Privacy Policy
Last updated: 12 October 2026
1. Who we are
Adplico is operated by Adplico LTD, a company registered in England and Wales, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
We are the data controller of your personal data within the meaning of Article 4(7) of the UK GDPR and the General Data Protection Regulation (EU GDPR, Regulation (EU) 2016/679).
Contact us:
- General enquiries:
- Data protection:
- Postal address: Adplico LTD, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
2. Data protection enquiries
For any question regarding the processing of your data or the exercise of your rights, contact us at .
3. What data do we collect and why?
We only collect the data strictly necessary for our purposes (data minimisation principle, Art. 5(1)(c) GDPR).
3.1 Creating and managing your account
| Data | Legal basis | Retention |
|---|---|---|
| Email address, first name, last name | Art. 6(1)(b) — performance of the contract | Lifetime of the account + 3 years after closure |
| Password (PBKDF2-SHA256 hash) | Art. 6(1)(b) | Lifetime of the account |
| Profile picture (via Google OAuth) | Art. 6(1)(b) | Lifetime of the account |
| Session data (encrypted token) | Art. 6(1)(b) | 30 days |
3.2 Signing in with Google (OAuth)
If you choose to sign in with Google, we retrieve your unique identifier, email address, first name, last name and profile picture. We do not access your Google account or any of your other Google data.
3.3 Using the service
| Data | Legal basis | Retention |
|---|---|---|
| Projects, videos, configurations | Art. 6(1)(b) | Lifetime of the account + 30 days |
| Activity logs | Art. 6(1)(f) — legitimate interest | 90 days |
| IP address (Cloudflare logs) | Art. 6(1)(f) | 30 days |
3.4 Subscription and payment
Payments are processed by our payment provider. We do not store your card number.
3.5 Connecting to Meta Ads
| Data | Legal basis | Retention |
|---|---|---|
| Meta access token (AES-encrypted) | Art. 6(1)(b) | Lifetime of the connection |
| Ad accounts, pages, pixels | Art. 6(1)(b) | Lifetime of the connection + 30 days |
| Metrics (CTR, ROAS, impressions) | Art. 6(1)(b) | 2 years |
3.6 AI video generation
The source images and videos you upload are transmitted to AtlasCloud (Seedance) for generation. If these files contain identifiable faces or voices, contact before uploading.
3.7 Transactional emails
Email address used for password resets and notifications (Art. 6(1)(b), lifetime of the account).
3.8 Cookies and trackers
On our public website, we use analytics cookies (Google Analytics 4) and advertising cookies (Meta Pixel) only with your prior consent. You can manage your preferences at any time via the “Manage cookies” link at the bottom of every page.
We also use PostHog for audience measurement: a cookie we set on the adplico.com domain lets us count visitors, understand which pages are viewed, and measure whether a visit leads to an account being created. This data is used solely to improve the service, is never cross-referenced with advertising processing, is neither shared nor sold, and is kept for thirteen months. It is hosted in the European Union. We also record sessions inside the application in order to fix what blocks our users: input fields are masked, and no password, API key or payment data appears in them. You may object by writing to us.
3.9 Adplico Chrome extension
Our browser extension connects your Chrome to your Adplico assistant. It has two features: downloading the images and videos of a page, and, if you link “assisted browsing” to your account, letting the assistant open and read pages to research your store. It processes the following data:
| Data | Legal basis | Retention |
|---|---|---|
| Adplico sign-in token (stored locally in your browser) | Art. 6(1)(b) — performance of the contract | Until sign-out or uninstall |
| Download button preferences (global and per-site, stored locally) | Art. 6(1)(b) | Until uninstall |
| Content of the pages the assistant opens or that you hand over to it: address, text, page structure and screenshots | Art. 6(1)(b) | Lifetime of the account + 30 days (technical log: 14 days) |
Downloading. Media on a page are detected entirely inside your browser, and downloads go through Chrome’s own save dialog. This feature sends neither the pages you visit nor the media you download to our servers.
Assisted browsing. It only works once you have linked it to your account, and you can disconnect it at any time. The assistant only acts in the tabs it opens itself, grouped apart, or in the tab you choose to hand over to it; Chrome shows its debugging banner for the whole session. Sensitive sites (banking, payment, messaging, accounts) are refused. What the assistant reads in those tabs is sent to our servers, then to the artificial intelligence model providers that run the assistant, to prepare your store research. On sites where you let it use your session, it browses pages: it never buys, publishes or sends anything on your behalf.
The extension collects neither your browsing history nor the content of the tabs you use yourself. This data only serves these two features: it is never sold, used for advertising or used to assess creditworthiness.
4. Who receives your data?
We do not sell your data. We share it only with our processors (Art. 28 GDPR):
| Processor | Role | Location | Safeguards |
|---|---|---|---|
| Cloudflare | Infrastructure, CDN | USA + global | EU-US DPF + SCCs |
| Payment provider | Payment | USA | EU-US DPF + SCCs |
| SendGrid (Twilio) | Transactional emails | USA | EU-US DPF + SCCs |
| Authentication, analytics | USA | EU-US DPF | |
| Meta Platforms | Ad publishing | USA (via IE) | EU-US DPF |
5. Transfers outside the European Union
Some processors are established in the United States. These transfers are governed by the EU-US Data Privacy Framework adequacy decision (2023/1795) and/or by Standard Contractual Clauses (SCCs, decision 2021/914). A copy is available on request at .
6. Retention periods
| Context | Retention |
|---|---|
| Active account | For the lifetime of the account |
| After closure | 3 years (account data) / 30 days (content) |
| Accounting data | 10 years |
| Technical logs | 30 to 90 days |
7. Your rights
In accordance with Articles 15 to 22 of the GDPR:
- Access (Art. 15): obtain a copy of your data.
- Rectification (Art. 16): correct inaccurate data.
- Erasure (Art. 17): request the deletion of your data.
- Restriction (Art. 18): temporarily freeze the use of your data.
- Portability (Art. 20): receive your data in a machine-readable format.
- Objection (Art. 21): object to processing based on our legitimate interest.
- Withdrawal of consent (Art. 7(3)): withdraw at any time a consent you have given.
Contact: — response within 1 month (Art. 12(3) GDPR).
8. Unsubscribing from marketing communications
Every commercial email contains a working unsubscribe link. You can also write to . Processing time: 10 business days.
9. Security
We implement appropriate technical and organisational measures (Art. 32 GDPR):
- Encryption in transit (TLS 1.3).
- Encryption of sensitive tokens at rest (AES).
- Password hashing (PBKDF2-SHA256, 100,000 iterations).
- Access limited on a least-privilege basis.
- Cloudflare infrastructure (SOC 2, ISO 27001).
10. Minors
Adplico is a professional service. We do not knowingly collect data from individuals under 18 years of age.
11. Right to lodge a complaint with a supervisory authority
As a UK company, our lead supervisory authority is the Information Commissioner’s Office (ICO) in the United Kingdom:
- Website: ico.org.uk
- Phone: +44 (0)303 123 1113
If you reside in the European Union, you may also lodge a complaint with the data protection authority of your country — in France, the Commission Nationale de l’Informatique et des Libertés (CNIL, www.cnil.fr).
12. Changes to this policy
We may update this policy. In the event of a material change, we will inform you by email and/or by notification within the application.