What we do with personal data, and what we never touch.
This notice explains what personal data we handle, why, how long we keep it, who processes it and what rights you have under the General Data Protection Regulation (GDPR). It is written in plain English. Where it differs from the Terms of Service and the data processing agreement in them, those documents govern the customer relationship.
1. The one distinction that matters
There are two very different kinds of data here, and we hold them in two very different roles.
Your own data: we are the controller. Your name, your work email, your company, your sign-up and your use of the app. We decide what to do with it, and this notice describes that.
Your business data: we are only a processor. Everything the app pulls from your shop, your website and your ad account on your instruction: products, pages, orders, and any personal data inside them such as a shopper's email address, phone number or postal code. You are the controller of that data. We act only on your documented instructions. You decide what the app may read, what it sends to the ad platform, and on what legal basis. You are responsible for having that basis, for what your advertising says, and for complying with the ad platform's terms and with advertising, consumer and data protection law. We do not decide any of it and cannot.
Customer data never leaves the purposes you set it. We do not sell it, we do not rent it, we do not use it to advertise to you or to anyone else, and we do not use it to train AI models.
2. Who is responsible
Controller for the data described in section 3: Adsonomy, operated by Dutch Bohemian Ventures, the Netherlands. Contact: hello@adsonomy.com.
We have not appointed a data protection officer, because the scale of this processing does not require one. All privacy questions and requests go to the address above.
3. What we hold as controller, and why
| Data | Where it comes from | Why, and on what basis |
|---|---|---|
| Name, work email, company | You, at sign-up | To create and run your account. Performance of a contract, Article 6(1)(b) |
| Email confirmation and its timestamp | Automatically, when you click the link | To prove the address is yours and that you asked us to write to you. Contract and legal obligation |
| Password, stored only as a one-way hash | You | To let you in and nobody else. Contract |
| What you did in the app, and when | Automatically | Support, security, and an audit trail of changes that spend money. Legitimate interest, Article 6(1)(f) |
| Demo sign-up: name, work email, company, website, business type, budget band | You, on the demo form | To open a demo workspace and to follow it up. Contract and legitimate interest |
| Hashed IP address | Automatically, on the public forms | To stop abuse. We store a one-way hash, never the address. Legitimate interest |
| Consent records: terms version, marketing choice, timestamps | Automatically | To show what was agreed and when. Legal obligation |
| Analytics about pages visited | A cookie, only if you accept it | To see which pages help. Consent, Article 6(1)(a) |
We do not collect special categories of personal data about you, and the service is for businesses, not for people under 18.
4. What the app does with your business data
On your instruction the app reads your catalogue, your website and your ad account, writes campaigns and changes to the ad platform inside the limits you set, and reports what happened. Where orders are used to measure results, identifiers such as email address and phone number are hashed before they are stored or sent, and the raw values are never written to our database.
The AI manager is given the facts of your account to work from. It is not given your shoppers' personal data, and nothing from your account is used to train anybody's model.
5. How long we keep it
- Account data: while you have an account, and 12 months after it closes, so we can settle questions and meet our own legal obligations.
- Records that money changed or that a change was made: 7 years, which Dutch tax and accounting law requires.
- Demo accounts: the workspace and its synthetic data are deleted 30 days after sign-up. The lead record is kept for 24 months.
- Waitlist entries from before launch: deleted no later than 24 months after sign-up, or immediately on request.
- Business data processed for you: kept while your account is open and deleted or returned as the data processing agreement says when it closes.
- Analytics: 14 months.
6. Who processes data for us
A short list, each bound by a data processing agreement, each acting only on our instructions:
- DigitalOcean, hosting, data centre in Amsterdam, the Netherlands.
- Resend, sending our email.
- OpenRouter, routing requests to the AI models the manager uses, with Anthropic as the model provider.
- Google Analytics, only if you accept the analytics cookie.
The ad platform you connect is not our processor. It is a separate controller with its own terms and its own privacy notice, and what it does with data you send it is between you and them. The same is true of your shop platform.
Data is stored in the European Union. Where a processor transfers data outside the EEA, the transfer is covered by the European Commission's standard contractual clauses or another safeguard recognised under the GDPR.
7. Your rights
You may ask for access to your data, correction, deletion, restriction, portability, and you may object to processing based on legitimate interest. Where processing rests on consent you may withdraw it at any time, which does not affect what happened before. Write to hello@adsonomy.com and we will answer within one month.
If you are unhappy with how we handled it you may complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority where you live or work.
If your request concerns data we hold for a customer rather than about you, we will point you at that customer: they are the controller and we may not act on it ourselves.
8. Cookies
The site sets nothing until you choose. Accepting analytics sets one Google Analytics cookie so we can see which pages help. The app itself uses a session cookie that keeps you logged in; it is strictly necessary and cannot be switched off without breaking the login.
9. Security
Access to production is limited to the people who need it. Credentials you give us for your shop or your ad account are encrypted at rest and never shown again after you save them. We can restore data from backups. No system is perfectly secure, and section 19 of the Terms sets out what we do and do not promise.
10. Changes to this notice
We update this notice when what we do changes. The date at the top always says when. Material changes to the customer relationship are notified as the Terms require.
11. Contact
Write to the controller named in section 2 at hello@adsonomy.com.