Beta This is a test version of AdReady — data may be reset. Report problems to maksim@agencijaepic.si.
AdReady

Privacy Policy

Last updated 15 October 2026

This policy explains what personal data AdReady processes, why, and what rights you have. AdReady is a workspace in which advertising agencies prepare, review, approve and publish ad campaigns for their clients.

1. Who we are

AdReady is operated by:

EP1C, oglaševanje, d.o.o.
Ribičičeva ulica 33, 1000 Ljubljana, Slovenia
Registration number: 6745296000
VAT number: SI85716979
E-mail: info@agencijaepic.si

2. Our role

  • Controller. We decide how the data of user accounts (agency staff and client reviewers), sign-in and security records and our own e-mails is processed.
  • Processor. Everything an agency puts into its workspace — clients, brand context, briefs, key visuals, creatives, ad copy, comments, approvals and the people it invites — is processed on the agency's behalf. The agency is the controller of that data; our obligations as its processor are set out in section 9 of the Terms of Service. Requests about that data are best sent to the agency first.

3. Data we process

  • Account data: name, e-mail address, password (stored only as a hash), two-factor authentication secret and recovery codes (encrypted), passkeys (public keys only), the Google account ID when you sign in with Google, notification preferences.
  • Organization data: the agency's name and its web address on AdReady, memberships, roles and permissions, invitations.
  • Workspace content: clients and their brand context, campaigns, briefs, uploaded or synced images, ad copy, comments, review decisions and the version history of all of these.
  • Data from connected services: see sections 5 and 6.
  • Technical and security data: IP address and browser (user agent) in the audit log, sign-in and sign-out records, server logs needed to run and protect the service.

4. Purposes and legal bases

  • Providing the service you or your agency signed up for, including e-mail notifications (performance of a contract, Art. 6(1)(b) GDPR).
  • Security, fraud prevention, audit trails and support (legitimate interests, Art. 6(1)(f) GDPR).
  • Meeting legal obligations, e.g. accounting (Art. 6(1)(c) GDPR).

We do not sell personal data, do not use it for advertising and do not build profiles of you.

5. Google user data

AdReady accesses Google user data in two cases, both started by you:

  • Sign in with Google (scopes openid, email, profile): your name, e-mail address and Google account ID, used only to create your account and sign you in.
  • Connecting Google Ads (scope https://www.googleapis.com/auth/adwords), by a member of an agency allowed to manage integrations: the list of Google Ads accounts the connected Google user can reach, the campaigns and ad groups in them, and campaign performance metrics. AdReady uses this access only to do what the agency asks in AdReady: create campaigns, ad groups and ads (created paused), pause or activate them, and show their results. The OAuth refresh token is stored encrypted.

AdReady's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data received from Google APIs is used only to provide and improve the features described above; it is not transferred to others except as needed to provide those features, to comply with law or as part of a merger or acquisition; it is never used for advertising, never sold, and never used to develop, improve or train generalized artificial intelligence or machine learning models; and people at AdReady do not read it unless you have given permission, it is necessary for security or to comply with law.

You can withdraw the access at any time: Disconnect on the Integrations page deletes the stored token, and you can also remove AdReady in your Google account under Third-party connections.

6. Meta and Figma

  • Meta (Facebook, Instagram): an agency connects Meta with an access token of its business. AdReady reads the ad accounts, Facebook pages, Instagram accounts and pixels the token can reach, creates campaigns, ad sets and ads (created paused), and reads their performance. The token is stored encrypted and deleted on Disconnect.
  • Figma: an agency connects Figma with read-only access (file_content:read, current_user:read). AdReady reads the structure of the files connected to campaigns, renders the selected frames to images and stores those images as creatives; it also stores the connected account's name and e-mail address. AdReady never edits anything in Figma. Tokens are stored encrypted and deleted on Disconnect.

7. AI features

To suggest ad copy, AdReady sends text to OpenAI through its API: the client's brand context, the campaign brief, the platform's requirements and earlier copy and feedback of the same client. Images are not sent. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models. Every request and result is logged in the agency's workspace.

8. Service providers (sub-processors)

  • DigitalOcean — servers, database and file storage, Frankfurt, Germany (EU)
  • Cloudflare — domain name service (DNS)
  • Mailgun (Sinch) — sending e-mail, EU region
  • OpenAI — AI copy suggestions (section 7)
  • Google, Meta, Figma — only for the connections an agency sets up (sections 5 and 6)

Where a provider processes data outside the EU/EEA, the transfer relies on an adequacy decision (such as the EU-U.S. Data Privacy Framework) or on the European Commission's standard contractual clauses.

9. How long we keep data

  • Account and workspace data: as long as the account or the agency's organization exists. After an agency ends its use of AdReady or asks for deletion, its data is deleted within 90 days, unless the law requires us to keep it longer.
  • Approved versions and audit logs are part of the agency's record of approvals and are kept as long as the organization exists.
  • Server logs: up to 14 days.
  • Backups are overwritten in their regular cycle.

10. Deleting your data

To delete your account or ask for data to be deleted, write to info@agencijaepic.si from the e-mail address of your account. An agency can remove members and client users itself; to delete an agency's whole organization, its administrator writes to the same address. Disconnecting Google Ads, Meta or Figma on the Integrations page deletes the stored credentials immediately.

11. Cookies

AdReady uses only cookies needed for it to work: the session cookie, the CSRF protection cookie and, if you choose "Remember me", a remember-me cookie. There are no analytics or advertising cookies.

12. Security

Connections are encrypted (TLS). Passwords are hashed; platform credentials and two-factor secrets are encrypted at rest. Accounts can use two-factor authentication and passkeys. Each agency's data is kept separate from other agencies', and important actions are recorded in an audit log.

13. Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing and to data portability. Write to info@agencijaepic.si; we answer within one month. You may also lodge a complaint with the Information Commissioner of the Republic of Slovenia (ip-rs.si) or the supervisory authority where you live.

14. Children

AdReady is a business tool and is not meant for people under 16.

15. Changes

We will update this policy when the service or the law changes and change the date above. Significant changes are announced by e-mail or in the app.