Privacy notice
Your personal data, plainly.
Who we are
Ovnit LTD (company number 17495977, registered office 128 City Road, London, EC1V 2NX, England) operates Adcquireand is the controller of the personal data described here, except where your brand’s data says we handle it on your brand’s behalf. Contact us about it at accounts@adcquire.com, or through the contact form. Company details.
What we collect, why, and our legal basis
| What | The data | Why | Legal basis |
|---|---|---|---|
| Your account | Name, work email, brand name, a one-way hash of your password, when you last signed in, your plan and trial dates, and which version of this notice you saw. If you set up two-step verification: your authenticator app’s key, encrypted, and keyed one-way hashes of your recovery codes. | To run your account and send the emails the service needs. | Contract (Article 6(1)(b)) where you are the business yourself (a sole trader or partner); otherwise — for a company, or your employer or a client — our legitimate interests in providing the service they signed up for (Article 6(1)(f)) |
| Invitations to a brand | The email address an owner enters to invite someone, and the role offered. | To send that one invitation. We got it from the person who invited you. | Legitimate interests (Article 6(1)(f)): letting a team share a brand |
| The weekly email and alerts | Your email, and your brand’s figures in the email. | To tell you what changed. On by default; switch it off in Alerts → Settings, or with the link in every email. | Contract (Article 6(1)(b)) where you are the business yourself (a sole trader or partner); otherwise — for a company, or your employer or a client — our legitimate interests in providing the service they signed up for (Article 6(1)(f)) |
| How you use the dashboard | When you last opened each brand, alerts you’ve read, decisions you made or were given, views you saved and your email settings. | To show what’s new since your last visit and who decided what, and to remember your settings. | We handle this for your brand, on its instructions, to provide the service it signed up for (see “Your brand’s data” below) |
| Messages through the contact form | Your name, email and message; for a sales enquiry also your company, role (optional), marketplaces, revenue band and plan. | To answer you — including privacy requests, complaints and security reports, which get a case reference. | Legitimate interests (Article 6(1)(f)): answering the people who write to us and, for sales enquiries, discussing a possible contract with their business. For privacy requests and complaints: our legal obligations (Article 6(1)(c)) |
| “Tell me when prompts launch” | Your email and the marketplace you chose. | To confirm your request, then send you one email when Sponsored Prompts launch there. | Consent (Article 6(1)(a)). Withdraw it any time with the link in the confirmation email, or by writing to us at accounts@adcquire.com; we then erase your address. |
| Marketing emails | Your email; your name if you have an account (to greet you); when and to what wording you agreed, when you confirmed it, and when you withdrew. | Only if you switched product update emails on in your account (or ticked the box at sign-up) with a confirmed address, or ticked the separate, unticked box on the contact form and then confirmed it from the link we sent to that address. | Consent (Article 6(1)(a) and PECR). Withdraw it any time: the switch on your Account page, the one-click unsubscribe link in every such email, or by writing to us at accounts@adcquire.com. It takes effect at once |
| When you unsubscribe | A fingerprint of your email address made with a one-way function (pseudonymised: not the address itself, but still personal data, because anyone with your address could make the same fingerprint), when you unsubscribed and how. The same fingerprint is in our security log. | So we never send that address marketing email again, even after your account or message is deleted. Only a fresh yes from you on your Account page, with your address confirmed, overrides it. | Legitimate interests (Article 6(1)(f)): keeping to your objection to marketing, and being able to show we do. Because this is how we keep to it, we keep the fingerprint even if you ask us to erase your data |
| Security records | Who did what and when in a brand (your account number, not your name); your sign-ins and security changes, with a rough name for the browser such as “Chrome on Mac” (not its full details or your IP address); a keyed fingerprint of your IP address or email used to stop repeated sign-in attempts and repeated confirmation emails; error records scrubbed of emails and tokens. | To keep accounts and the service secure and to show who approved a change. | Legitimate interests (Article 6(1)(f)): security and accountability |
| Service logs | For each request to our servers: the time, the address asked for (without anything after a “?”), the result, how long it took, and your account number if you’re signed in; when something fails, technical details of the error. Our request logs don’t record your IP address or what you send in a form; the web server’s own error lines (for example when a page can’t be reached during an update) can include the IP address, the browser and the full address asked for; they too are kept only up to a fixed size, then overwritten. | To keep the service running and to investigate faults and misuse. | Legitimate interests (Article 6(1)(f)): a reliable, secure service |
Your brand’s data
The Amazon Ads reports you upload, the listing text you paste, and the sample answers from Amazon’s assistant you paste to check are your brand’s business data: prompts, campaigns, products and figures. They aren’t meant to contain personal data, and we use them only to run the service for your brand. They are visible only to people you give access to, never sold, and never shown to other customers.
If you trade as a sole trader or partnership, your brand’s figures can be personal data about you. Where your brand’s data includes personal data about people (for example your team, or a sole trader’s figures), we handle it on your brand’s behalf, only to run the service, under the data processing agreement that forms part of our terms. Your rights below apply to it, and we’ll help your brand answer any request.
Amazon Ads data
When your brand connects its Amazon Ads account (not available yet — today you upload reports yourself), Adcquire reads, for the advertising profile you choose in North America:
- the list of advertising profiles the Amazon login can see, so you can choose one;
- the daily Sponsored Products prompts and campaign reports: the prompt text, campaign and ad-group names, the products’ ASINs, and impressions, clicks, spend, sales and orders;
- campaign and ad-group settings: names, budgets, bids and placements, so a change can be sent correctly.
It uses them only to show and act on your brand’s Amazon advertising, and sends to Amazon only the changes your team approves. The sign-in happens on Amazon’s site; we never see your Amazon password.
- Kept: until the brand is deleted (by an owner, or with the account of its only member). What was fetched from Amazon is deleted when you disconnect, 30 days after the person who connected it leaves the brand unless an owner connects again, and within 72 hours if Amazon asks us to. Pauses and changes your team decided stay in your brand’s history, without their before-and-after figures. Amazon asks brands to confirm the connection once a year.
- Who else receives it: only the providers that run Adcquire for us (below) — never another customer or advertiser. AI features are off, so no AI provider receives it; that would only change with Amazon’s written approval and after AI in Adcquire says so.
How the connection works, step by step: the Amazon Ads integration.
Who else receives it
- DigitalOcean, which hosts Adcquire and its database in London, UK, keeps backups in the UK or the EEA, and stores everything above on our instructions.
- Resend, which delivers the emails above from the USA, and keeps copies there for a limited time.
- A log service, if we use one: the service’s technical records (which page was asked for, when, whether it worked, your account number and, when something fails, details of the error), with email addresses removed — to find and fix faults. It receives nothing today.
- Amazon (Amazon Ads), only if your brand connects its Amazon Ads account — not available yet: the sign-in happens on Amazon’s site, and approved changes are sent to Amazon.
- Anthropic (the maker of Claude) would provide the AI features — it receives nothing today: AI features are switched off. If that changes, AI in Adcquire and this notice will say so first.
We don’t sell personal data, use it for advertising, or run trackers. DigitalOcean and Resend are US companies: where your data reaches the USA (Resend’s email delivery, or DigitalOcean support), it is protected by their certification under the UK–US data bridge (the UK Extension to the EU-US Data Privacy Framework). If that ever ends, both contracts include the ICO’s International Data Transfer Addendum. Ask us for a copy. The full list, and how we tell you about changes, is on sub-processors.
How long we keep it
- Your account and your brands’ reports: until you delete them — or, for an account left unused for a year after its free trial ended (no sign-ins, and no new reports or Amazon connection in its brands), until we delete it after an email warning a month before. Signing in keeps it.
- Contact-form messages: 12 months; one that led to you becoming a customer, up to 3 years from when you sent it.
- “Tell me when prompts launch” sign-ups: until the email is sent, you unsubscribe, or 2 years.
- The fingerprint of an address that unsubscribed from marketing email: for as long as we send marketing email, so it stays unsubscribed (the copy in the security log: 2 years, like the rest of it).
- Invitations: 30 days after they’re used, expire or are withdrawn.
- After you delete your account, a record with no name or email in it (when it was created and last used, its plan, and which terms it accepted): 2 years, then deleted.
- Security log: 2 years. Sign-in attempt fingerprints: up to 2 days. Error records: 30 days after the error was last seen.
- Service logs: kept on our server only up to a fixed size, then overwritten by newer ones.
- The details are on deleting your data.
Your rights
You can ask for a copy of your personal data, have it corrected or erased, restrict or object to its use, receive it in a portable format, and withdraw any consent. Withdrawing consent doesn’t affect what we did with it before. You can download a copy yourself at any time from Account → Download your data, and delete your account there too. Or ask through the contact form (you’ll get a case reference) or at accounts@adcquire.com. We answer within one month, and confirm a request is yours by replying to the email on your account.
Your right to object. Where we rely on legitimate interests — marked in the table above, including your account and emails when you use Adcquire for a company, your employer or a client, and invitations, security records, service logs and contact-form messages — you can object at any time on grounds relating to your situation. We’ll stop unless we have compelling legitimate grounds, or need the data for a legal claim. You can always object to marketing, and we’ll stop.
If you want to complain about how we handle your data, tell us the same way: we acknowledge a complaint within 30 days, look into it, and tell you the outcome. You can also complain to the Information Commissioner’s Office at ico.org.uk.
What you have to give us
An account needs your name, work email, brand name and a password. A sales enquiry needs the fields the form marks as required; a privacy, security or support message needs only your name and email. Anything marked optional is optional.
Automated decisions
Adcquire ranks advertising decisions about your brand’s campaigns. It makes no automated decisions about people that have legal or similarly significant effects.
Changes to this notice
We record which version you saw. If we change it materially, we’ll tell account holders by email before it applies.