Privacy Policy

The data controller is ADVENTA 2022 Ltd (trading as “Adventa Digital”), a company registered in the Bulgarian Commercial Register.

• →Company: ADVENTA 2022 Ltd („Адвента 2022“ ЕООД)
• →Company number (ЕИК): 207187647
• →Legal form: Single-member limited liability company (ЕООД) registered in Bulgaria
• →Registered address: 17 Tsar Ivan Shishman St, Alen Mak bl., entr. B, fl. 2, apt. 7, Botevgrad 2140, Bulgaria
• →Manager: Spas Tsvetoslavov Damyanov
• →Contact for privacy matters: damyanovspas@gmail.com

AdHub is an internal tool we built for ourselves. We use it to run and report on the advertising campaigns we manage for our clients.

• →It is not a public product. There is no self-service sign-up and no public registration.
• →It is not sold, resold, licensed or made available to third parties.
• →Only authorised employees of our agency have accounts and access.
• →It connects only to the ad accounts of clients who have explicitly granted us access through their own Meta Business portfolio or Google Ads account.

Once a client grants access, AdHub reads advertising data from the Meta Marketing API and the Google Ads API for that client’s ad accounts only:

• →Ad account details — identifier, name, currency, time zone, status
• →Campaign, ad set and ad structures and their settings
• →Delivery and performance metrics — impressions, clicks, conversions, spend
• →Ad creatives — the images and videos used in those ads, which we download and store
• →Access and refresh tokens for the authorised connection, stored encrypted

A client can revoke our access at any time from their own Meta Business settings or Google Ads account. When access is revoked, we stop collecting new data.

This is the important part, and we want to be unambiguous about it. AdHub does not collect or process personal data about the end users or customers of our clients. Specifically:

• →No customer lists, contact lists or uploaded audience files.
• →No email addresses, phone numbers or names of our clients' buyers or website visitors.
• →No lead-form submissions and no personally identifiable information about consumers.
• →No tracking of individuals, and no profiling of individuals, across websites or apps.
• →We do not sell, rent or share any of this data with third parties for their own purposes.

AdHub is an internal business system, so it does hold a limited amount of personal data — almost all of it about our own staff rather than about consumers:

• →Agency user accounts — name, email address, profile image, and login sessions for the employees who use the tool.
• →Audit records — which user performed which action, when, and the IP address the action came from. We keep these so that access to client advertising data is accountable.
• →Connection metadata — the platform user identifier of the person who authorised a given ad account connection, plus the granted scopes.

The legal basis for this processing is our legitimate interest in operating and securing an internal business system (Article 6(1)(f) GDPR), and, for staff accounts, the employment relationship.

Most of the advertising data we import — campaign structures, spend and aggregated performance metrics — is business data, not personal data.

Where client ad account data does contain personal data, we act as a processor on behalf of that client, who remains the controller, and we process it only on their instructions under our services agreement. For our own staff accounts, audit records and website enquiries, we act as the controller.

To make creatives searchable and comparable, AdHub sends ad creatives to Google’s Gemini API, which automatically describes and labels what is in the image or video. Only the media file itself is sent — no client name, no account identifier, no metrics and no personal data accompany it.

AdHub runs on servers we manage ourselves in the European Union (Frankfurt / Amsterdam). The database and the stored ad creatives stay within the EU.

The one exception is the creative labelling described in section 07, where media files are sent to Google outside the EEA.

• →Platform access and refresh tokens are encrypted at rest — they are never stored in plain text.
• →All traffic runs over HTTPS.
• →Access is limited to authorised agency employees, and the database enforces row-level isolation between clients.
• →Actions taken in the system are written to an audit log.

No system is perfectly secure, but these are the measures we consider appropriate for the data involved.

• →Client advertising data and creatives — kept for the duration of the engagement and deleted within 90 days after it ends.
• →Platform tokens — deleted as soon as a connection is removed or the engagement ends.
• →Audit records — kept for a limited period for security and accountability, then deleted.
• →Website enquiries — kept for up to 24 months after our last contact.
• →Accounting records — kept for the periods required by Bulgarian accounting and tax law.

You can ask us to delete data sooner at any time — see the data deletion page.

We do not sell your data. We share it only with the providers that make the service work:

• →Meta and Google — the source platforms we read advertising data from, under the access you grant.
• →Google (Gemini API) — automated labelling of ad creatives, as described in section 07.
• →Our EU hosting provider — the infrastructure AdHub runs on.
• →Vercel and Resend — hosting of this website and delivery of emails sent through its contact form.
• →Authorities and professional advisers — only where we are legally required to.

You have the right to:

• →access — obtain confirmation of what personal data we hold about you and a copy of it;
• →rectification — have inaccurate or incomplete data corrected;
• →erasure — have your data deleted (“the right to be forgotten”);
• →restriction — limit how we process your data in certain circumstances;
• →data portability — receive your data in a structured, machine-readable format;
• →object — object to processing based on our legitimate interests, including the creative labelling described above;
• →withdraw consent at any time, where processing is based on consent;
• →lodge a complaint with a supervisory authority.

Exercising these rights is free of charge and we respond within 30 days.

Email damyanovspas@gmail.com or use the data deletion form. We may ask for additional information to confirm your identity before we act — this protects your data from requests made by someone else.

If you believe we are handling your data unlawfully, you may complain to the Commission for Personal Data Protection (CPDP), Bulgaria:

• →Address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria
• →Email: kzld@cpdp.bg
• →Website: www.cpdp.bg

Separately from AdHub, this website processes a small amount of data:

• →Contact form — name and job title, email, and optionally phone, company name, website link, the topics you select and your message. These reach us as an email; there is no database behind the form.
• →Server logs — IP address, browser type and request time, recorded by our hosting provider for security and diagnostics.

We update this policy when the way we work changes or when the law requires it. The current version is always published on this page and the date at the top shows when it last changed.

Questions about this policy or about how we handle data go to damyanovspas@gmail.com.