AdTruffle

Privacy Policy

Last updated 1 October 2026

This Privacy Policy explains how personal data is collected, used, stored, and shared when you visit https://www.adtruffle.com or use AdTruffle (the “Service”).

AdTruffle is operated by SCALEFLOWS LTD (“we”, “us”, “our”). This is the privacy notice for AdTruffle under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy covers your personal data as a visitor or customer. How we read the public Meta Ad Library and label stores is product methodology. It is not a separate public page, and it is not this notice.

1. Who we are (controller)

  • Controller: SCALEFLOWS LTD, the operator of AdTruffle
  • Company number: 16609439
  • Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
  • Contact email: support@adtruffle.com

VAT / tax: Listed prices are exclusive of VAT. Applicable VAT (or equivalent) is calculated and added by Stripe at checkout.

If you have questions about this Privacy Policy or wish to exercise your rights, email support@adtruffle.com. The registered office is listed above and on the Legal notice.

2. Supervisory authority

We are established in the United Kingdom. The UK Information Commissioner’s Office (ICO) is the relevant supervisory authority. You may complain to the ICO at https://ico.org.uk/ if you are unhappy with how we handle your personal data. We would appreciate the chance to address your concerns first.

3. Personal data we collect

3.1 Account and login data

  • Email address
  • Login credentials or authentication identifiers (including where you sign up or sign in with Google OAuth)
  • Account settings (for example preferred countries, reach thresholds, digest time and channels, webhook URLs)
  • Watchlist, swipe file, saved filters, alert rules, and digests we send you
  • Subscription and plan status (including credits usage related to your account)

3.2 Payment-related data

Payments are processed by Stripe. We do not store your full card details. We may receive limited billing metadata from Stripe (for example payment status, customer identifier, plan, invoices, and refund status) needed to provide and administer your subscription.

3.3 Technical and usage data

  • Device, browser, and connection information (such as IP address, user agent, approximate location derived from IP)
  • Log data relating to access, security, and abuse prevention
  • Product usage events needed to operate the Service (for example credit unlocks, filter use, feature access)
  • Referral data: when you open a link a member shared (a shared ad, or their link to this site), we record the day, the member’s referral code and the ad, the referring site (host only), your country, device type and in-app browser, your network prefix (the first three parts of an IPv4 address), and a one-way visitor hash that can no longer be linked to you after two days. If you then sign up or subscribe, we record which member referred you and the amounts you paid. We also keep the network prefixes accounts sign in from, to spot members referring themselves.

3.4 Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. Vercel Analytics and Vercel Speed Insights load and run unless you reject them. You can change that choice on the Cookie Policy page.

3.5 Communications

If you email us at support@adtruffle.com, we process your name, email address, and message so we can reply.

3.6 What we do not collect about advertisers or ad audiences

Public Meta Ad Library fields (such as page names and ad identifiers) are published by Meta. We do not hold personal data about people who see or click third-party ads beyond what Meta publishes publicly in the Ad Library, and we do not claim to hold advertiser personal data beyond those public fields.

4. Purposes and legal bases

We process personal data for the following purposes and legal bases (UK GDPR Article 6):

  1. Providing the Service and managing your account — performance of a contract with you (or steps prior to entering a contract).
  2. Processing subscriptions, credits, upgrades/downgrades, cancellations, and refunds — performance of a contract; and where needed, legitimate interests in administering billing.
  3. Sending transactional emails (account, billing, security, digests you configure) — performance of a contract; legitimate interests.
  4. Security, fraud prevention, and acceptable-use enforcement — legitimate interests; legal obligation where applicable.
  5. Improving and debugging the Service using aggregated or necessary technical data — legitimate interests.
  6. Analytics (Vercel Analytics and Speed Insights) — run unless you reject them on the Cookie Policy page.
  7. Measuring which shared links bring in customers, and keeping those numbers free of self-referrals: legitimate interests. The referral cookie is set when you open a shared ad unless you have rejected cookies, and for a member’s link to the home page only after you accept them.
  8. Responding to enquiries and legal requests — legitimate interests; legal obligation where applicable.
  9. Google OAuth sign-in — performance of a contract / steps requested by you; and processing necessary to authenticate you via the provider you choose.

Where we rely on legitimate interests, we balance those interests against your rights and expectations. You may object to processing based on legitimate interests as described in Section 9.

5. Processors and recipients

We use trusted service providers who process personal data on our behalf (or as independent controllers where they determine their own purposes, such as payment networks):

  • Supabase — database, authentication, and related backend infrastructure
  • Vercel — hosting, delivery of the website/application, and Analytics / Speed Insights unless you have rejected them
  • Stripe — payment processing and subscription billing
  • Resend — transactional email and digest email
  • Ad library scrapers — scrapers that read the public Meta Ad Library. They collect public ad fields, not your account
  • Railway — crawl and digest jobs, run in the Netherlands
  • Anthropic — niche classification of public ad and landing-page text
  • OpenAI — embeddings for search, when that provider is configured
  • Discord, or another webhook you configure — only if you choose that delivery for digests
  • Google — only if you sign in with Google (Google acts as an identity provider; see Google’s own privacy notice for its processing)

We may also disclose data if required by law, to protect rights and safety, or in connection with a corporate transaction (for example merger or asset sale), subject to appropriate safeguards.

We do not sell your personal data.

6. International transfers

Our providers may process data in the United Kingdom, European Economic Area, United States, or other countries. Where personal data is transferred outside the UK (or, where applicable, the EEA), we take steps to ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement / Addendum, EU Standard Contractual Clauses (where applicable), and provider terms that include transfer mechanisms.

7. Retention

We retain personal data only as long as needed for the purposes above:

  • Account data: for the life of your account and a reasonable period afterwards (for example to handle disputes, chargebacks, or legal claims), unless you request earlier deletion and we are not required to retain it.
  • Billing records: for periods required by tax and accounting law.
  • Security and server logs: for a limited period consistent with security and operational needs.
  • Cookie / consent records: for the period needed to honour and evidence your choices.
  • Referral data: network prefixes of shared-link visits for 30 days, the visits themselves for 13 months, the daily salt behind visitor hashes for two days, sign-in network prefixes until 90 days after last seen, and who referred an account for the life of that account.

You may ask us to delete your account at any time. Deleting your account removes account-related personal data described in our product materials and cancels any active subscription, subject to data we must retain by law (for example invoice records).

8. Security

We use appropriate technical and organisational measures, including encrypted transport (HTTPS/TLS), access controls, and storage of secrets in hosting providers’ encrypted environment settings. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. Your rights

Under UK GDPR, depending on the circumstances, you may have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase data (“right to be forgotten”)
  • Restrict processing
  • Data portability
  • Object to processing based on legitimate interests
  • Withdraw consent where processing is based on consent (withdrawal does not affect prior lawful processing)
  • Lodge a complaint with the ICO

To exercise these rights, email support@adtruffle.com. Postal enquiries can be sent to the registered office on the Legal notice. We may need to verify your identity before acting on a request.

10. Children

The Service is intended for business users and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will take appropriate steps.

11. Automated decision-making

We do not use your personal data for automated decision-making that produces legal or similarly significant effects about you within the meaning of UK GDPR.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be notified in-product or by email where appropriate. Continued use of the Service after an update constitutes acknowledgement of the updated Policy, except where consent is required by law.

13. Related documents