Privacy Policy

Who we are

Adapty (adapty.pro) is operated by Artem Zhukov, carrying out individual activity under certificate No. 1308723 in the Republic of Lithuania ("Adapty", "we", "us"). We are the controller of the personal data described in this policy.

For anything about your data, write to [email protected].

What this policy covers

It covers adapty.pro and the Adapty application. Landing pages that our users publish on addresses ending in .adapty.pro are covered differently: there we process visitors' data on behalf of the person who published the page (see "Published landing pages").

What we collect

• Account: your email address, display name and password, which we store only as a one-way hash. If you sign in with Google or Facebook, we receive your email address, name and that provider's identifier for you.
• Guest use: a random identifier kept in a cookie, so that a project you start without an account stays yours.
• Your content: ideas, briefs, chat messages, the website address you give us and the text we read from that site, hypotheses, experiments, landing pages, and the images, logos and photos you upload or we generate for you.
• Advertising connections: the access and refresh tokens a platform issues when you connect it (stored encrypted), your user identifier at that platform, the ad accounts you can use there with their name, currency, time zone and status, related assets such as Facebook Pages, and the campaigns and ads you create through Adapty with their results.
• Usage and technical data: a record of each request we make to an AI model for you (the instructions and input sent, the model, tokens and cost), server logs (the address requested, the outcome, timing and your account identifier), and salted hashes of your IP address and browser user agent used against abuse. We do not keep raw IP addresses in our database.
• Plan: which plan you are on, its status and dates, and how much of it you have used. When paid plans are offered, payments are handled by Stripe; we never receive your card number.
• Messages you send us, for example to [email protected] or [email protected].

Why we use it

• To provide the service you asked for: your account and projects, the analyses and hypotheses, the pages you publish, and the campaigns we launch in your own ad accounts at your request. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the service secure and fair: rate limits, abuse prevention and investigating faults. Legal basis: our legitimate interest in a working, safe service (Art. 6(1)(f) GDPR).
• To run the service responsibly: tracking what each AI request costs and how reliable each part is. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• To meet legal obligations, such as answering a lawful request from an authority (Art. 6(1)(c) GDPR).

We do not sell personal data, we do not use it to profile you for advertising, and adapty.pro runs no third-party analytics or advertising trackers. We do not use your content to train AI models.

How AI is involved

To write analyses, hypotheses, texts and images, we send the relevant parts of your content to an AI provider, including photos you choose to use in an ad. The results are generated and may be wrong; you decide what to publish or launch. We make no decision with legal or similarly significant effect about you by automated means alone.

Who receives it

We share personal data only with the services we need to run Adapty, and only what each needs:

• AI providers: OpenAI, Anthropic, Google (Gemini API), DeepSeek and Alibaba Cloud (Model Studio). Which one handles a task is chosen per task, so the content you submit may reach any of them.
• Advertising platforms you connect: Meta, Google, TikTok, LinkedIn, Reddit and Snapchat. We send them what a campaign needs, on your instruction; their own privacy policies apply to what they hold.
• Sign-in providers, when you use them: Google and Meta.
• Hosting and network: Amazon Web Services stores files in the EU (Stockholm region); Cloudflare provides DNS, encryption in transit, caching and protection from attacks, and therefore processes IP addresses; the application, database and logs run on servers we operate ourselves.
• Email: Hostinger hosts our mailboxes and sends the emails we send you.
• Payments: Stripe, once paid plans are offered.
• Operational alerts: Telegram carries internal alerts to the operator, which can include an account's email address, for example when a new account is created.
• Authorities, when the law requires it.

Transfers outside the EU

Some of these recipients process data outside the European Economic Area, including in the United States and China. Where available, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified companies) or the Standard Contractual Clauses in the provider's data processing terms. Where neither is available, the transfer takes place because it is necessary to provide the service you request (Art. 49(1)(b) GDPR).

Published landing pages

When a user publishes a landing page with Adapty, the data its visitors leave (the name, email, phone number and message entered in a form) and the visit statistics are processed on that user's behalf: the user is the controller and we are their processor. Visits are counted without cookies, using a hash of the IP address and browser that changes every day, together with the referring site and campaign tags.

A page owner may add a Meta Pixel, a Google tag or a TikTok Pixel; those are loaded only on that owner's page, on their decision. Visitors who want to use their rights should contact the page owner; we help the owner answer.

Cookies and browser storage

adapty.pro uses only what is needed for the service to work, so it does not ask for consent:

• adapty.refresh_token — keeps you signed in; expires after 30 days.
• adapty.guest_id — ties a guest project to your browser; expires after 30 days.
• Browser storage — whether you are signed in, a sign-in in progress, and a guest draft, so a reload does not lose them.

There are no analytics or advertising cookies on adapty.pro.

How long we keep it

• Your account and content: while your account exists. When you delete it, we delete them, usually within minutes and at the latest within 30 days.
• Records of AI requests: on deletion we remove their content and the link to you, and keep only the model, tokens and cost for our accounts.
• Server logs: 30 days; warnings and errors 90 days; request traces 14 days.
• Guest projects: until they are kept in an account or deleted; a guest project that stays untouched may be deleted.
• Anything the law requires us to keep, such as accounting records, for as long as it requires.

Security

Traffic is encrypted, passwords are stored as hashes, advertising tokens are encrypted at rest, IP addresses are stored only as salted hashes, and access to our systems is limited to the operator. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the supervisory authority as the law requires.

Your rights

You may ask for access to your data, its correction, its deletion, a copy in a portable format, a restriction of its use, or object to processing based on our legitimate interest. Write to [email protected] from your account's email address; we answer within one month.

You can delete your account yourself at any time; the Data deletion page explains how, and what happens to data obtained from advertising platforms.

You may also complain to a supervisory authority: in Lithuania the State Data Protection Inspectorate (vdai.lrv.lt), or the authority where you live or work.

Children

Adapty is a business tool and is not meant for anyone under 16. We do not knowingly collect their data; if you believe we have, write to us and we will delete it.

Changes to this policy

We publish every change here with a new date. If a change matters for how your data is used, we tell you in the product or by email before it applies.