Adronis privacy policy

1. Who is responsible for your data

The controller of the personal data described here is [FULL NAME], a private individual resident in [CITY], Republic of Serbia, who operates Adronis as a freelancer. Adronis is not a registered company. More about who you are dealing with is on our terms page.

Data protection contact: privacy@adronis.app.

2. Two different roles

For your account, your billing data and your use of the product, we are the controller — we decide why and how that data is processed, and this policy describes it.

For personal data inside the material you upload — a face in a reference photo, a name in a brief, a customer detail in a note — we act as your processor: you decide what goes in, we process it to run the service for you. A data processing agreement on our standard terms covers that processing and is available at privacy@adronis.app.

3. What we collect

Account details: business name, owner name, email address, password (stored hashed by our authentication provider), city, vertical, website or social handle.
Business brief: what you sell, your typical customer, what makes you different, brand vibe, palette, things the engine should avoid.
Brand material you upload: reference photos, logos and other assets, which may contain images of people.
Channel connections: the access tokens needed to publish to the platforms you connect, and the account identifiers those platforms return.
Billing data: billing email, country, VAT identification number if you give one, plan, billing cycle, invoice history and payment status. Card numbers are handled entirely by Paddle — they are entered on Paddle's systems and we never receive or store them.
Product usage: which creatives you approve or kill, when, and the engagement metrics connected platforms report back.
Messages you send us: contact and support forms, including anything you choose to write in them.
Technical data: IP address, browser and device information, server and security logs generated when you use the site, and reports of errors the site runs into in your browser.

4. Why we process it, and on what legal basis

To provide the service — creating your account, rendering drops from your brief, publishing approved creatives, showing performance. Basis: performance of our contract with you.
To bill you and keep accounts — subscriptions, invoices, tax. Basis: performance of the contract, and legal obligation for tax and accounting records.
To support you — answering messages, investigating problems. Basis: performance of the contract, and our legitimate interest in running a supportable product.
To keep the service secure and working — logging, abuse prevention, debugging, backups. Basis: our legitimate interest in the security and integrity of the service.
To improve the engine — using aggregated, anonymised signals about output quality and performance. Basis: our legitimate interest in improving the product. We do not use your brand material to train generative models for other customers.
To send service emails — drop ready, approval reminders, billing and trial notices, changes to these documents. Basis: performance of the contract. Any purely promotional email is sent only with your consent and can be switched off at any time.
To meet legal obligations and defend legal claims. Basis: legal obligation, and our legitimate interest in establishing or defending claims.

We do not sell personal data, and we do not use it for automated decisions that produce legal or similarly significant effects for you.

5. Cookies and local storage

We use only what is strictly necessary to run the product: a session stored in your browser to keep you signed in, and storage for basic interface preferences. We do not use analytics, advertising or tracking cookies, and there are no third-party trackers on this site.

Our fonts and scripts are served from our own site, so opening a page does not send your IP address to Google or to any other font or script service.

On your first visit we ask you to confirm your choice, and we remember it in your browser. If we ever introduce analytics or any non-essential cookie, we will ask for your consent again and update this section before it is switched on.

6. Who else processes your data

We share personal data only with providers that help us run the service, under contracts that oblige them to protect it and to process it only on our instructions:

Supabase — database, authentication and file storage for the product.
Paddle.com — our online reseller and Merchant of Record: payment processing, subscriptions, invoicing and tax. Paddle acts as an independent controller for payment, tax and fraud-prevention purposes under its own privacy policy.
Vercel — website and application hosting, including request and security logs.
Generative model providers — the AI services that render creatives from your brief and reference material. A current list of the providers in use is available on request.
Email delivery provider — for service and account emails.
Platforms you connect yourself — Instagram, Facebook, TikTok, Google Business, LinkedIn, Pinterest. We exchange data with them to publish creatives you approved and to read back performance metrics. They handle that data under their own privacy policies, as independent controllers.

Two services get a small amount of data straight from your browser, under their own terms and privacy policies:

Open-Meteo — the weather forecast in your control room. Your browser sends it your business's town and, like any web request, your IP address; nothing else about you or your account.
Your browser's push service (Apple, Google or Mozilla, depending on your device) — only if you switch on notifications, to deliver them to your device. The message content is encrypted on its way through.

We may also disclose data where we are legally required to, or to establish or defend legal claims. If the business is ever sold or reorganised, data may transfer to the acquirer, and we will tell you before that happens.

An up-to-date list of subprocessors is available at privacy@adronis.app. Business customers with a signed data processing agreement receive notice of new subprocessors before they start.

7. International transfers

Some of the providers above are based outside the European Economic Area, including in the United States. Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses, on an adequacy decision where one applies, or on another lawful transfer mechanism, together with the additional safeguards our providers commit to. You can ask us for details of the mechanism used for a particular transfer.

8. How long we keep it

Account data, brand material and rendered creatives: while your account is active, plus 90 days after cancellation so you can reactivate. Deleted after that, or sooner if you ask.
Channel tokens: deleted when you disconnect the channel or close the account, whichever comes first.
Invoices and accounting records: kept for the period tax law requires, typically up to 10 years. These cannot be deleted on request while that obligation runs.
Contact and support messages: 24 months from the last message in the thread.
Server and security logs: up to 12 months.
Error reports from your browser: 30 days.
Backups: deleted data can persist in encrypted backups for up to 35 days before those backups expire.

9. Your rights

Subject to the conditions in applicable data protection law, you have the right to: get a copy of your data; correct it; delete it; restrict or object to processing, including processing based on our legitimate interests; receive it in a portable format; and withdraw a consent you gave, without affecting processing carried out before you withdrew it.

To exercise any of these, email privacy@adronis.app from the address on your account, or write through our contact page. We respond within one month, and will tell you if we need longer because a request is complex. We may ask you to confirm your identity before acting.

If you are unhappy with how we handled a request, you can complain to your data protection supervisory authority — in the EU, the authority of the country where you live or work, and in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection. We would rather hear from you first.

10. Security

Data is encrypted in transit with TLS and at rest by our infrastructure providers. Channel tokens and credentials are stored in restricted-access storage. Access to production data is limited to the people who need it to operate the rendering and publishing pipeline, and access is logged. We keep backups, use row-level access rules so that one account cannot read another's data, and review this as the product changes.

No system is perfectly secure. If a personal data breach occurs that is likely to present a risk, we notify the competent supervisory authority within 72 hours of becoming aware of it, and notify affected customers without undue delay where the law requires.

11. Children

Adronis is a business product and is not directed at children. We do not knowingly collect data from anyone under 18. Do not upload reference material depicting children unless you hold the permission of their parent or guardian for advertising use.

12. Changes to this policy

We email active accounts at least 14 days before a material change takes effect, and always update the date at the top of this page.

13. Contact

Privacy questions and data requests: privacy@adronis.app, or our contact page.