Privacy Policy

    Effective date: 2026-11-11

    This policy explains what personal data Adflank collects when you visit our website or use the app, why, who it is shared with, how long it is kept, and how to exercise your rights. It applies to adflank.com, app.adflank.com, any earlier addresses the service was offered under, and the emails we send.

    Updated 2026-11-05: we now name Discord, which notifies our team of support and contact-form messages; say more precisely how Google handles Flanker messages; add the legal basis for reviewing Flanker conversations and for our sign-in abuse counters; describe how account deletion works and what is kept after it; and remove features we no longer offer.

    1. Who we are

    Adflank is a competitor-intelligence service for marketing teams. The data controller for the personal data described here is:

    UAB Bakst, trading as Adflank

    Company registration number: 307506583

    VAT number: LT100019926018

    Registered address: Sausio 13-osios g. 7-20, LT-04344 Vilnius, Lithuania

    Email: hello@adflank.com

    For anything in this policy, email hello@adflank.com with the subject line “Privacy”.

    2. What we collect, and where it comes from

    2.1 Account and profile

    When you create an account we collect your first name, email address and, if you use Google sign-in, the name and email your Google account provides. During onboarding you may also tell us your company name and website, your role, your industry, the advertising platforms you use and your goals. Signing in is by one-time code emailed to you; legacy accounts created before 2026 may hold a password, stored only as a hash by Firebase Authentication.

    2.2 What you ask us to track

    The competitors you add: their names, websites, Meta (Facebook and Instagram) pages, Google advertising domains, TikTok and LinkedIn advertisers, and any keywords you track. Agencies also enter the names, websites and contact emails of the clients they manage on our platform.

    2.3 Billing

    Payment is taken by Stripe on Stripe’s own checkout pages. We never see or store your card number. We store your Stripe customer identifier, your plan and whether your subscription is active, which Stripe sends us after payment.

    2.4 Things you write in the app

    Your conversations with Flanker, our AI assistant; feedback you leave on its answers; messages you send to our support chat, in the app or on our website (website visitors get an anonymous session so their thread can be kept, and may leave an email address so we can reply); and to-do items and calendar events you create on your home screen.

    2.5 Contact form and newsletter

    The contact form collects your name, email, message and any file you attach. The newsletter form on our blog, and the optional “product updates” box at sign-up, collect your email and your consent to receive marketing. Signing up adds you to our marketing emails only if you tick that box.

    2.6 Usage and technical data

    Inside the app we count which features you use and the days you were active, keyed to your account, and how many AI messages you send per day so we can enforce plan limits. Our hosting provider, Google Firebase, records standard server logs (IP address, browser and device type, pages requested, timestamps) for security and operations. To protect sign-in from abuse we count code requests per network address and per email domain; we store only a keyed hash of the address or domain, never the address itself, and the counters are deleted after 2 days. On the marketing site, and only if you consent, Omnisend records page views and sets visitor identifiers (see the Cookie Policy).

    2.7 Integrations you connect

    If you connect Slack or Discord, we store the webhook address for the channel you choose so we can post digests there. It is stored server-side and is not readable from the browser.

    2.8 Public advertising data about the companies you track

    The product itself is built from publicly available advertising information: ads published in Meta’s Ad Library, Google’s Ads Transparency Center, TikTok’s Commercial Content Library, LinkedIn’s Ad Library and public search results. This is information about businesses, not about you. It can incidentally include personal data of people who appear in advertisements (for example a presenter or an influencer named in an ad). We process it under our legitimate interest in providing competitive-intelligence services, we do not enrich it or use it to profile those individuals, and we do not send it to anyone except as described in section 5.

    3. Why we use it, and the legal basis

    PurposeDataLegal basis (GDPR Art. 6)
    Providing the service you signed up for: your account, your dashboards, tracking the competitors you chose, sending sign-in codesAccount, profile, competitor lists, integrationsPerformance of a contract (Art. 6(1)(b))
    Billing and subscription managementStripe customer id, plan, statusPerformance of a contract; legal obligation to keep accounting records (Art. 6(1)(c))
    Answering your questions with Flanker, including sending the relevant context to our AI providerYour messages, your name, company, plan and the competitor data on your dashboardsPerformance of a contract
    Reviewing a small sample of stored Flanker conversations to improve its answersYour messages and Flanker's repliesLegitimate interest (Art. 6(1)(f)) in improving the service. You can object at any time by switching off 'Store my Flanker conversations' in Settings
    Support, and replying to the contact form, including notifying our team of new messages through DiscordSupport conversations, contact form entries and attachments, the email address you givePerformance of a contract; legitimate interest in answering enquiries (Art. 6(1)(f))
    Product emails: verification and sign-in codes (we keep a short delivery log of sign-in codes, including whether each code email was opened, to spot and fix codes that do not arrive, and for security, and to notice log-in attempts for addresses with no account; the code email contains a small tracking image that tells our email provider, Omnisend, when it is opened. We use that signal only to tell whether codes arrive. Omnisend also records opens of the other emails we send through it, such as digests and newsletters; we use those only to measure delivery and engagement in aggregate), and the daily competitor digest for accounts that have it switched onEmail address, name, code delivery and open status, digest contentPerformance of a contract; you can switch the digest off in Integrations. Legitimate interest (Art. 6(1)(f)) in helping visitors reach the right sign-up path and in keeping sign-in secure
    Protecting sign-in from abuse by counting code requests per network address and email domainKeyed hashes of the network address and email domain, request countsLegitimate interest (Art. 6(1)(f)) in keeping sign-in secure and preventing abuse
    Marketing emails and newsletters, only if you ticked the box at sign-up or subscribed on our blogEmail address, consent recordConsent (Art. 6(1)(a)); withdraw at any time via the unsubscribe link or by emailing us
    Understanding which features are used, keeping the service secure and improving itFeature usage counts, daily activity, server logsLegitimate interest (Art. 6(1)(f)) in running and improving the service
    Marketing-site analytics via OmnisendPage views, visitor identifiersConsent (Art. 6(1)(a)) given through the cookie banner
    Complying with law and defending legal claimsWhatever is necessary from the aboveLegal obligation; legitimate interest

    4. Flanker and other AI features

    Flanker answers questions about your competitors. To do that, each message you send is processed by Google's Gemini models through the Gemini API, from a server we run on Google Cloud, together with the context the answer needs: your first name and company, your plan, the list of competitors you track, summaries of their ads, a sample of their ad copy, and the earlier messages in the same conversation. Conversations are stored for 90 days from when they are first stored, so you can return to them. A small number may be reviewed by the Adflank team to improve Flanker's answers, and every access through our admin tools is logged. You can turn storage off, or delete your stored conversations, in Settings. Adflank itself does not use your conversations to train AI models. Google receives your messages and that context through the Gemini API and handles them under the Gemini API terms that apply to our account, which set out whether and how Google may keep or use them. AI answers can be wrong; treat them as analysis to check, not as fact.

    5. Who we share data with

    We do not sell personal data. We share it with the providers below, each of which processes it on our instructions or under its own terms as noted, and with authorities where the law requires.

    ProviderWhat forWhere
    Google Cloud / FirebaseHosting, authentication, database (Firestore), file storage for attachments, server functions, server logsEU (database, multi-region eur3) and USA (functions, us-central1)
    Google (Gemini API)Generating Flanker's answersUSA and other countries where Google processes Gemini API requests
    StripePayments, invoices, subscription status. Stripe is an independent controller for the payment itselfEU and USA
    OmnisendSending sign-in codes, verification and digest emails; newsletters; marketing-site analytics (with consent)EU and USA
    SearchAPI.ioRetrieving public advertising data from Meta's Ad Library, Google, TikTok's Commercial Content Library and LinkedIn's Ad Library. Receives the names, pages and domains of the competitors you track, never your account detailsUSA
    DiscordNotifying our team of new support and contact-form messages: the message (shortened), your name as entered, your plan and your email address, including an address a website visitor typed that we have not verified. The notifications go to a private channel only our team can seeUSA
    Slack / Discord (your own channel)Only if you connect them: the digest content is posted to the channel you choseUSA
    Google (favicon service) and MicrolinkYour browser requests small logos and page previews for the competitor websites shown on your dashboards. Those requests carry your IP address and the competitor's domainUSA

    We may also disclose data to a buyer or successor if the business is sold or merged, under the same commitments as this policy, and to professional advisers under confidentiality.

    6. International transfers

    Some providers above process data in the United States. Where they do, transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework for providers certified under it, or on the Commission’s Standard Contractual Clauses with supplementary measures. You can ask us for details of the safeguard that applies to a given provider.

    7. How long we keep it

    DataKept for
    Account, profile, competitor lists, dashboards, integrationsWhile your account exists. Cancelling your plan does not delete it, so you can come back. To delete your account, email us (see section 9) and we delete it within 30 days of your request, including your contact at our email provider (Omnisend) and our team's Discord notifications of your support messages — by hand where a provider requires it.
    Kept after account deletionInvoices and payment records (10 years, as required by Lithuanian accounting law), a billing history without contact details (2 years), and security and access logs (up to 2 years).
    Flanker conversations90 days from when each conversation is first stored, then erased. You can turn storage off or delete them yourself in Settings at any time.
    Support conversationsWhile your account exists.
    Notifications of support and contact-form messages in our team's Discord channelDeleted within 30 days when you ask us to delete your account, by hand where needed. Notifications of messages sent without an account are kept until we delete them, or sooner if you ask us.
    Sign-in code delivery records: the address, when each code was sent, whether our email provider accepted it or reported a bounce, when the code email was first opened (as reported by our email provider, Omnisend), and whether the code was used. If someone asks for a log-in code for an address that has no Adflank account, we record the address and the time of the request (no email is sent), so we can help people who meant to sign up.90 days, to spot and fix undelivered codes and for security. Then erased.
    Sign-in abuse counters: a keyed hash of the network address and of the email domain a code was requested from, and how many requests each made2 days, then erased.
    Onboarding you started but did not finish90 days from your last step, then erased.
    Contact form messages and attachments12 months from receipt.
    Newsletter and product-update subscriptionsUntil you unsubscribe.
    Newsletter consent recordKept as proof of consent after account deletion.
    Feature usage counts and activity days12 months.
    Server logsUp to 30 days, per Google Cloud's default logging retention.
    Invoices and payment records10 years, as required by Lithuanian accounting law.
    Your cookie choice12 months, or until you change it.

    8. Security

    Data is stored on Google Cloud infrastructure and encrypted in transit and at rest. Access to the database is restricted by per-user security rules, so an account can read only its own data. Sign-in uses one-time codes rather than stored passwords. Only the people who need access to operate the service have it. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the supervisory authority as the law requires.

    9. Your rights

    Under the GDPR you can ask us to:

    • tell you what personal data we hold about you and give you a copy (access and portability);
    • correct anything that is wrong;
    • delete your data, subject to the retention we must keep by law (there is no delete button in the app: email us and we do it within 30 days);
    • restrict or object to processing based on our legitimate interests;
    • withdraw consent at any time where consent is the basis, without affecting what was done before.

    Email hello@adflank.com from the address on your account. We answer within one month. You can also complain to the State Data Protection Inspectorate of the Republic of Lithuania (VDAI), or to the authority in the EU country where you live or work.

    10. Agencies and their clients

    If you use Adflank as an agency and create profiles for your clients, you decide what client information to enter and are the controller for it; we process it on your behalf under the Terms of Service, which include our data-processing commitments. Enter only what you have the right to share.

    11. Cookies and similar storage

    What we store in your browser, what is essential, and what needs your consent is set out in the Cookie Policy. You can change your choice at any time using the “Cookie settings” link in the footer.

    12. Children

    Adflank is a business tool for people aged 18 or over. We do not knowingly collect data from anyone younger; if you believe we have, tell us and we will delete it.

    13. Changes

    When this policy changes we update the effective date at the top. For changes that affect your rights or how we use your data, we will also email account holders before the change applies.

    14. Contact

    Contact

    UAB Bakst, trading as Adflank

    Company registration number: 307506583

    VAT number: LT100019926018

    Registered address: Sausio 13-osios g. 7-20, LT-04344 Vilnius, Lithuania

    Email: hello@adflank.com