Privacy Policy
Last updated 10 August 2026
In short: We collect what we need to run your account and fill your brand into ads. We do not sell your data and we run no advertising trackers. You can export or delete everything from your account page.
1.Who controls your data
AdCartel is run by an independent developer in the State of Illinois, United States, and that person is the controller of the personal data described here. There is no company behind it and no team.
The site currently sells nothing, so no trading address is published. If that changes, a legal name and a postal address will be published here at the same time.
People sign up from anywhere, so this policy is written to the stricter European standard and applied to everyone. Where you have rights under your own state or national law on top of that, those apply too.
2.Exactly what we hold
This is the full list. It is written from the actual database schema rather than from a template, so if something is not here, we are not storing it.
| Data | Why | Where it lives | Legal basis | Public? |
|---|---|---|---|---|
| Account email and password | To create and sign you into an account. | Supabase (authentication). | Performance of a contract. | No |
| Google account name, email and profile picture, if you sign in with Google | To sign you in without a separate password. | Supabase (authentication). We never receive your Google password. | Performance of a contract. | No |
| Seller storefront: handle, display name, seller type, bio, website, portfolio, niches, formats, and for agencies team size and any client names you enter | To give your listings a public page buyers can judge you by. | Supabase (seller_profiles). | Performance of a contract. | Anyone can see it |
| Listings: the brand the ad ran for, the ad image, your description, price, and any spend or revenue you report | To show the ad on the store and let buyers remake the layout. | Supabase (ad_submissions). | Performance of a contract. | Anyone can see it |
| Proof screenshots you upload, and the description our AI writes of what it saw in them | To check the ad is really yours before the listing goes live. | Supabase (ad_submissions). The image is sent to Cloudflare Workers AI to be read. It is never shown on the store. | Performance of a contract. | No |
| Photos of your product you upload for a video remake | So the generated video shows your actual product instead of a lookalike. | Sent to fal.ai to run the video model. Not stored by us. | Performance of a contract. | No |
| Brand kit: brand name, product, colour and offer | To fill your details into ads without retyping them. | Your own browser only. | Performance of a contract. | No |
| Server logs (IP address, browser, pages requested) | To keep the service running and to investigate abuse. | Vercel (our host). | Legitimate interest in operating a secure service. | No |
3.What is public, and what is not
Two things you enter are visible to the whole internet, on purpose: your seller storefront and every listing on it. That is the point of a marketplace, but it is worth saying outright before you type anything into either. Everything else in the table above is private to your account.
Proof screenshots are the case worth spelling out. They often contain your own revenue figures, so they are never shown on the store. The image is sent to Cloudflare's AI to be read once, and only the resulting yes-or-no and a one-line description are kept.
4.Who else touches your data
These are every company we hand personal data to in order to run the service. We do not sell data to anyone, and we run no advertising or analytics trackers.
| Company | What they do for us | Where |
|---|---|---|
| Supabase | Database and sign-in | United States |
| Vercel | Hosting and server logs | United States |
| Cloudflare | AI that reads proof screenshots and writes layout recipes | Global network |
| fal.ai | Runs the video model on product photos you upload | United States |
| Sign-in, only if you choose it | United States |
5.Meta advertising data
Built, but not switched on. No Meta account can be connected today. The store is built to read read-only advertising results from a meta ad account you choose to connect, in order to to show measured results on a listing instead of a seller's own claim. No advertising data has been read from anyone, because the connection has never been switched on.
When it is, it stores an access token and the resulting spend, revenue and purchase figures. It will be opt-in, read-only, and revocable both from your account page here and from your Meta settings.
When it does exist it will be opt-in, read-only, and revocable from your Meta settings at any time. We will update this policy before it goes live, not after.
4.What we do not do
- We do not sell or rent personal data.
- We run no advertising or analytics trackers, and set no third-party marketing cookies.
- We do not build advertising profiles of you or track you across other websites.
- We do not make automated decisions that produce legal effects for you.
5.Who else processes it
We use a small number of processors, each bound to handle data only on our instructions: Supabase for accounts and database, Vercel for hosting and server logs, and Higgsfield for rendering. Reference ads are embedded from YouTube using its no-cookie domain, and nothing is requested from them until you press play.
Some of these operate outside the UK and EEA. Where data is transferred out, it is covered by Standard Contractual Clauses or an equivalent approved safeguard.
6.How long we keep it
Account and brand kit data is kept while your account is open, and deleted when you delete the account. Creator applications are kept for up to two years after a decision so we can explain it if asked. Server logs rotate within 30 days. Ads generated before accounts existed live only in your own browser and are gone when you clear site data.
7.Your rights, and how to actually use them
If you are in the UK or EEA you have the right to access, correct, delete, restrict, object to, and port your data. If you live in California, Colorado, Connecticut, Texas, Virginia or another US state with a privacy statute, you have comparable rights to know, delete, correct and opt out of sale. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing for you to opt out of.
We have built the two rights that matter most directly into the product rather than making you email us and wait:
- Export. Download everything we hold about you as a JSON file from your account page.
- Delete. Erase your storefront, every listing on it, your Meta connection and its token, your brand kit and everything this browser holds, from the same page. It is immediate and it is not reversible.
Export and delete are self-service above, so no request has to wait on us. A published contact address is coming, and any other request will be answered within one month once it is. We will not charge you for exercising a right, and we will not treat you differently for having done so.
If you think we have handled your data badly you can complain to your data protection authority. In the UK that is the Information Commissioner's Office, in the EEA it is your national supervisory authority, and in the US it is generally your state Attorney General.
8.Security and children
Passwords are hashed by Supabase and never visible to us. Every database table uses row-level security, so a signed-in user can only ever read or write their own row. No system is perfectly secure, and we will tell you and the regulator if a breach puts you at risk.
The store is not for under-18s and we do not knowingly collect their data.