Effective October 12, 2026 · Social Climax Media, LLC
AdsFactory.ai, operated by Social Climax Media, LLC (North Dakota, USA). Contact: support@adsfactory.ai.
Account data: email, name (if provided), authentication records.
Purchase data: handled by Stripe, our payment processor; we receive transaction status and receipt metadata, never your full card number.
Your brand inputs: brand names, page links, and configuration you enter to generate your reports.
Connected ad-account data (only if you connect one): read-only advertising metadata (spend, performance metrics, creative identifiers) used to power your private features.
Usage data: logs, device and browser info, and analytics events about how the Service is used.
Public advertising data: we separately index publicly available advertising data (e.g., the Meta Ad Library); this concerns public brand advertising, not our users’ private data.
To provide and improve the Service; to generate and deliver your reports; to process payments; to send transactional email (receipts, report delivery, account notices) and, only with consent or as permitted by law, product updates you can opt out of; to secure the Service and prevent abuse.
We do not sell your reports, brand configuration, or connected-account data, and we never show them to other customers except in aggregated, anonymized form. Customer status is never disclosed or inferable from any public surface of the Service.
While you use our signed-in pages, the tools in section 10 can see what those pages show. Microsoft Clarity records them. We mask what they show about your account where we can, but these can still appear in its recordings: your brand’s name; the brands you watch; the markets your brands are in; which ads you saved; where our map marks your brand, the brands you watch and your planned moves; the shape of your brand’s desire mix chart; and the address and title of each page, which can name a brand you opened. The Meta Pixel and Google Analytics receive the address of each page and details of it, such as its title. That is part of the sharing the next paragraph describes.
The analytics and advertising cookies and the server events described in section 10 share identifiers and the other details listed there with Google, Meta and Microsoft for analytics and marketing measurement, and Google, Meta and Microsoft also use what they receive for their own purposes, including advertising (section 10 says what each one receives). Some laws (such as California’s CPRA) treat this as a "sale" or "share." You can opt out of this at any time (the last paragraph of section 10 says how far an opt-out reaches).
Supabase (database, authentication), Vercel (hosting), Stripe (payments), Resend (transactional email), Google (Tag Manager for loading the tags in section 10; Drive/Cloud for media storage), and AI model providers used in our analysis pipelines (which process advertising content, not your account identity). We keep this list current as our stack evolves.
Three companies also receive data through the tools in section 10 and are not on this list for that data: Google (through Google Analytics), Meta (through the Meta Pixel and the Conversions API) and Microsoft (through Microsoft Clarity). Each uses what it receives for its own purposes too, and section 10 explains their roles.
We are based in the United States and use service providers located in the United States and elsewhere, so your information may be processed in the United States and other countries whose data-protection laws may differ from your own. Where required for transfers of personal data from the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the applicable Standard Contractual Clauses.
Account and report data are kept while your account is active and for a reasonable period after, then deleted or anonymized. You may request export or deletion at any time (see section 9).
Google keeps the visit data Google Analytics collects for the period set in our Google Analytics account, and Google’s Privacy Policy and its advertising pages say how long Google keeps what it uses for its own purposes. Google’s own use of what it receives is covered by Google’s Privacy Policy (see section 10).
Meta deletes the hashed details once it has matched them, and may keep the rest of what the Meta Pixel and our server send it for up to two years, and any ad audience built from it until we delete that audience. Meta’s own use of what it receives is covered by Meta’s Privacy Policy (see section 10).
Microsoft Clarity keeps the data for playing back session recordings for 30 days, and its analytics data (such as the page addresses and the visitor ID), its heatmap data and any recording we label or favorite for 9 months; after that Microsoft deletes it from Clarity’s servers, backups included. Microsoft’s own use of what it receives is covered by the Microsoft Privacy Statement (see section 10).
We keep your account’s consent choice while the account exists; copies in our backup files are kept until those files are deleted (see section 10).
Row-level isolation between customer accounts, encrypted transport, and least-privilege keys. No system is perfectly secure; we will notify affected users of a breach as required by law.
Depending on your location (e.g., GDPR/UK, California CCPA/CPRA), you may have rights to access, correct, export, delete, or restrict processing of your personal information, and to non-discrimination for exercising them. Requests: support@adsfactory.ai. We respond within the legally required window.
Essential cookies (for sign-in, security, and remembering your preferences) always run; they are required for the Service to work.
We also use analytics and advertising cookies from Google Analytics (site analytics), the Meta Pixel (advertising measurement and ad targeting) and Microsoft Clarity (session recordings and heatmaps of how our pages are used), all loaded through Google Tag Manager, to understand how our site is used and to measure our marketing. They set cookies on our own domain such as _ga, _fbp, _clck and _clsk, and Microsoft Clarity also sets cookies on Microsoft’s own domains (clarity.ms and bing.com).
Google Analytics records which pages you visit and what you do on them under the random ID in its _ga cookie, and your browser also sends Google the address of each page and your IP address, which Google may use to work out your general location. How Google uses information from sites or apps that use its services explains how Google collects and uses this data.
Wherever it loads, the Meta Pixel sends Meta the address of each page you visit and of the page you came from, your IP address, and details of your browser and device (such as its type, model and time zone), under the random ID in its _fbp cookie and, when you arrive from a link on Facebook or Instagram, that link’s click ID in its _fbc cookie. The Meta Pixel also looks for details in forms and elsewhere on our pages, such as the email address you type to sign in, and sends Meta a hashed copy of any email address, first name, last name, phone number, gender, date of birth, city, state, zip code, country or customer ID it finds, whether or not you sign in (Meta calls this automatic advanced matching). Hashed means scrambled one way: the details themselves are not sent. It also tells Meta which buttons you click, with the words on them, and sends descriptive details of our pages. It also sends how long our pages take to load, whether you last came to our site from Facebook, Instagram or another site, and, with a checkout or purchase event, any total price shown on the page. Inside the Facebook and Instagram apps’ own browsers it also reads what those browsers hold about your visit, such as the ad you came from. After you sign in with an emailed link or with Google, the Meta Pixel also sends Meta hashed copies of your email address and of our ID for your account (Meta calls this advanced matching). Meta uses them to match your visits to people on its platforms, to measure and deliver ads. We keep the hashed email address and our ID for your account, as it is, in a cookie named af_am on your browser for 180 days from the last time you signed in that way, including after you sign out; the Meta Pixel hashes the ID before it sends it. We only set these cookies where they are allowed, and the Meta Pixel does not load once you decline or opt out.
When you create an account, start a trial or buy a plan, our server also tells Meta about it directly (Meta calls this the Conversions API), and again when a trial becomes a paid plan, with hashed copies of your email address and of our ID for your account and, when you are on our site at the time, your IP address, your browser details and the Meta Pixel’s cookies. Our server sends these only where analytics and advertising cookies were allowed in your browser when you created the account or checked out (a trial becoming a paid plan follows the choice made at its checkout), and never once your account’s choice is an opt-out, including one made while signed in after you checked out. An opt-out made while you are signed out reaches your account only when you sign in on that browser, so until then it does not stop these (the last paragraph of this section says how an opt-out reaches your account).
Google Analytics is not one of the processors in section 5. Google runs it for us, and also uses what it receives for its own purposes. Google says it uses what sites like ours share with it to run, improve and develop its services, measure ads, fight fraud and personalize content and ads. Google’s Privacy Policy explains how Google uses the data for each of these purposes and the legal grounds it relies on.
Meta is not one of the processors in section 5, because it does not only act for us. Under Meta’s Business Tools Terms, Meta acts on our behalf when it matches the hashed details and measures how our ads perform. For visitors in the EU and the EEA (with Meta Platforms Ireland Limited) and in the UK (with Meta Platforms, Inc.), we and Meta are joint controllers of collecting this data on our site and sending it to Meta, and once Meta has it, Meta is a controller in its own right. Under Meta’s Controller Addendum and its UK Controller Addendum we are responsible for telling you about this here, and Meta is responsible for your rights over the data it holds after that (to access, correct, delete, restrict or receive a copy of it). Meta also uses what the Meta Pixel and our server send it for its own purposes, including to target and deliver ads, to personalize the content and ads it shows people on and off its platforms, to help businesses reach people with messages on Messenger and its other products, to keep its products safe and improve them, and for research and development. Meta’s Privacy Policy explains who Meta is and how to contact it and its data protection officer, how Meta uses your data, the legal basis it relies on and how to exercise your rights with Meta. To stop the Meta Pixel and our server sending Meta anything about your visits to us for ad targeting, decline or use the "Do Not Sell or Share My Personal Information" link in our footer (the last paragraph of this section says how far an opt-out reaches). To choose how ads are targeted to you across other sites too, use aboutads.info/choices or youronlinechoices.eu.
Microsoft Clarity is not one of the processors in section 5. Under Microsoft’s terms for Microsoft Clarity, we and Microsoft are each an independent controller of the personal data it collects on our site: each of us decides for itself how it uses that data. Microsoft also collects or receives what Microsoft Clarity records, and the Google Analytics visitor ID and session ID our tag container gives it, to provide Microsoft Advertising, and uses them for its own purposes, including improving its products and building profiles for advertising. The Microsoft Privacy Statement explains how Microsoft collects and uses your data.
When you are signed in, we keep your account’s consent choice on our server. It holds whether you accepted these cookies or opted out and, where we know it, how (the banner, the "Do Not Sell or Share" link, the "Opt back in" link or a Global Privacy Control signal from your browser), with the version of this notice in force when it reached us and when it reached us. It holds no IP address, no browser details and no browser ID. While you are signed out we keep nothing on our server: a choice made then stays in your browser until you sign in on it. Two essential cookies serve your choice. The af_consent cookie holds the choice itself in your browser for up to a year. The af_consent_ok cookie holds a scrambled code made from our ID for your account and the choice your browser holds, never the ID itself, and the day it was set, so your browser knows whether that choice has reached your account and never sends one already confirmed for another account. It lasts a year, and a signed-in browser that holds no opt-out checks your account’s choice again each day it is used.
Every page also loads its fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), for every visitor and before any consent choice, so your browser sends Google your IP address and browser details. Google provides Google Fonts as its own public service, not as one of our processors. Google Fonts sets no cookie.
Your choices depend on where you are. In the EEA, the UK, and Switzerland we ask for your consent before any analytics or advertising cookie is set, and none of them load until you accept; you can decline, and you can withdraw a consent at any time with the "Do Not Sell or Share My Personal Information" link in our footer, which works everywhere. Elsewhere (including the United States) these cookies run by default, and you can opt out at any time using that same link. We also honor the Global Privacy Control (GPC) browser signal as an opt-out everywhere. An opt-out (Decline, the "Do Not Sell or Share" link or a Global Privacy Control signal) made while you are signed in on app.adsfactory.ai follows your account. Once it reaches us, our server stops sending Meta anything about your later payments. Every browser you then sign in on stops loading the analytics and advertising tags, from the first page if our server can be reached when you sign in, otherwise from the next page that reaches it; one that was already signed in stops within a day. If an opt-out does not reach us at once, your browser sends it again each time it opens one of our pages while you are signed in. One made while you are signed out, including on our marketing site adsfactory.ai, which does not see your sign-in, applies only to that browser for as long as it keeps our cookie (up to a year). It is then sent to the next account that signs in on that browser, which records an opt-out but does not let an Accept sent this way undo an opt-out the account holds. A choice already confirmed for one account is never sent for another. We keep your account’s choice while the account exists. To opt back in, use the "Opt back in" link beside "Do Not Sell or Share" in our footer while you are signed in, or Accept where our banner asks: that replaces your account’s opt-out and turns the tags back on in that browser. Any other browser that holds an opt-out keeps it until you opt back in there too, and one whose opt-out never reached us still sends it to your account when you sign in there. A Global Privacy Control signal keeps the tags off in the browser that sends it, so opting back in there needs the signal turned off.
The Service is for businesses and is not directed to children under 16; we do not knowingly collect their data.
Material changes will be posted with a new effective date and notified in-product or by email. In the EEA, the UK, and Switzerland, a change with a new effective date asks again for your consent to analytics and advertising cookies.
AdsFactory is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc., Facebook, or Instagram. "Meta," "Facebook," and "Instagram" are trademarks of Meta Platforms, Inc. We use publicly available Meta Ad Library data in accordance with its public availability.