LEGAL

Privacy Policy

Effective Date: June 11, 2026 | Last Updated: June 11, 2026

Plain English Summary:We collect your email and usage data to run the service. We use Supabase for storage, OpenAI for AI summaries, and a third-party to access Meta's public Ads Library. We do not sell your personal data to anyone. If you're in the EU or UK, you have rights to access, correct, and delete your data — just email us.

1. Who We Are

Advorly ("we", "us", or "our") operates the website advorly.online and the Advorly SaaS platform. We are a B2B lead generation platform that helps agencies, consultants, and freelancers find businesses running ads on Meta (Facebook and Instagram).

For the purpose of applicable data protection laws (including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and India's Digital Personal Data Protection Act 2023 ("DPDP Act")), Advorly is the data controller for personal data we collect about you as a user of our Platform.

Our designated privacy contact is: support@advorly.online

2. What Personal Data We Collect

2.1 Data You Provide to Us

Account Data: Your email address and hashed password when you create an account. We use Supabase Auth for authentication — your password is never stored in plain text.
Profile Data: Your name, if you choose to provide it.
Payment Data: We do not store your payment card details. Payments are processed by our third-party payment processor, which handles card data under its own PCI-DSS compliant systems.
Communications: Any messages you send to us via contact forms or email.

2.2 Data We Collect Automatically

Usage Data: Information about how you use the Platform, including searches performed (keywords, country selected, number of leads requested), pages visited, and features used.
Log Data: IP address, browser type and version, device type, operating system, and timestamps of requests.
Session Tokens: Authentication tokens stored in your browser's local storage to keep you logged in.

2.3 Data We Do NOT Collect

We do not collect special category (sensitive) personal data such as health information, religious beliefs, or political opinions.
We do not knowingly collect personal data from individuals under 18 years of age.
We do not collect data from private individual Facebook or Instagram profiles. All lead data shown on the Platform originates from Meta's public Ads Library, which indexes business advertising pages — not private personal profiles.

3. How We Use Your Personal Data

We use your personal data for the following purposes and under the following legal bases:

Purpose	Legal Basis (GDPR)
Provide and operate the Platform (account management, running searches, delivering lead results)	Performance of contract (Art. 6(1)(b))
Process your subscription payment and manage your credits balance	Performance of contract (Art. 6(1)(b))
Send transactional emails (account creation, search complete, credits low)	Performance of contract (Art. 6(1)(b))
Improve the Platform, debug issues, and analyse usage patterns	Legitimate interests (Art. 6(1)(f)) — improving our service
Prevent fraud, abuse, and enforce our Terms of Service	Legitimate interests (Art. 6(1)(f)) — protecting our business and users
Send you marketing emails about new features (only with your consent)	Consent (Art. 6(1)(a)) — you can unsubscribe at any time
Comply with legal obligations (e.g., tax records, law enforcement requests)	Legal obligation (Art. 6(1)(c))

4. Data About Leads (Meta Ads Library)

The Platform displays business advertising data sourced from Meta's Ads Library — a public transparency database. This includes business page names, ad copy, website URLs, and Facebook page links.

Important distinctions:

This data relates to business entities running paid advertisements, not private individuals browsing Facebook or Instagram.
Meta makes this data publicly available as part of its regulatory transparency obligations. It is not scraped from private user profiles.
If a sole trader is advertising under their personal name, that individual's name could constitute personal data under GDPR. In such cases, our legal basis for processing is legitimate interest (B2B prospecting), balanced against the individual's reasonable expectation of public visibility given they are actively paying to advertise to the public.
We recommend that users of our Platform conduct their own Legitimate Interest Assessment (LIA) before contacting EU-based business contacts, as required under GDPR Article 6(1)(f).

AI-Generated Summaries: Ad summaries are produced by OpenAI's GPT-4o-mini. Ad text from Meta's public Ads Library is sent to OpenAI's API for processing. We do not send any personal data about our users to OpenAI. In compliance with EU AI Act Article 50 (effective August 2, 2026), all AI-generated content is clearly labeled as machine-generated on the Platform.

5. How We Share Your Data

We do not sell your personal data. We share it only as follows:

5.1 Service Providers (Data Processors)

We share data with the following service providers who process it on our behalf, under data processing agreements:

Provider	Purpose	Location
Supabase, Inc.	Database storage, user authentication	USA (AWS)
OpenAI, Inc.	AI-generated ad summaries (ad text only, no user PII)	USA
ScrapeCreators	Meta Ads Library data retrieval	USA
Vercel, Inc.	Platform hosting and serverless functions	USA (global CDN)
Payment Processor	Subscription billing and credit purchases	Varies

5.2 Legal Requirements

We may disclose your data if required to do so by law, court order, or government authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

5.3 Business Transfer

If Advorly is acquired by or merged with another company, your personal data may be transferred to the new entity. We will notify you via email and/or a prominent notice on our Platform before your data is transferred and becomes subject to a different privacy policy.

6. International Data Transfers

Our service providers (including Supabase, OpenAI, and Vercel) are based primarily in the United States. If you are located in the EU, UK, or other jurisdictions with cross-border data transfer restrictions, your personal data may be transferred to the US.

For transfers from the EU/UK to the US, we rely on the following safeguards:

Standard Contractual Clauses (SCCs) as approved by the European Commission, incorporated into our data processing agreements with US-based service providers.
Where applicable, providers who are certified under the EU-US Data Privacy Framework.

You may request a copy of the relevant safeguards by contacting us at support@advorly.online.

7. Data Retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

Account Data: Retained for the duration of your account plus 2 years after deletion, or as required by applicable law.
Transaction Records: Retained for 7 years as required for tax and accounting purposes in most jurisdictions.
Search and Usage Logs: Retained for 12 months, after which they are anonymised or deleted.
Lead Data: Retained for the duration of your account. You may delete individual leads or all leads from your account at any time.

Upon account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

8. Cookies and Tracking

We use the following cookies and similar technologies:

Strictly Necessary Cookies: Authentication tokens (session cookies) required to keep you logged in. These cannot be disabled without impairing the functionality of the Platform.
Analytics (if applicable): We may use privacy-respecting analytics tools to understand aggregate usage patterns. We do not use Google Analytics or Meta Pixel on our Platform.

We do not use advertising or tracking cookies. We do not track you across other websites.

9. Your Rights

9.1 EU and UK Users (GDPR / UK GDPR)

If you are in the EU or UK, you have the following rights regarding your personal data:

Right of Access: You may request a copy of the personal data we hold about you.
Right to Rectification: You may request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data in certain circumstances.
Right to Restriction: You may request that we restrict processing of your data in certain circumstances.
Right to Data Portability: You may request your data in a structured, machine-readable format.
Right to Object: You may object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority. EU residents may contact their national DPA; UK residents may contact the ICO (ico.org.uk).

9.2 California Users (CCPA / CPRA)

If you are a California resident, you have the following rights:

Right to Know: The right to know what personal information we collect, use, disclose, and sell (we do not sell personal information).
Right to Delete: The right to request deletion of your personal information, subject to certain exceptions.
Right to Correct: The right to request correction of inaccurate personal information.
Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioural advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise any of these rights, contact us at support@advorly.online. We will respond within 45 days.

9.3 Australian Users

Australian users have rights under the Privacy Act 1988 and the Australian Privacy Principles, including the right to access and correct personal information held about you. Contact us to exercise these rights.

9.4 Indian Users (DPDP Act 2023)

As an India-based company, we comply with India's Digital Personal Data Protection Act 2023. Indian users have rights to access information about their data, correct inaccurate data, and withdraw consent where processing is consent-based.

9.5 How to Exercise Your Rights

To exercise any of the above rights, please email support@advorly.online with "Privacy Request" in the subject line. We will acknowledge your request within 72 hours and respond within 30 days (or 45 days for CCPA requests).

We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests.

10. Data Security

We implement industry-standard technical and organisational measures to protect your personal data, including:

All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
Passwords are hashed using bcrypt and are never stored in plain text.
Access to production databases is restricted to authorised personnel only.
We use Supabase Row-Level Security (RLS) to ensure users can only access their own data.

Despite these measures, no security system is impenetrable. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR.

11. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a person under 18, we will delete that data promptly. If you believe we may have collected data from a child, please contact us immediately at support@advorly.online.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email (to the address associated with your account) and/or by posting a notice on the Platform at least 14 days before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Your continued use of the Platform after the effective date of any changes constitutes your acknowledgment of the updated Privacy Policy.

13. Contact and Complaints

For any privacy-related questions, requests, or complaints, please contact:

Advorly — Privacy Team

Email: support@advorly.online

Website: advorly.online

We take all privacy complaints seriously and will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority:

EU: Your national Data Protection Authority (e.g., CNIL for France, BfDI for Germany)
UK: Information Commissioner's Office (ICO) — ico.org.uk
Australia: Office of the Australian Information Commissioner — oaic.gov.au
India: Data Protection Board of India (when operational)

This Privacy Policy was last reviewed on June 11, 2026. Advorly is not a law firm and this document does not constitute legal advice. We recommend consulting a qualified legal professional for advice specific to your jurisdiction and business.