Privacy Policy

Controller

NO4MAT is the controller of personal data processed for adsrunning. NO4MAT is a French simplified joint-stock company (SAS) with a share capital of €100.00, registered under 985 134 931 R.C.S. Dax. Its registered office is 10 avenue des Baines, 40510 Seignosse, France.

For privacy questions and requests, contact [email protected].

Data we process

Account identity and authentication are managed through Clerk. The service checks your Clerk user identifier, primary email verification and account eligibility, including ban, lock and application suspension status.

For API and MCP access, we store API key hashes, names, display prefixes, creation, last-use and revocation timestamps, your credit balance and the ledger of credit grants, reservations, charges and refunds. These records are associated with your account; the full API key secret is shown only when it is created.

Watchlists associate your account with the companies you choose to watch. We store when a watch was created and your seen-through position to show new and unseen advertisements in your alerts. API ad collections also associate your account with requested company or platform selectors, collection options, status and results.

Operational telemetry includes request outcomes, error categories, durations and performance measurements. The application's telemetry adapter excludes identities, IP addresses, headers, query strings, filters, raw errors and stacks. Framework logs outside that adapter are not covered by this exclusion.

Abuse controls separately process network information, including IP-based rate-limit buckets, account usage and request concurrency. Network bucket keys are hashed; hashing does not make this data anonymous.

The feature vote on the /2000 page stores a hash of your IP address and browser user agent to count one vote per visitor.

If you book a demo, Google Calendar collects the name, email address and any notes you enter, and shares them with NO4MAT. If you email [email protected], we process your message and email address to answer you.

Purposes and legal bases

We process account identity, API credentials, credit records, watchlists, alerts and ad collections to provide the features you request and administer access to them. The legal basis is performance of our contract with you, including steps taken at your request before entering that contract.

We process rate-limit information and operational diagnostics to prevent abuse, enforce usage limits, maintain availability and diagnose failures. The legal basis is our legitimate interest in running and protecting the service.

We process demo bookings, emails and feature votes to answer you and to learn what visitors want. The legal basis is our legitimate interest in talking with prospects and improving the service.

Service providers and hosting

Clerk provides account authentication. Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, provides hosting.

Cloudflare sits in front of the website, so your requests, including your IP address, pass through its network. Cloudflare R2 stores the advertisement images and videos served from cdn.adsrunning.com.

Google provides the calendar used to book demos.

Cookies and browser reporting

Clerk uses authentication and session cookies for sign-in and account access. The application also checks Clerk's __client_uat cookie to determine whether a visitor is signed in before installing browser reporting outside workspace pages.

If you vote on the /2000 page, we set the emissaire_vote cookie for one year and store your choice in your browser's local storage under emissaire:feature-vote. That page also keeps a session-storage flag, emissaire-modem-loaded, so its loading animation plays once per visit.

Public analytics is absent. Signed-out public visitors send no browser telemetry. When enabled, authenticated browser reporting sends bounded error categories and Web Vitals to the same-origin telemetry endpoint, not messages, stacks, URLs, DOM text, identity or session replay.

International transfers

Using service providers may involve processing outside the European Economic Area, including in the United States. Such transfers are subject to the GDPR's requirements for international transfers. Contact [email protected] for information about the safeguards applicable to your data.

Retention

Pre-authentication rate-limit buckets expire after two minutes without an admitted request refreshing them. The API account-eligibility cache lasts 60 seconds. Catalogue exposure quotas use a rolling 24-hour usage window, with storage expiry set to that window plus one minute when usage is added.

Ad collection results expire seven days after completion. Collection status remains available for 30 days after completion, and collection idempotency keys are scoped to a 30-day window.

Account data, API keys, the credit ledger, watchlists and vote hashes have no automatic deletion today. We keep them while your account or the vote feature exists, and delete them on request to [email protected].

Your rights

Under the GDPR, and subject to its conditions, you may request access to, rectification or erasure of your personal data, restriction of processing and data portability. You may object to processing based on legitimate interests. Send requests to [email protected].

You also have the right to lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), at www.cnil.fr.

Public advertising data

The advertising data displayed on adsrunning comes from public sources about companies and their advertisements. It is separate from your account data and is displayed for advertising research and analysis.

Some LinkedIn ads are posted by a person rather than a company page. For those ads we show the name and public profile link that LinkedIn publishes with the ad. People shown in an ad can exercise their rights by writing to [email protected].