Privacy Policy

1. Who we are

AdFlow is operated by Digital Ad Expert (“we”, “us”, “our”), the data controller for account data described below. For questions about this policy or to exercise your data protection rights, contact us at [email protected].

Digital Ad Expert is operated by Yiğit Yıldız, a sole proprietor (Person Fizik) registered with the Albanian National Business Center (Qendra Kombëtare e Biznesit), business registration number (NUIS) M61404014A. Registered address: Rruga Astrit Losha, Pallati Marituda, Tiranë, Albania.

2. Two roles: controller and processor

AdFlow is a click-tracking and campaign-attribution tool. When you create an AdFlow account, we act as data controller for your account data (email, name, password hash, billing plan).

When your tracking links capture data about the visitors who click your ads (IP address, device, location, click identifiers), you are the data controller for that visitor data, and AdFlow acts as your data processor. You are responsible for ensuring you have a valid legal basis (e.g. consent or legitimate interest, in line with GDPR and the ePrivacy Directive) to track your own visitors, and for your own privacy notices to them. A data processing agreement (DPA) is available on request.

3. What data we collect

• Account data: name, email address, hashed password (never stored in plain text), plan/role.
• Click data (processed on your behalf): IP address, approximate geolocation derived from IP, device/browser user agent, referrer URL, UTM parameters, and ad-platform click identifiers (e.g. fbclid, gclid, ttclid) present in the URL.
• Conversion data: events you or your ad platform send back to us via postback URL, pixel, or the Meta Conversions API integration.
• Technical/log data: request logs used for security, abuse prevention, and bot filtering.

4. Legal basis for processing

Account data is processed under Art. 6(1)(b) GDPR (performance of a contract with you). Click and conversion data is processed on your instructions as our customer, under Art. 6(1)(f) GDPR (legitimate interest in operating the service you configured) or the legal basis you establish with your own visitors.

5. Data retention

Click and conversion data is retained according to your plan's stated retention window (currently 30 days on the Free plan; longer retention is planned for paid tiers). Account data is retained for as long as your account is active, and deleted upon account deletion request, subject to any legal retention obligations.

6. Where your data is processed

AdFlow is self-hosted on infrastructure we operate and control directly — we do not sell or share your data with data brokers or advertising networks beyond the integrations you explicitly configure (for example, sending conversion events to Meta via the Conversions API when you enable that feature).

7. Security

We use industry-standard measures to protect data in transit (TLS/HTTPS) and at rest, including hashed credentials (bcrypt), access-controlled infrastructure, firewalling, and intrusion prevention on our servers. No system is 100% secure, and we continuously work to improve our security posture.

8. Your rights (GDPR)

If you are located in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Restrict or object to certain processing
• Request a portable copy of your data
• Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, email [email protected].

9. Cookies

The AdFlow dashboard uses a single essential authentication cookie/token to keep you signed in. It does not set third-party advertising or tracking cookies on this website. Tracking links you create in AdFlow may set identifiers on your own destination pages as part of the attribution feature you configured — that data belongs to you as controller, as described in Section 2.

10. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected by updating the “Last updated” date above.