.1 This Privacy Policy explains what personal data AdScraper collects, why, how it is used, shared and kept, and the rights you have over it. It applies to the AdScraper website, application and every feature we offer (together, the “Service”), and it forms part of the Terms of Use.

1.2 The controller of the personal data described here is 55.828.563 CLAYTON LEONEL DA SILVA, an individual microentrepreneur (MEI) registered in Brazil under CNPJ 55.828.563/0001-64, based in Foz do Iguaçu, Paraná, Brazil (“AdScraper”, “we”, “us”). You can reach us, and our data protection contact, at the addresses in chapter 16.

1.3 We process personal data under the Brazilian General Data Protection Law (Lei 13.709/2018, the “LGPD”), the Brazilian Internet Act (Lei 12.965/2014) and, where they apply to you, the data protection laws of the place where you live.

1.4 Where you put other people's data into the Service, for example the address of a landing page or the text of a ticket, you decide why that data is there; we process it only to run the Service, and chapter 14 says what you are responsible for.

2. The data we collect

2.1 Data you give us when you sign in with Google: the identifier of your Google account, your email address, your name and your profile picture, as Google sends them. Your account is created from them on the first sign-in.

2.2 Data you give us in your profile and settings: your username, your name, your country, your timezone, your language, the picture you upload as an avatar, and your preferences for the Service.

2.3 Data created by your use of the Service: the pages you follow and their settings; the readings and histories of those pages; the pages you like and the members you subscribe to; the badges you receive; the last time you were seen using the Service; the records of the creatives saved for you and of the copies built for you; your tickets; your webhook endpoints, their secrets and the deliveries made to them; and a record of the work the Service runs for you, with its cost.

2.4 Data you type into the Service: the names and addresses of the links you add to a page, the terms of your searches, the addresses of your webhooks and the text of your tickets.

2.5 Data about your Google Drive, when you connect it: the email address of the connected account, the identifiers of the folders and files AdScraper creates there, and the access credentials Google gives us, kept encrypted. Chapter 5 describes this in full.

2.6 Technical data: the Service keeps the data of your sessions, including the device and network address they come from, and the connection records the Brazilian Internet Act requires, the date, time and IP address of each access, for six months, under confidentiality, disclosed only under a court order. It keeps no other log of your requests or of your browser.

2.7 We do not ask for and do not intend to collect sensitive personal data, such as data about health, religion, political opinions, sexual life or biometrics. Do not put such data in the Service.

3. Data about other people, and what others see of you

3.1 The Service reads the Meta Ad Library, which Meta publishes to the public, and records about the advertisers you follow the name and picture of their page, their ads and the addresses of their creatives, the transcripts of their videos and the copies built from them, and the landing pages, tracking, checkout and player elements found for them. The page's picture is served from a public address that needs no sign-in. Where an advertiser is an individual, some of this is personal data.

3.2 We process this data because the advertiser made it manifestly public in the Ad Library, and on the basis of our legitimate interest and yours in the transparency of advertising, in research and in competitive analysis, within the purpose and the good faith that justified its publication. We combine it only with what the advertiser's own ads and landing pages publish, never with other sources, and we do not use it to profile a person. We have weighed these interests against the rights and expectations of the people concerned, and keep a record of that assessment, which you may ask about.

3.3 If you are an advertiser and your page in the Service refers to you as an individual, you may ask us to remove it or to exercise the rights described in chapter 12, by writing to the address in chapter 16. We answer within fifteen days, as chapter 12 says.

3.4 Your profile is visible to every signed-in member: your username, your name, your picture, your badges, when you were last seen, your public pages and the count of your subscribers. Your email address and the date you joined are visible only to you and to our staff. Other members' profiles are visible to you on the same terms. Webhooks send data about your pages to the servers you choose; what those servers do with it is governed by you and by them, not by this Policy.

4. Why we use the data, and on which legal basis

4.1 To provide the Service to you under the Terms of Use: creating and keeping your account, reading the pages you follow, saving creatives to your Drive, building copies, reading the links you add, sending webhooks, showing your profile and the community features, answering your tickets, and, when they are offered, charging for plans and credits. Legal basis: the performance of the contract between you and us (LGPD article 7, V).

4.2 To keep the Service safe and honest: preventing fraud and abuse, enforcing the limits of the Service and the Terms of Use, keeping one account per person, and protecting the rights of members, advertisers and third parties. Legal basis: our legitimate interest (LGPD article 7, IX), weighed against your rights and expectations, and, where it applies, the exercise of rights in judicial or administrative proceedings.

4.3 To run and improve the Service: measuring how it is used, finding and fixing failures, and planning capacity, with data in aggregated or de-identified form wherever possible. Legal basis: our legitimate interest (LGPD article 7, IX).

4.4 To comply with the law: keeping the records the law requires, such as connection records and, when payments are offered, the fiscal and accounting records of your purchases, and answering lawful requests from authorities. Legal basis: compliance with a legal or regulatory obligation (LGPD article 7, II).

4.5 To connect your Google Drive and to process the data we receive from Google, as described in chapter 5. Legal basis: your consent, which you give on Google's consent screen and may withdraw at any time by disconnecting your Drive (LGPD article 7, I). If you do not connect it, creatives are not saved and copies are not built; nothing else changes.

4.6 We do not use your data for advertising, and we do not send marketing emails. The automated decisions in the Service are limited to enforcing its limits and plans, such as pausing readings when a balance reaches zero; you may ask us to review any of them.

5. Google sign-in and Google Drive

5.1 Signing in with Google gives us your Google account identifier, your email address, your name and your profile picture. We use them to create your account, to show who you are and to contact you about the Service.

5.2 When you connect your Google Drive, we ask Google only for the permission to manage the files that AdScraper itself creates in your Drive, and to know the email address of the connected account. AdScraper cannot see, change or delete any other file in your Drive.

5.3 With that permission, AdScraper creates its folders in your Drive, writes the creatives into them from your browser, keeps track of which of those files still exist, reads the videos it saved there to build the copies, as chapter 6 describes, and gives up its access when you disconnect. We store the identifiers of those folders and files, the email address of the connected account and the access credentials Google gives us, encrypted on our servers.

5.4 AdScraper's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. We use the data we receive from Google only to provide the features you see in the Service; we do not use it for advertising, we do not sell it, we do not share it with data brokers or advertising platforms, no person reads it except with your agreement, for security or as the law requires, and we do not use it to train or improve machine-learning models. The only data from your Drive that leaves our servers is the audio of the videos AdScraper saved there, sent to the providers described in chapter 6 to build the copies.

5.5 You may disconnect your Drive at any time in your profile. We then revoke AdScraper's access at Google and delete the credentials we held; your files stay in your Drive, where they belong to you. You may also revoke AdScraper's access yourself, in the settings of your Google account. Google's own processing of your data is governed by Google's privacy policy.

6. Automated analysis of creatives

6.1 To build the copies, AdScraper extracts the audio of the videos it saved in your Drive and has it transcribed and analysed by specialised speech-recognition and language-model providers, which return the transcript, the language spoken, the grouping of creatives into copies and the other results you see.

6.2 The audio and the transcripts are those of the advertisers' videos; they are not data about you, and the providers receive nothing that identifies you alongside them.

6.3 We keep the transcripts, shared between the members who saved the same video, and the copies built for you, for as long as the video is referenced by a member's Drive; after that they are deleted. We do not use the audio, the transcripts or the copies to train any model of our own. The providers that transcribe and analyse them receive the advertisers' public videos and nothing about you, and may keep and use what they receive under their own terms, which may include improving their own models.

7. Who we share data with

7.1 The providers we need to run the Service, each receiving only what its part requires: the provider that handles your sign-in and sessions; Google, for sign-in and, when you connect it, your Drive, as described in chapter 5; the providers that transcribe and analyse the advertisers' videos, as described in chapter 6; the providers that host the Service's database and files; and, when plans are offered, the payment providers, which receive what is needed to charge you, keep card numbers themselves, never on our servers, and, for the curators of the marketplace, receive what they need to verify and pay them.

7.2 Except Google, the payment providers and the providers that transcribe and analyse the advertisers' videos, which act under their own terms, these providers process data as our operators, on our instructions and under confidentiality, and may not use it for their own purposes.

7.3 When you save creatives, your browser fetches them from the advertising platform's servers, which may see your IP address, as they would if you opened the Ad Library yourself. The servers that receive your webhooks, and the websites you add as links, are chosen by you and act on their own account.

7.4 Our staff, who read your account data, your usage and your tickets to help you, to keep the Service safe and to enforce the Terms of Use; authorities, when the law or a court order requires it; and a successor, if AdScraper is merged, acquired or sold, with notice to you.

7.5 Other members: the profile data described in chapter 3, and your public pages. We do not sell personal data, and we do not share it with advertisers or data brokers.

8. International transfers

8.1 AdScraper is established in Brazil, and the providers in chapter 7 are in the United States and in other countries. Your data may therefore be transferred outside Brazil, and outside the country where you live.

8.2 We make these transfers under the LGPD (article 33): to providers that have signed the standard contractual clauses approved by the ANPD or offer equivalent guarantees, or where the transfer is necessary to perform the contract between you and us, as with the providers through which the Service runs (article 33, IX).

9. Cookies and storage in your browser

9.1 The Service uses the cookies needed to keep you signed in and, for a few minutes, to recognise you on your way back from Google's consent screen when you connect your Drive. They are necessary for the Service and expire or are deleted when their purpose ends.

9.2 The Service keeps in your browser's local storage which tab is saving creatives and how far the saving got, so that two tabs do not do the same work. This data never leaves your browser.

9.3 We use no analytics, advertising or tracking cookies and no third-party trackers in your browser. Because every cookie we use is necessary, we do not ask for your consent to them. If we ever add cookies that are not necessary, we will update this Policy and ask for your consent before using them.

10. How long we keep data

10.1 Your account data, your settings and the data created by your use of the Service are kept while your account is open. The readings and histories of a page are part of the Service and are kept as long as the page exists in it, even after you stop following it.

10.2 The creatives are in your Drive, under your control. The records about them on our servers, the transcripts and the copies are kept while a member's Drive references the video, and are deleted when no member's Drive does. Your webhook deliveries are kept with their endpoint and are deleted when you delete the endpoint. Your tickets and the record of the work run for you are kept while your account is open.

10.3 When you close your account, we block the sign-in at once and revoke and delete the Drive credentials we held. We delete or anonymise your personal data within ninety days, and sooner on your request at the address in chapter 16, except the records we must keep by law, such as the connection records of the Brazilian Internet Act, kept for six months, and the fiscal and accounting records of your purchases, kept for the periods the law sets, and except what we need to establish, exercise or defend a legal claim. The files in your Drive are never touched.

10.4 Our technical logs, which hold events of the Service and not your requests, are kept for fourteen days. If we keep backup copies, they are deleted on their own rotation within thirty days.

11. Security

11.1 We protect your data with measures appropriate to its nature: the credentials of your Google Drive are stored encrypted; webhook deliveries are signed so your server can verify them; connections to the Service are encrypted in transit; access to the Service's data is limited to the staff who need it; and the administration of the Service is open to administrators alone.

11.2 No method of transmission or storage is completely secure. Keep your Google account secure, since it is the key to your AdScraper account, and tell us at once if you believe your account was used without your authorisation.

11.3 If a security incident affecting your personal data may cause you relevant risk or harm, we will inform you and the National Data Protection Authority (ANPD) within three working days of learning of it, or six where the ANPD's rules for small agents apply, with the nature of the data involved, the measures taken and the ways to reduce the risk.

12. Your rights

12.1 Under the LGPD (article 18), you have the right to obtain from us, at any time and on request: confirmation that we process your data; access to it; the correction of data that is incomplete, inaccurate or out of date; the anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law; the portability of your data to another provider; the deletion of data processed with your consent; information about the entities with which we have shared your data; information about the possibility of not giving consent and the consequences of refusing it; and the withdrawal of your consent.

12.2 You also have the right to object to processing based on our legitimate interest, to ask for the review of decisions taken solely by automated means, and to petition the National Data Protection Authority (ANPD) about our processing. Where the law of the place where you live gives you other rights, you may exercise them with us in the same way.

12.3 Some of these rights you can exercise yourself in the Service: your profile and settings can be edited, your Drive can be disconnected, your links, webhooks and pages can be deleted, and your readings and copies can be exported. For the rest, write to the address in chapter 16. We may ask you to confirm your identity, we answer free of charge, and we answer within fifteen days of your request, and at once, in a simplified form, where that is possible.

12.4 Withdrawing your consent or asking for deletion does not affect the lawfulness of the processing done before, and does not cover the records we must keep by law, described in chapter 10.

13. Children

13.1 The Service is made for professionals and businesses, and the Terms of Use require you to be at least 18 years old. It is not directed at children, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.

14. Your responsibilities

14.1 When you add a landing page, name a link, set up a webhook or write a ticket, you may put personal data of other people into the Service. You are responsible for having the right to do so, and for using what the Service shows you about advertisers and other members within the Terms of Use and the law.

14.2 The servers that receive your webhooks, and anything you export from the Service, are under your control and your responsibility.

15. Changes to this Policy

15.1 We may update this Policy from time to time. The date at the top of this text says when it last changed.

15.2 When a change is material, we give you notice at least thirty days before it applies, by email to the address of your account or through the Service. If a change requires your consent, we ask for it before the change applies to you.

16. Contact and data protection contact

16.1 For any question or request about this Policy or your data, write to [email protected].

16.2 Our data protection contact (encarregado) is Clayton Leonel da Silva, reachable at [email protected]; this is also the channel between you, the National Data Protection Authority (ANPD) and us. You may petition the ANPD at gov.br/anpd.