Privacy Policy

1. Data we process

• Account data: e-mail address, password hash, organisation name.
• Content you upload: your master banner image and the ad formats you choose to generate.
• Usage and technical data: exports you run, log records, IP address, browser information.
• Billing data: credit balance, purchase and spending history. Card details are processed by payment providers and never reach our servers.

2. Purposes and legal bases

• Providing the Service (contract performance): account management, running resize exports, delivering results, support.
• Billing and accounting (contract performance; legal obligation).
• Service security and abuse prevention (legitimate interest).
• Product analytics and improvement of generation quality (legitimate interest).
• Communications you have requested (contract performance or consent).

3. Processors and transfers

To provide the Service we share data with processors acting on our instructions: hosting and infrastructure providers, payment providers, e-mail delivery services, and third-party AI model providers that process your uploaded banner solely to produce your requested formats. Where processors are located outside the EEA, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

We do not sell personal data and do not use your uploaded content to train our own or third-party foundation models.

4. Retention

Account data is kept for as long as your account exists. Uploaded banners and generated results are kept so you can access them in your dashboard and are deleted upon account deletion, except where retention is required by law (e.g. accounting records) or for the establishment of legal claims.

5. Your rights

Subject to the GDPR you have the right to:

• access your personal data and receive a copy;
• rectify inaccurate data;
• erase data ("right to be forgotten");
• restrict or object to processing based on legitimate interest;
• data portability;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a data-protection supervisory authority in your country of residence.

To exercise these rights, write to hello@fabrika.ad. We respond within one month.

6. Cookies

The Service uses cookies and similar technologies that are strictly necessary for authentication, security and remembering your language preference (e.g. the session refresh cookie). We also use privacy-respecting analytics to measure site usage.

Campaign attribution cookies (technical). Before any analytics consent is given, and only if you arrive from an advertising campaign, we store two technical identifiers for up to 30 days: ade_click_v1, an opaque click token issued by our own ad tracker, and ade_utm_v1, which holds the campaign source, medium and campaign name, the Google Ads (gclid) or Yandex Direct (yclid) click identifier, and the reviewed landing route you arrived on. They serve a single purpose — connecting a subsequent registration to the campaign that produced it — and are never used to profile you, to target advertising, or to share data with third-party advertising networks. We do not store the full URL, search terms or any account fields in them. If you arrive without campaign parameters, nothing is stored at all.

Both cookies are deleted from your browser as soon as the registration is linked to an account. The campaign attribution record then kept on the account is erased when you withdraw analytics attribution in Privacy settings or delete the account; the ad click token is retained for as long as the account exists, because reconciling paid clicks with the ad tracker is a strictly necessary measurement we owe under the advertising service contract.

With your consent, a browser cookie additionally keeps a fuller first-touch record for up to 30 days: the product, reviewed landing route, locale, referring hostname and the remaining campaign identifiers (such as ad content and campaign id) that the technical cookies above deliberately leave out. We do not store the full URL, search terms, prompts or account fields in this record. After account linking, the browser cookie is deleted and the minimized record is retained on the account for aggregate acquisition measurement until you withdraw analytics consent in Privacy settings or delete the account. If an authenticated deletion fails, a strictly necessary pending marker (up to one year) asks for explicit confirmation for the currently signed-in account and is removed on success. Anonymous decline creates no account-deletion marker.

7. Changes and contact

We may update this Policy; the current version is always available on this page. Questions about privacy: hello@fabrika.ad (Qurve Labs LLC, 30 N Gould St, Sheridan, WY 82801, USA).