Privacy Policy
Effective date: 2026-11-11
This policy explains what personal data Adflank collects when you visit our website or use the app, why, who it is shared with, how long it is kept, and how to exercise your rights. It applies to adflank.com, app.adflank.com, any earlier addresses the service was offered under, and the emails we send.
Updated 2026-11-05: we now name Discord, which notifies our team of support and contact-form messages; say more precisely how Google handles Flanker messages; add the legal basis for reviewing Flanker conversations and for our sign-in abuse counters; describe how account deletion works and what is kept after it; and remove features we no longer offer.
1. Who we are
Adflank is a competitor-intelligence service for marketing teams. The data controller for the personal data described here is:
UAB Bakst, trading as Adflank
Company registration number: 307506583
VAT number: LT100019926018
Registered address: Sausio 13-osios g. 7-20, LT-04344 Vilnius, Lithuania
Email: hello@adflank.com
For anything in this policy, email hello@adflank.com with the subject line “Privacy”.
2. What we collect, and where it comes from
2.1 Account and profile
When you create an account we collect your first name, email address and, if you use Google sign-in, the name and email your Google account provides. During onboarding you may also tell us your company name and website, your role, your industry, the advertising platforms you use and your goals. Signing in is by one-time code emailed to you; legacy accounts created before 2026 may hold a password, stored only as a hash by Firebase Authentication.
2.2 What you ask us to track
The competitors you add: their names, websites, Meta (Facebook and Instagram) pages, Google advertising domains, TikTok and LinkedIn advertisers, and any keywords you track. Agencies also enter the names, websites and contact emails of the clients they manage on our platform.
2.3 Billing
Payment is taken by Stripe on Stripe’s own checkout pages. We never see or store your card number. We store your Stripe customer identifier, your plan and whether your subscription is active, which Stripe sends us after payment.
2.4 Things you write in the app
Your conversations with Flanker, our AI assistant; feedback you leave on its answers; messages you send to our support chat, in the app or on our website (website visitors get an anonymous session so their thread can be kept, and may leave an email address so we can reply); and to-do items and calendar events you create on your home screen.
2.5 Contact form and newsletter
The contact form collects your name, email, message and any file you attach. The newsletter form on our blog, and the optional “product updates” box at sign-up, collect your email and your consent to receive marketing. Signing up adds you to our marketing emails only if you tick that box.
2.6 Usage and technical data
Inside the app we count which features you use and the days you were active, keyed to your account, and how many AI messages you send per day so we can enforce plan limits. Our hosting provider, Google Firebase, records standard server logs (IP address, browser and device type, pages requested, timestamps) for security and operations. To protect sign-in from abuse we count code requests per network address and per email domain; we store only a keyed hash of the address or domain, never the address itself, and the counters are deleted after 2 days. On the marketing site, and only if you consent, Omnisend records page views and sets visitor identifiers (see the Cookie Policy).
2.7 Integrations you connect
If you connect Slack or Discord, we store the webhook address for the channel you choose so we can post digests there. It is stored server-side and is not readable from the browser.
2.8 Public advertising data about the companies you track
The product itself is built from publicly available advertising information: ads published in Meta’s Ad Library, Google’s Ads Transparency Center, TikTok’s Commercial Content Library, LinkedIn’s Ad Library and public search results. This is information about businesses, not about you. It can incidentally include personal data of people who appear in advertisements (for example a presenter or an influencer named in an ad). We process it under our legitimate interest in providing competitive-intelligence services, we do not enrich it or use it to profile those individuals, and we do not send it to anyone except as described in section 5.
3. Why we use it, and the legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the service you signed up for: your account, your dashboards, tracking the competitors you chose, sending sign-in codes | Account, profile, competitor lists, integrations | Performance of a contract (Art. 6(1)(b)) |
| Billing and subscription management | Stripe customer id, plan, status | Performance of a contract; legal obligation to keep accounting records (Art. 6(1)(c)) |
| Answering your questions with Flanker, including sending the relevant context to our AI provider | Your messages, your name, company, plan and the competitor data on your dashboards | Performance of a contract |
| Reviewing a small sample of stored Flanker conversations to improve its answers | Your messages and Flanker's replies | Legitimate interest (Art. 6(1)(f)) in improving the service. You can object at any time by switching off 'Store my Flanker conversations' in Settings |
| Support, and replying to the contact form, including notifying our team of new messages through Discord | Support conversations, contact form entries and attachments, the email address you give | Performance of a contract; legitimate interest in answering enquiries (Art. 6(1)(f)) |
| Product emails: verification and sign-in codes (we keep a short delivery log of sign-in codes, including whether each code email was opened, to spot and fix codes that do not arrive, and for security, and to notice log-in attempts for addresses with no account; the code email contains a small tracking image that tells our email provider, Omnisend, when it is opened. We use that signal only to tell whether codes arrive. Omnisend also records opens of the other emails we send through it, such as digests and newsletters; we use those only to measure delivery and engagement in aggregate), and the daily competitor digest for accounts that have it switched on | Email address, name, code delivery and open status, digest content | Performance of a contract; you can switch the digest off in Integrations. Legitimate interest (Art. 6(1)(f)) in helping visitors reach the right sign-up path and in keeping sign-in secure |
| Protecting sign-in from abuse by counting code requests per network address and email domain | Keyed hashes of the network address and email domain, request counts | Legitimate interest (Art. 6(1)(f)) in keeping sign-in secure and preventing abuse |
| Marketing emails and newsletters, only if you ticked the box at sign-up or subscribed on our blog | Email address, consent record | Consent (Art. 6(1)(a)); withdraw at any time via the unsubscribe link or by emailing us |
| Understanding which features are used, keeping the service secure and improving it | Feature usage counts, daily activity, server logs | Legitimate interest (Art. 6(1)(f)) in running and improving the service |
| Marketing-site analytics via Omnisend | Page views, visitor identifiers | Consent (Art. 6(1)(a)) given through the cookie banner |
| Complying with law and defending legal claims | Whatever is necessary from the above | Legal obligation; legitimate interest |
4. Flanker and other AI features
Flanker answers questions about your competitors. To do that, each message you send is processed by Google's Gemini models through the Gemini API, from a server we run on Google Cloud, together with the context the answer needs: your first name and company, your plan, the list of competitors you track, summaries of their ads, a sample of their ad copy, and the earlier messages in the same conversation. Conversations are stored for 90 days from when they are first stored, so you can return to them. A small number may be reviewed by the Adflank team to improve Flanker's answers, and every access through our admin tools is logged. You can turn storage off, or delete your stored conversations, in Settings. Adflank itself does not use your conversations to train AI models. Google receives your messages and that context through the Gemini API and handles them under the Gemini API terms that apply to our account, which set out whether and how Google may keep or use them. AI answers can be wrong; treat them as analysis to check, not as fact.
5. Who we share data with
We do not sell personal data. We share it with the providers below, each of which processes it on our instructions or under its own terms as noted, and with authorities where the law requires.
| Provider | What for | Where |
|---|---|---|
| Google Cloud / Firebase | Hosting, authentication, database (Firestore), file storage for attachments, server functions, server logs | EU (database, multi-region eur3) and USA (functions, us-central1) |
| Google (Gemini API) | Generating Flanker's answers | USA and other countries where Google processes Gemini API requests |
| Stripe | Payments, invoices, subscription status. Stripe is an independent controller for the payment itself | EU and USA |
| Omnisend | Sending sign-in codes, verification and digest emails; newsletters; marketing-site analytics (with consent) | EU and USA |
| SearchAPI.io | Retrieving public advertising data from Meta's Ad Library, Google, TikTok's Commercial Content Library and LinkedIn's Ad Library. Receives the names, pages and domains of the competitors you track, never your account details | USA |
| Discord | Notifying our team of new support and contact-form messages: the message (shortened), your name as entered, your plan and your email address, including an address a website visitor typed that we have not verified. The notifications go to a private channel only our team can see | USA |
| Slack / Discord (your own channel) | Only if you connect them: the digest content is posted to the channel you chose | USA |
| Google (favicon service) and Microlink | Your browser requests small logos and page previews for the competitor websites shown on your dashboards. Those requests carry your IP address and the competitor's domain | USA |
We may also disclose data to a buyer or successor if the business is sold or merged, under the same commitments as this policy, and to professional advisers under confidentiality.
6. International transfers
Some providers above process data in the United States. Where they do, transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework for providers certified under it, or on the Commission’s Standard Contractual Clauses with supplementary measures. You can ask us for details of the safeguard that applies to a given provider.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, competitor lists, dashboards, integrations | While your account exists. Cancelling your plan does not delete it, so you can come back. To delete your account, email us (see section 9) and we delete it within 30 days of your request, including your contact at our email provider (Omnisend) and our team's Discord notifications of your support messages — by hand where a provider requires it. |
| Kept after account deletion | Invoices and payment records (10 years, as required by Lithuanian accounting law), a billing history without contact details (2 years), and security and access logs (up to 2 years). |
| Flanker conversations | 90 days from when each conversation is first stored, then erased. You can turn storage off or delete them yourself in Settings at any time. |
| Support conversations | While your account exists. |
| Notifications of support and contact-form messages in our team's Discord channel | Deleted within 30 days when you ask us to delete your account, by hand where needed. Notifications of messages sent without an account are kept until we delete them, or sooner if you ask us. |
| Sign-in code delivery records: the address, when each code was sent, whether our email provider accepted it or reported a bounce, when the code email was first opened (as reported by our email provider, Omnisend), and whether the code was used. If someone asks for a log-in code for an address that has no Adflank account, we record the address and the time of the request (no email is sent), so we can help people who meant to sign up. | 90 days, to spot and fix undelivered codes and for security. Then erased. |
| Sign-in abuse counters: a keyed hash of the network address and of the email domain a code was requested from, and how many requests each made | 2 days, then erased. |
| Onboarding you started but did not finish | 90 days from your last step, then erased. |
| Contact form messages and attachments | 12 months from receipt. |
| Newsletter and product-update subscriptions | Until you unsubscribe. |
| Newsletter consent record | Kept as proof of consent after account deletion. |
| Feature usage counts and activity days | 12 months. |
| Server logs | Up to 30 days, per Google Cloud's default logging retention. |
| Invoices and payment records | 10 years, as required by Lithuanian accounting law. |
| Your cookie choice | 12 months, or until you change it. |
8. Security
Data is stored on Google Cloud infrastructure and encrypted in transit and at rest. Access to the database is restricted by per-user security rules, so an account can read only its own data. Sign-in uses one-time codes rather than stored passwords. Only the people who need access to operate the service have it. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the supervisory authority as the law requires.
9. Your rights
Under the GDPR you can ask us to:
- tell you what personal data we hold about you and give you a copy (access and portability);
- correct anything that is wrong;
- delete your data, subject to the retention we must keep by law (there is no delete button in the app: email us and we do it within 30 days);
- restrict or object to processing based on our legitimate interests;
- withdraw consent at any time where consent is the basis, without affecting what was done before.
Email hello@adflank.com from the address on your account. We answer within one month. You can also complain to the State Data Protection Inspectorate of the Republic of Lithuania (VDAI), or to the authority in the EU country where you live or work.
10. Agencies and their clients
If you use Adflank as an agency and create profiles for your clients, you decide what client information to enter and are the controller for it; we process it on your behalf under the Terms of Service, which include our data-processing commitments. Enter only what you have the right to share.
11. Cookies and similar storage
What we store in your browser, what is essential, and what needs your consent is set out in the Cookie Policy. You can change your choice at any time using the “Cookie settings” link in the footer.
12. Children
Adflank is a business tool for people aged 18 or over. We do not knowingly collect data from anyone younger; if you believe we have, tell us and we will delete it.
13. Changes
When this policy changes we update the effective date at the top. For changes that affect your rights or how we use your data, we will also email account holders before the change applies.
14. Contact
Contact
UAB Bakst, trading as Adflank
Company registration number: 307506583
VAT number: LT100019926018
Registered address: Sausio 13-osios g. 7-20, LT-04344 Vilnius, Lithuania
Email: hello@adflank.com