This policy explains what personal data AdStance collects when you use this service, why, and what rights you have over it. It's written by the person who built the product, not a law firm — it's accurate about what the system actually does, but if you need this reviewed for a specific compliance purpose, have your own counsel look at it rather than relying on it as legal advice.

Who is responsible for your data

The service is operated by Gateway Management OÜ, a private limited company registered in Estonia (registry code 14988050, VAT number EE102685103), registered address Kaupmehe tn 6-17, Kesklinna linnaosa, Tallinn, 10114, Harju maakond, Estonia. For any privacy question or request, contact kristjan@gatewaymgmt.ee. As a small company, there isn't a separate data protection officer — that inbox is the direct line.

What we collect

Account & contact data: your email address, used to log in via a one-time magic link and to deliver your finished report.

What you submit for a report: your company's website or a written description of it, your target market, any competitors you list (including their websites), your chosen platforms and tier, and any optional details you provide (industry, exclusions, example-count targets).

Payment data: handled entirely by Stripe. We never see or store your card number — Stripe passes us confirmation that payment succeeded and the amount charged, nothing more.

The report itself: the finished document (PDF and Word file) and the intermediate research data generated while building it — this is derived from what you submitted plus publicly available advertising data, not additional personal data about you.

Cookies & analytics

We group cookies into three categories, and you choose which optional ones run via the cookie icon in the corner of the screen — your choice is saved, and you can reopen that panel and change it at any time.

• Necessary — the session cookie that keeps you logged in. Always on; there's no way to run the service without it.
• Analytics — Google Analytics, so we can see how the site is used (pages visited, buttons clicked, where people drop off).
• Marketing — the Meta (Facebook) Pixel, so we can measure how well our ads perform, including once you check out (the report tier and amount paid — never your card details, which go directly to Stripe).

If you decline a category, its tool never loads and no cookies from it are set. Google and Meta process whatever data they do receive under their own privacy policies, and may use it for their own analytics or ad-targeting purposes.

Why we process it, and the legal basis

To create your account and deliver the report you paid for (performance of a contract), to charge you correctly and meet our accounting and tax obligations (legal obligation), and to keep the service secure and working, e.g. debugging a failed run (legitimate interest). The Analytics and Marketing cookies above run only on the basis of the consent you give via the cookie icon — we don't sell your data to anyone, or hand it to anyone else for their own marketing.

Who else sees it

We use a small number of specialist providers to actually run the service, each acting as a processor on our instructions:

• Stripe — payment processing
• Resend — sending you the magic-link and report-ready emails
• Anthropic — the AI models that research competitors, sweep ad platforms, and write the report
• Vercel — application hosting, and storage for your generated report files
• SearchApi.io — the third-party lookup service used to query Meta's and Google's public ad libraries
• Google (Google Analytics) and Meta (Meta Pixel) — site usage and ad-performance measurement, only if you accept cookies

Some of these providers process data outside the EU/EEA (notably the US). Where that happens, it's covered by those providers' own standard contractual clauses or equivalent safeguards — we haven't built anything custom on top of that, we rely on the providers' own compliance posture.

We do not sell your personal data, and we don't share it with anyone for their own marketing purposes.

How long we keep it

We keep your account, your submitted inputs, and your generated reports for as long as your account exists, so you can return to your dashboard and re-download past reports. If you want your account and associated data deleted, email us and we'll do it — the main constraint is that Stripe and our accounting records for completed payments are retained for the period required by Estonian tax law regardless of an account deletion request.

Your rights

If you're in the EU/EEA (or covered by a similar regime), you have the right to access, correct, delete, or export the personal data we hold about you, to object to or restrict certain processing, and to complain to your local data protection authority (in Estonia, the Andmekaitse Inspektsioon) if you think we've got it wrong. Email us to exercise any of these — we'll respond as quickly as we reasonably can.

Children

This service is intended for business use and isn't directed at children. We don't knowingly collect personal data from anyone under 16.

Changes to this policy

If this policy changes in a way that matters, we'll update the date at the top of this page. Continuing to use the service after a change means you've accepted the update.