AdLab

1. Introduction

AdLab is an online platform that connects small brands with micro-influencers for sponsored content campaigns. We support discovery, applications, collaboration workflows, and payment tracking between participating users.

This Privacy Policy explains how AdLab collects, uses, shares, and protects personal data when you use our website, APIs, and related services.

By creating an account or using AdLab, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with these practices, do not use the Service.

2. Data We Collect

We collect different categories of personal data depending on how you use the Service and whether you participate as an influencer or a brand.

2.1 Account Data

Email address
Full name
Password in hashed form only
User role such as influencer or brand
Profile photo and cover image URLs

2.2 Profile Data

For influencers, this may include biography, social handles, follower counts, engagement rates, audience reach, demographics, phone number if provided, tags, and media kit content.

For brands, this may include company name, website, industry, company description, and company size.

2.3 Campaign and Application Data

Campaign details such as title, description, budget range, platforms, deliverables, deadlines, and target audience
Application information such as cover letters, proposed content, and estimated reach
Workflow material such as contracts, briefs, drafts, feedback, final content, and engagement metrics

2.4 Messages and Reviews

Direct messages exchanged on the platform
Ratings and reviews submitted after campaign completion

2.5 Payment Information

We track payment status, amounts, invoice references, and payment dates for collaborations. We do not collect or store credit card numbers, bank account details, or similar financial instrument data.

2.6 Social Media Connections

Social media user IDs and usernames
OAuth access tokens and TikTok refresh tokens where applicable
Token expiry dates
Account type, follower counts, media counts, and video counts
Platform insights such as likes, comments, shares, reach, and views

3. How We Use Your Data

Providing the Service by creating and managing accounts, campaigns, applications, and workflow stages
Matching and discovery between brands and influencers
Displaying profile, media kit, and performance information to support partnerships
Fetching and showing analytics from connected platforms
Sending notifications about applications, campaigns, messages, and service announcements
Tracking payment obligations between collaborators
Improving the product, preventing abuse, and understanding usage patterns

4. Legal Basis for Processing

Consent: when you create an account and agree to this Privacy Policy
Contract performance: when processing is necessary to provide the Service
Legitimate interests: for product improvement, security, fraud prevention, and analytics, where those interests are not overridden by your rights

5. Data Sharing

We do not sell, rent, or trade personal data to third parties for marketing or advertising purposes.

With other users where profile, campaign, application, and collaboration data must be visible to the relevant parties
With Instagram and TikTok when you connect accounts through OAuth and use related platform features
With Supabase as our infrastructure provider for hosting, authentication, storage, and database processing
With authorities or counterparties when disclosure is required by law, legal process, or regulatory obligation

6. Your Rights Under GDPR

To exercise these rights, contact us using the details below. We aim to respond within 30 days.

Right of access to obtain a copy of your personal data
Right to rectification of inaccurate or incomplete data
Right to erasure, subject to applicable retention obligations
Right to data portability in a structured and commonly used format
Right to restrict processing in specific circumstances
Right to withdraw consent where processing relies on consent
Right to lodge a complaint with your competent Data Protection Authority

7. Data Retention

Account data is retained while the account is active and is deleted within 30 days of a valid deletion request
Profile and campaign data is generally deleted with the account, although some public review data may be anonymised instead
OAuth tokens are deleted when the related social connection is removed
Messages are deleted within 30 days of account deletion, although the other participant may retain their own copy while their account remains active
Payment records may be retained for up to 7 years to comply with accounting and tax requirements

8. International Data Transfers

AdLab uses third-party infrastructure and connected platform providers that may process personal data outside the European Economic Area, including in the United States.

Where personal data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other legally recognised transfer mechanisms.

9. Security

No online system can guarantee absolute security, but we apply reasonable technical and organisational measures to protect your data.

HTTPS and TLS encryption for data in transit
Hashed passwords and secure authentication practices
Row Level Security policies at the database layer
State validation in OAuth flows to reduce CSRF risk
HTTP-only cookies and secure token handling where applicable
Regular infrastructure and dependency reviews

10. Children's Privacy

AdLab is not intended for individuals under 16 years old. We do not knowingly collect personal data from children under 16. If we learn that such data has been collected without valid consent where required, we will delete it promptly.

11. Changes to This Policy

Continued use of the Service after an updated version becomes effective constitutes acceptance of the revised policy.

We may update this Privacy Policy to reflect legal, operational, or product changes
We will update the last-updated date and version when material edits are made
We may notify registered users by email or in-product notice where appropriate

12. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or our data practices, contact our privacy team using the details below.

AdLab Privacy Team

Email: privacy@adlab.com

We aim to respond to privacy-related inquiries within 30 days of receipt.