California Privacy Notice (CCPA/CPRA)

• Identifiers. Email address, optional name, and IP address.
• Commercial information. Subscription status and billing records.
• Internet or network activity. Dashboard page views and feature interactions via PostHog.
• Sensitive personal information. Ad-network API credentials — used solely to provide the service on your instruction.
• Inferences. None — we do not build individual profiles from any of the above.

• Directly from you — at registration, payment, and when connecting ad networks.
• Automatically — via server logs and PostHog analytics as you use the dashboard.
• From Stripe — payment event webhooks (subscription status updates).

• Service delivery.
• Billing & subscription management.
• Transactional communications.
• Security & fraud prevention.
• Product improvement.

We do not sell personal information for money. We do not share personal information for cross-context behavioural advertising. Ad-network API credentials are transmitted to the relevant network solely on your instruction when you connect an integration.

• Right to Know. Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete. Request deletion of your personal information, subject to legal exceptions.
• Right to Correct. Request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing. We do not sell or share personal information, so there is nothing to opt out of.
• Right to Limit Use of Sensitive Personal Information. We already restrict use of your API credentials solely to service delivery; no further action is required on your part.
• Right of Non-Discrimination. We will not discriminate against you for exercising any of these rights.

Email matthew@adgreg.com with “CCPA Request” in the subject line. Include your name and a description of your request. We respond within 45 days, extendable by a further 45 days with notice. We may need to verify your identity before processing your request.

You may designate an authorized agent to submit a request on your behalf in writing. We may require proof of your identity and the agent’s authority before processing the request.

• Account data — deleted within 30 days of account deletion.
• Billing records — retained for 3 years to comply with Czech accounting law (Act No. 563/1991 Coll.).
• Analytics data — anonymised after 12 months.
• Server logs — deleted after 30 days.

The effective date at the top of this page reflects the latest version of this notice.