Back to the appHow AdSight360 keeps your data safe
One page on what we hold, where it lives, who can see it and how it is protected, written for the person at a client who has to ask. The Privacy Policy and the Data Processing Agreement are the legal documents; this is the plain version of the same facts.
What we hold
- Your advertising figures: the performance of your campaigns, ads and placements as each ad platform reports them, never about one person.
- Your team: names, email addresses, sign-in records and what each person does in the app.
- Records you connect or upload to check results: orders, leads and visits, with a hashed customer reference and no names or addresses.
- Card numbers, never. Payments go to our payment provider; we keep the card's brand, its last four digits and its expiry.
Where it lives
- The database and sign-in are in London (Supabase, AWS eu-west-2); your report files and ticket attachments are in a Google Cloud bucket in London.
- The app, the API and the jobs that pull your figures run on Google Cloud in London.
- Emails we send you go through a provider in the United States under its data processing terms with UK transfer safeguards.
- Encrypted backups are kept for 35 days in a separate Google Cloud project; deleted data is gone from them within 36 days.
Who at AdSight360 can see it
- A staff member opens your workspace with one click, and every visit is logged with who, when and why; a visit ends when the staff member closes it, signs out, or after 15 idle minutes.
- Nobody at AdSight360 changes your team or what your people can do without a ticket from your Account owner or an Admin. A direct change to your data is only ever a reviewed script with a ticket and a second staff member's approval, and shows in your change history.
- Every staff action is recorded. Visits and support work are kept for two years, access decisions for six; who has access to what is reviewed every quarter.
- Staff sign in with two-step verification; the most sensitive actions need a fresh two-step code, a written reason and the approval of a second super admin where one is in post.
How it is protected
- Two-step sign-in for your team, which your Account owner can require for everyone.
- Connection keys to your ad accounts are encrypted in a vault that no staff login can read; our own keys live in a secrets manager, never in code.
- Every file uploaded to a ticket is scanned for malware, and cannot be opened or downloaded until it has passed.
- Rate limits, security headers and a strict content policy on every page; dependencies and secrets scanned on every change.
- If something goes wrong on our side, affected clients are told within 48 hours of our knowing, with what happened, what data and what we did; the regulator within 72 hours where the law requires it.
The companies we use
These companies process data for us under written terms. Your own ad platforms, stores, analytics and CRM systems are not among them: you have your own terms with each, and we read from them on your instruction.
| Company | What it does for AdSight360 | Where the data is |
|---|---|---|
| Supabase | Database and sign-in, including encrypted storage of connection keys | UK, London |
| Google Cloud | Runs the app, the API and the jobs; stores your report files and attachments; keeps our keys and the encrypted backups; checks the addresses of websites your ads appeared on | UK, London |
| Windsor | Connects to your advertising, analytics, store and CRM accounts and returns their figures; carries out approved Autopilot changes | Switzerland (company); hosting location as published in Windsor's own sub-processor list |
| Anthropic | Sightel, the drafted recommendations on alerts, the brand-safety checks of ad and placement text and the first look at support tickets; not used to train models | United States, under the UK addendum |
| Our payment provider | Card payments, subscriptions and invoices; card numbers go there only | EU and United States, under its data processing terms with UK transfer safeguards |
| Postmark | Sends the emails you get from us | United States, under its data processing terms with UK transfer safeguards |
| PostHog | Counts which screens of the app get used, by workspace, only if you allow analytics on the cookie banner; no name, email or ad figure, and set to discard your address | EU, Frankfurt |
| Google Workspace | Our company email, including support@ and privacy@ | Google's data centres, which may be outside the UK, under Google's data processing terms |
Your rights and complaints
To ask for a copy of your personal data, correct it or have it deleted, email privacy@adsight360.com. We reply within a month.
If you are unhappy with how we have handled your personal data, complain to privacy@adsight360.com first: we acknowledge a complaint within 30 days, keep you updated and tell you the outcome.
You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.
Report a security problem
If you have found a way to see or change data you should not, email security@adsight360.com. This address is also in our security.txt.
Please include what you saw, how to repeat it, and which account you used. Stay within your own account's data and do not read, change or keep anyone else's.
We reply within two working days. We do not pay bounties, and we do not pursue good-faith research that follows these rules.
Documents on request
Email privacy@adsight360.com for any of these.
- Data Processing Agreement
- Sub-processor List
- Answers to your procurement team's security questionnaire
- Privacy Policy (also in the app under Settings, Data & privacy)