Privacy Policy

Who we are

AdZippy is operated by SIA Noctura Group, Ģertrūdes iela 38 - 12, Rīga, LV-1011, Latvia, the data controller for AdZippy account data. Privacy and support contact: man@testo-hit.com.

For the Facebook ad accounts you connect, AdZippy acts on your instructions: it creates, reads and changes ads only when you use the app.

What we store on our servers

• Your AdZippy sign-in: email address and password (stored by our sign-in provider, never in plain text), or your Google sign-in.
• Your workspace: a private workspace created for you on first use, and who belongs to it.
• Your Facebook connection: your Facebook user ID and name, the permissions you granted, when access expires, and the Facebook access key itself — encrypted (AES-GCM) before it is saved. Only AdZippy's servers can decrypt it; it is never sent to your browser.
• Ad accounts you choose (up to 5): account ID, name and currency.
• Videos you upload: the Facebook video ID and which ad account it went to, so only your workspace can check its processing status.
• Data deletion requests: a confirmation code, your Facebook user ID and the result, so you can check the status.

What stays in your browser

Ad drafts, launch history, templates, defaults and uploaded video files are kept in your own browser storage. We do not receive them unless you launch an ad.

Purposes and legal basis

We use account and workspace data as necessary to provide the AdZippy service you request, on the basis of performing our agreement with you (GDPR Article 6(1)(b)). We use the minimum session and security records needed to prevent unauthorised access and protect customers, on the basis of our legitimate interests in securing the service (Article 6(1)(f)), subject to your rights and interests. These records follow the published retention periods. We do not use connected ad-account data for unrelated advertising. When we process business ad-account data on your instructions, you remain responsible for your lawful use of that data. Facebook authorisation controls what Meta permits us to access; it does not itself determine the legal basis for every processing activity.

What we send to others

• Meta (Facebook): images, videos, ad text and settings you launch, and requests to read your campaigns and results.
• AI translation: when you use Translate, the requested ad text — including imported Meta ad copy you selected — is sent to OpenAI through the Lovable AI Gateway. No account IDs or Facebook access tokens are included in that request.
• Hosting: Lovable Cloud hosts the application; the project database is located in Ireland. Other hosting, edge, secret-storage and AI processing locations have not been fully verified, so we make no promise that all processing stays in the EU.

We do not sell your data or use your ad data to advertise to you.

How long we keep it

Your Facebook connection is kept until you disconnect, remove AdZippy in your Facebook settings, or request deletion. In addition, an automatic clean-up runs once a day (around 03:15 UTC) and permanently deletes:

• a stored Facebook access key 60 days after it expired;
• a chosen ad account, and the records of videos uploaded to it, 90 days after you deselected it — or 90 days after your workspace lost its Facebook connection, unless you reconnected in the meantime;
• records of signed-out sessions 7 days after sign-out;
• one-time Facebook sign-in links 24 hours after they were created;
• Facebook data-deletion confirmation records 12 months after the request.

Facebook data-deletion requests are still carried out immediately. Your AdZippy account and workspace are deleted on request.

Removing your data

• Disconnect in AdZippy Settings deletes the stored Facebook access key, and can also ask Facebook to remove AdZippy's permissions.
• Removing AdZippy in your Facebook settings makes Facebook notify us; we then delete the stored access key.
• Facebook data deletion request: we delete the stored access key, your chosen ad accounts and uploaded-video records, and give you a code to check the status on our data deletion page.

To delete your AdZippy account itself, email man@testo-hit.com.

Requests from public authorities

SIA Noctura Group received no national-security requests for user data in the 12 months before this policy was published. From now on, any government or public-authority request for customer data is handled as follows:

• We verify who is asking, and their legal authority and jurisdiction.
• We assess each request's legal validity individually, with qualified legal advice when needed.
• Where lawful, we challenge requests that are unlawful or broader than necessary.
• We disclose only the minimum data legally required.
• We securely record each request, our review, the decision and anything disclosed.
• We tell affected customers unless the law prohibits it.
• Only authorised staff handle requests, and each is escalated to the company's responsible person.

Your rights

You may request access, correction, deletion, restriction or portability where applicable, and may object to processing based on legitimate interests. Contact man@testo-hit.com. You may complain to Latvia's Data State Inspectorate (Datu valsts inspekcija), dvi.gov.lv, or another competent supervisory authority.