Privacy Policy

This Privacy Policy explains how AdsPing (“AdsPing”, “we”, “our”) handles information in connection with the AdsPing service (the “Service”) — a server-side conversion tracking platform that forwards events from our customers’ websites to advertising platforms such as Meta, TikTok, and Google.

AdsPing serves two distinct groups: our customers (businesses that sign up to use the Service) and the visitors of those customers’ websites (end users). Each section below makes clear which group it applies to.

The Service and this website (adsping.io) are operated by ORBITVIBE GROWTH SOLUTION L.L.C-FZ, the data controller responsible for AdsPing:

1. Our role

AdsPing operates as a data processor for website visitors and as a data controller for its own customer accounts.

• For customers — when you create an AdsPing account we act as the controller of your account information (name, email, billing details).
• For end users of customer websites — when events flow through AdsPing, we process them on behalf of our customer, under that customer’s instructions, and only for the purpose of delivering those events to the destinations (Meta, TikTok, Google, etc.) the customer has connected. The customer is the controller of that data.

2. Information we collect

2.1 Customer account information

• Name, email, password hash, and optional profile details.
• Billing information (processed by Stripe; we store only the last-four digits and customer identifier).
• Usage information such as pixel settings, connected destinations, and dashboard preferences.
• Product analytics for our own internal operations (see Section 8).

2.2 Event metadata processed on behalf of customers

When a visitor loads a website with the AdsPing tracking script installed, we receive events that include information such as:

• Event type (e.g. PageView, Purchase, Lead).
• URL of the page where the event occurred.
• UTM parameters (source, medium, campaign, content, term).
• Ad-click identifiers if present in the URL or cookies (fbclid, gclid, ttclid, msclkid, etc.).
• A first-party identifier generated by our script to stitch a visitor’s session together.
• Technical information sent by the browser (IP address, user agent, page URL).
• Values provided by the customer’s site for that event (e.g. order value, currency, product identifier).
• Hashed contact information for advanced matching (email, phone) — only if the customer’s site explicitly provides it and only in a one-way SHA-256 hashed form when forwarded to ad platforms.

Events are forwarded to the destinations our customer has configured and then stored only as aggregate counters in our systems. We do not retain per-event rows containing contact information. The metrics we retain are limited to counts and sums grouped by day, event type, UTM attribution, destination, and currency.

2.3 Cookies we set on customer websites

Our tracking script may set a first-party cookie (_ap_id) on the customer’s domain to provide a stable identifier across a browsing session and to deduplicate events. The cookie contains a random value — no personal information.

3. How we use information

• To operate, maintain, and improve the Service.
• To process events on behalf of customers and forward them to their chosen destinations.
• To communicate with customers about their account, billing, and service updates.
• To detect, prevent, and respond to fraud, abuse, and security issues.
• To comply with our legal obligations.

We do not sell personal information. We do not use event data for our own advertising or profiling.

4. Google user data

When a customer connects their Google account to AdsPing, we access data from Google APIs. This section explains exactly what we access, why, and what we do not do with it. AdsPing’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4.1 What we access and why

4.2 How we store it

Google access and refresh tokens are encrypted at rest and are used only to make the API calls described above on the customer’s behalf. The connected account email is stored so the dashboard can display it. We do not copy Google Analytics reports or Google Ads campaign data into our own records.

4.3 Limited Use

• We use Google user data only to provide and improve the features described above, which the customer explicitly requested.
• We do not transfer Google user data to third parties except as necessary to provide the Service, to comply with applicable law, or as part of a merger or acquisition.
• We do not use Google user data for advertising, including retargeting, personalized advertising, or interest-based advertising of our own.
• We do not sell Google user data.
• We do not allow humans to read Google user data, unless we have the customer’s affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, to comply with applicable law, or the data is aggregated and de-identified for internal operations.
• We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

4.4 Revoking access

A customer can disconnect their Google account at any time from the AdsPing dashboard, which deletes the stored tokens. Access can also be revoked directly from Google Account permissions. After revocation we stop making API calls on that account’s behalf.

5. Meta and WhatsApp data

When a customer connects a Meta ad account or a WhatsApp Business Account through Facebook Login, we access data from Meta’s APIs only for the features that customer has turned on. We use it in accordance with the Meta Platform Terms and the WhatsApp Business Policy.

5.1 What we access and why

5.2 Message content and conversation scoring

By default, we do not store the text of WhatsApp messages.

Conversation scoring is an optional feature that the customer turns on separately for each connected number. While it is on:

• The text of messages in that number’s conversations, both received and sent by the business, is stored encrypted in our database. Photos, voice notes, and other media are recorded only by type, plus any caption.
• That text is sent to our subprocessor Anthropic, which evaluates how likely the conversation is to become a customer and how well it was handled. The result is shown only in that customer’s dashboard.
• Message text is deleted 30 days after it is received. Scores are kept with the lead.
• Message text is never used to send messages, for advertising, or to train or improve artificial intelligence models, whether ours or Anthropic’s. Anthropic does not train models on data sent through its commercial API.

The customer is the controller of these conversations. Before turning scoring on, the customer is responsible for informing the people who message them and for having a valid legal basis, including explicit consent where messages may contain health information or other special categories of personal data. The customer can turn scoring off at any time. From then on no new message text is stored, and existing text is deleted on the 30-day schedule above.

5.3 How we store it

Meta and WhatsApp access tokens and the phone numbers of people who message a connected number are encrypted at rest, with encryption keys managed in AWS Key Management Service. We use tokens only to make the API calls described above on the customer’s behalf.

5.4 Revoking access

A customer can disconnect Meta or WhatsApp at any time from the AdsPing dashboard. Access can also be removed directly from Facebook under Settings → Business Integrations. See our data deletion instructions to have your data removed.

6. Legal bases (EEA / UK)

Where the EU or UK GDPR applies we rely on one of the following legal bases:

• Contract — to provide the Service we have agreed to deliver.
• Legitimate interests — to operate and secure our Service, prevent abuse, and develop new features.
• Consent — where required (e.g. the customer’s website has obtained cookie consent from the visitor before firing events).
• Legal obligation — to comply with applicable law.

7. Subprocessors

We use a small number of vetted third-party providers to run the Service. Each is bound by contract to equivalent data-protection terms.

Advertising platforms below receive conversion events only when a customer has explicitly connected them as a destination on their pixel. Each platform is an independent controller of the data it receives from the customer.

AdsPing does not forward direct identifiers (email, phone) to any recipient in plaintext — identifiers used for advertiser-side matching are SHA-256 hashed before transit in line with each platform’s Conversions/Events API specification.

8. Sharing

We share information only as described in this Policy, specifically:

• With the subprocessors listed above, under contract.
• With the advertising platforms a customer has connected as a destination — this is the core purpose of the Service.
• With law enforcement or courts when required by a valid legal request, in a jurisdiction that applies to us.
• In connection with a corporate transaction (merger, acquisition) provided the recipient continues to honour this Policy.

9. International data transfers

AdsPing operates from the United States and the European Union and may route event processing through either region. Where data is transferred from the EEA, UK, or Switzerland, we rely on the Standard Contractual Clauses and/or an applicable adequacy decision. Customers in Türkiye may opt to have their events processed in a Turkey-region endpoint for KVKK compliance.

10. Retention

• Customer account information — retained while the account is active and for up to 24 months after account closure, unless a longer retention period is required by law (e.g. tax records).
• Event metadata aggregates — retained for up to 24 months to support historical reporting; customers may request shorter retention via their account settings.
• Raw event payloads — not retained after forwarding.

11. Security

We encrypt data in transit (TLS 1.2+) and at rest. Access to production systems is limited to authorised personnel and protected by multi-factor authentication. We run regular backups, monitor for anomalies, and maintain an incident-response plan. If we become aware of a security incident affecting your data, we will notify you without undue delay.

12. Your rights

Depending on your location, you have rights to access, correct, delete, export, or restrict processing of your personal information, to object to processing, and to lodge a complaint with your local data-protection authority. End users of a customer website should contact that customer directly, since AdsPing processes event data on their behalf.

• EEA / UK — rights under the GDPR.
• California — rights under the CCPA / CPRA.
• Türkiye — rights under KVKK Article 11.

To exercise any of these rights, email privacy@adsping.io. We respond within 30 days.

13. Children

The Service is not directed to children under 16 and we do not knowingly process personal information of children. If you believe a child has provided us with personal information, contact privacy@adsping.io and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. Material changes are notified to customers by email and posted here with an updated “Last updated” date at least 14 days before taking effect.

15. Contact

AdsPing is operated by ORBITVIBE GROWTH SOLUTION L.L.C-FZ.

See also our Terms of Service and our Data Processing Agreement.