# Privacy notice: Adsonomy URL: https://adsonomy.com/privacy Last updated: 20 September 2026 Plain-text version of the page above. Adsonomy is an independent product and is not affiliated with OpenAI. ## Summary The Adsonomy privacy notice, covering adsonomy.com, the demo and the Adsonomy app at app.adsonomy.com. It separates two roles: Adsonomy is the controller of your own account data, and only a processor of the business data the app reads from your shop, your website and your ad account on your instruction, where you are the controller. It sets out what is held as controller and on what legal basis, what the app does with business data, how long everything is kept, which processors are used, the rights under the GDPR, cookies, security, how changes are notified and where to write. ## Key facts - Controller for the account data: Adsonomy, operated by Dutch Bohemian Ventures, the Netherlands. Contact: hello@adsonomy.com. No data protection officer has been appointed, because the scale of the processing does not require one. - You are the controller of the business data the app reads, and Adsonomy acts only on your documented instructions. You decide what the app may read, what it sends to the ad platform and on what legal basis, and you are responsible for having that basis, for what your advertising says, and for complying with the ad platform's terms and with advertising, consumer and data protection law. - Customer data is not sold, not rented, not used to advertise to you or to anyone else, and not used to train AI models. - Legal bases for the data held as controller: performance of a contract, Article 6(1)(b); legitimate interest, Article 6(1)(f); consent for analytics, Article 6(1)(a); and legal obligation for email confirmation and consent records. - Identifiers such as email address and phone number used to measure results are hashed before they are stored or sent, and the raw values are never written to the database. IP addresses on the public forms are stored only as a one-way hash, never the address. - The AI manager is given the facts of your account to work from, not your shoppers' personal data, and nothing from your account is used to train anybody's model. - Retention: account data while the account is open plus 12 months; records that money changed or that a change was made, 7 years under Dutch tax and accounting law; demo workspaces and their synthetic data deleted 30 days after sign-up, with the lead record kept 24 months; waitlist entries from before launch deleted no later than 24 months after sign-up, or immediately on request; business data processed for you deleted or returned as the data processing agreement says; analytics 14 months. - Processors: DigitalOcean for hosting, in a data centre in Amsterdam, the Netherlands; Resend for sending email; OpenRouter for routing requests to the AI models the manager uses, with Anthropic as the model provider; Google Analytics, only if you accept the analytics cookie. - The ad platform you connect is not a processor. It is a separate controller with its own terms and its own privacy notice, and the same is true of your shop platform. - Data is stored in the European Union. Transfers outside the EEA are covered by the European Commission's standard contractual clauses or another safeguard recognised under the GDPR. - Requests are answered within one month. Complaints can go to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority where you live or work. - No special categories of personal data are collected, and the service is for businesses, not for people under 18. - Where this notice differs from the Terms of Service and the data processing agreement in them, those documents govern the customer relationship. ## Full text Privacy notice ## What we do with personal data, and what we never touch. Last updated 20 September 2026. Applies to adsonomy.com, the demo, and the Adsonomy app at app.adsonomy.com. This notice explains what personal data we handle, why, how long we keep it, who processes it and what rights you have under the General Data Protection Regulation (GDPR). It is written in plain English. Where it differs from the [Terms of Service](https://adsonomy.com/terms) and the data processing agreement in them, those documents govern the customer relationship. ### 1. The one distinction that matters There are two very different kinds of data here, and we hold them in two very different roles. **Your own data: we are the controller.** Your name, your work email, your company, your sign-up and your use of the app. We decide what to do with it, and this notice describes that. **Your business data: we are only a processor.** Everything the app pulls from your shop, your website and your ad account on your instruction: products, pages, orders, and any personal data inside them such as a shopper's email address, phone number or postal code. **You are the controller of that data. We act only on your documented instructions.** You decide what the app may read, what it sends to the ad platform, and on what legal basis. You are responsible for having that basis, for what your advertising says, and for complying with the ad platform's terms and with advertising, consumer and data protection law. We do not decide any of it and cannot. Customer data never leaves the purposes you set it. We do not sell it, we do not rent it, we do not use it to advertise to you or to anyone else, and we do not use it to train AI models. ### 2. Who is responsible Controller for the data described in section 3: Adsonomy, operated by Dutch Bohemian Ventures, the Netherlands. Contact: hello@adsonomy.com. We have not appointed a data protection officer, because the scale of this processing does not require one. All privacy questions and requests go to the address above. ### 3. What we hold as controller, and why | Data | Where it comes from | Why, and on what basis | |---|---|---| | Name, work email, company | You, at sign-up | To create and run your account. Performance of a contract, Article 6(1)(b) | | Email confirmation and its timestamp | Automatically, when you click the link | To prove the address is yours and that you asked us to write to you. Contract and legal obligation | | Password, stored only as a one-way hash | You | To let you in and nobody else. Contract | | What you did in the app, and when | Automatically | Support, security, and an audit trail of changes that spend money. Legitimate interest, Article 6(1)(f) | | Demo sign-up: name, work email, company, website, business type, budget band | You, on the demo form | To open a demo workspace and to follow it up. Contract and legitimate interest | | Hashed IP address | Automatically, on the public forms | To stop abuse. We store a one-way hash, never the address. Legitimate interest | | Consent records: terms version, marketing choice, timestamps | Automatically | To show what was agreed and when. Legal obligation | | Analytics about pages visited | A cookie, only if you accept it | To see which pages help. Consent, Article 6(1)(a) | We do not collect special categories of personal data about you, and the service is for businesses, not for people under 18. ### 4. What the app does with your business data On your instruction the app reads your catalogue, your website and your ad account, writes campaigns and changes to the ad platform inside the limits you set, and reports what happened. Where orders are used to measure results, identifiers such as email address and phone number are **hashed before they are stored or sent**, and the raw values are never written to our database. The AI manager is given the facts of your account to work from. It is not given your shoppers' personal data, and nothing from your account is used to train anybody's model. ### 5. How long we keep it - Account data: while you have an account, and 12 months after it closes, so we can settle questions and meet our own legal obligations. - Records that money changed or that a change was made: 7 years, which Dutch tax and accounting law requires. - Demo accounts: the workspace and its synthetic data are deleted 30 days after sign-up. The lead record is kept for 24 months. - Waitlist entries from before launch: deleted no later than 24 months after sign-up, or immediately on request. - Business data processed for you: kept while your account is open and deleted or returned as the data processing agreement says when it closes. - Analytics: 14 months. ### 6. Who processes data for us A short list, each bound by a data processing agreement, each acting only on our instructions: - **DigitalOcean**, hosting, data centre in Amsterdam, the Netherlands. - **Resend**, sending our email. - **OpenRouter**, routing requests to the AI models the manager uses, with **Anthropic** as the model provider. - **Google Analytics**, only if you accept the analytics cookie. The ad platform you connect is **not** our processor. It is a separate controller with its own terms and its own privacy notice, and what it does with data you send it is between you and them. The same is true of your shop platform. Data is stored in the European Union. Where a processor transfers data outside the EEA, the transfer is covered by the European Commission's standard contractual clauses or another safeguard recognised under the GDPR. ### 7. Your rights You may ask for access to your data, correction, deletion, restriction, portability, and you may object to processing based on legitimate interest. Where processing rests on consent you may withdraw it at any time, which does not affect what happened before. Write to hello@adsonomy.com and we will answer within one month. If you are unhappy with how we handled it you may complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority where you live or work. If your request concerns data we hold *for a customer* rather than about you, we will point you at that customer: they are the controller and we may not act on it ourselves. ### 8. Cookies The site sets nothing until you choose. Accepting analytics sets one Google Analytics cookie so we can see which pages help. The app itself uses a session cookie that keeps you logged in; it is strictly necessary and cannot be switched off without breaking the login. ### 9. Security Access to production is limited to the people who need it. Credentials you give us for your shop or your ad account are encrypted at rest and never shown again after you save them. We can restore data from backups. No system is perfectly secure, and section 19 of the Terms sets out what we do and do not promise. ### 10. Changes to this notice We update this notice when what we do changes. The date at the top always says when. Material changes to the customer relationship are notified as the Terms require. ### 11. Contact Write to the controller named in section 2 at hello@adsonomy.com.