Privacy Policy

How VIZIUNE GRAFICA SRL collects and uses personal data when you visit or use Adplex, who helps us, how long we keep it, and how to exercise your rights under the GDPR.

At a glance

Exact quotes from the text below

  • Card numbers

    “Full card numbers go to Stripe only and never reach our servers.”

    Read point 3.1
  • Chrome extension

    “It does not read the content of the page, your browsing history, or any other site.”

    Read point 7.1
  • Account closure

    “When you close your account, we delete your data within a reasonable time, normally within 30 days, except what we must keep by law.”

    Read point 11.1
  • Your requests

    “We answer within one month, and may ask you to confirm your identity first.”

    Read point 12.2

1. Who is responsible

The controller of the personal data described in this policy is VIZIUNE GRAFICA SRL ("we", "us"):

VIZIUNE GRAFICA SRL, a limited liability company registered in Romania · Registered office: 2 Aleea Botorani, Sector 5, 050814 Bucharest, Romania · Trade Register no.: J40/598/2015 · Fiscal code (CUI): 29194835 · EUID: ROONRC.J40/598/2015 · Email: [email protected]

For anything about privacy, including exercising your rights, write to [email protected]. We have not appointed a data protection officer because we are not required to; the address above reaches the people responsible.

2. Our two roles: controller and processor

We are the controller for data about the people who visit our site, create accounts, pay us or contact us. This policy describes that processing.
We are a processor for personal data that our customers put into Adplex for their own business. Examples: leads collected by their lead-generation ads, people shown in their photos or videos, customer data inside their product feeds, or data in the ad accounts they connect. Our customer is the controller of that data and decides why it is processed. We process it only to provide the service, under Article 28 GDPR, as set out in our Terms of Service. If your data is in a customer's project, please contact that business first; we will help them answer you.

3. What we collect

CategoryExamplesSource
Account dataEmail address, password (stored only as a secure hash), name if given, projects you belong to, role (owner / member), invitationsYou, or the teammate who invited you
Billing dataPlan, billing interval, credit balance and history, invoices, billing name and address, VAT number, the last digits and brand of your cardYou and Stripe. Full card numbers go to Stripe only and never reach our servers.
Connected-platform dataAccess tokens for Meta, Google, TikTok and similar (stored encrypted); ad-account, page, pixel and catalog identifiers and names; campaign, ad and performance data you ask us to readThe platform, after you authorise it
Content you work withUploaded images, videos and fonts, brand kits, product feeds, prompts, generated output, rules, ad copyYou and your team
Usage and technical dataIP address, browser and device information, pages and features used, error and security logs, timestamps of logins and actionsYour browser and our servers
CommunicationsSupport requests and emails you send usYou
Referral dataThe referral code you arrived with, if you came through a partner's linkA cookie set when you open a referral link (see the Cookie Policy)

We don't ask for special categories of data (health, religion, and so on), and we ask you not to upload them. The service is not intended for anyone under 18.

4. Why we use it, and on what legal basis

PurposeLegal basis (GDPR art. 6)
Creating your account and providing the service, including running the AI generation, publishing and automations you requestPerformance of our contract with you (6(1)(b))
Taking payments, issuing invoices, keeping accounting recordsContract (6(1)(b)) and legal obligation under Romanian tax and accounting law (6(1)(c))
Service emails: password resets, invitations, billing notices, important changesContract (6(1)(b))
Keeping the service secure: preventing fraud, abuse and free-credit farming, investigating incidentsLegitimate interests (6(1)(f)) in protecting our service and customers
Improving the service, using aggregated usage statisticsLegitimate interests (6(1)(f))
Attributing a sign-up to a referral partner, and paying that partner's commissionLegitimate interests (6(1)(f)) in running our partner programme
Product news and marketing emailsYour consent (6(1)(a)), which you can withdraw at any time. We send none without it.
Responding to legal claims and requests from authoritiesLegal obligation (6(1)(c)) and legitimate interests (6(1)(f))

Where we rely on legitimate interests, you can object, as described in "Your rights" below. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Google user data

If you connect a Google account (Google Ads, Analytics, Merchant Center, Drive), we access only the data needed for the features you use, for example reading reports or catalogs and creating or changing campaigns on your instruction.

Adplex's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, we don't let humans read it except with your permission, for security, or to comply with law, and we don't use it to train AI models.

6. Meta (Facebook / Instagram) data

If you connect Meta, we receive an access token and the data needed for the features you use: your ad accounts, pages, pixels, catalogs, campaigns, ads, posts you choose to boost, and their performance data. We use it only to provide those features to you. You can disconnect in the project's settings, or remove Adplex in Facebook under Settings & privacy → Settings → Business integrations. To delete the data, see "Deleting your data" below.

7. The Adplex Chrome extension

The optional "Adplex for Meta Ads Manager" Chrome extension runs only on Meta Ads Manager pages (adsmanager.facebook.com and business.facebook.com/adsmanager). It reads the ad account id and ad id from the address of the ad you have open, and sends only those two numbers to Adplex so we can show which catalog image or video that ad uses and, when you click Apply, change it through Meta's API with your project's Meta connection. It does not read the content of the page, your browsing history, or any other site.

Signing in uses a one-time code: the extension keeps a short-lived access token (valid one hour) in your browser's session memory, cleared when the browser closes. It stores no password and no long-lived token. You only see projects you can open in Adplex. Disconnect from the extension's menu at any time; this revokes its access immediately. The extension sends nothing to anyone other than Adplex, and the data it handles is used only for this feature, never for advertising, never sold, and never used to determine creditworthiness.

8. AI processing

When you run an AI feature, we send the inputs that task needs to the AI provider that performs it: the prompt, the reference images, the product data, and the script to be voiced. The provider processes them to return the result. We don't use your content to train AI models. Where a provider offers it, we use API terms under which inputs are not used to train the provider's models.

9. Who we share data with

We don't sell personal data. We share it only with providers that help us run the service, under contracts that require them to protect it, and with the platforms you choose to connect:

WhoWhat forWhere
Hosting and infrastructure providersServers, database and file storage; content delivery and protection against attacksEU, with a global delivery network
Payment processorPayments, subscriptions, invoices and tax calculationEU / US
AI service providersGenerating the images, videos, voice-overs and text you ask for. Each request carries only what that generation needsUS / EU
Image optimisation serviceCompressing images before they are storedEU
Email delivery providerSending service emailsEU / US
Invoicing and accounting providersIssuing invoices and meeting Romanian tax obligationsRomania
Platforms you connect, such as Meta, Google or TikTokOnly if you connect them: the actions and data exchanges you ask forTheir own terms apply

We keep an up-to-date list of the individual providers we use. If you need it, for example for your own data protection records, ask us at [email protected] and we will send it.

We may also disclose data to authorities or courts when the law requires it, to professional advisers bound by confidentiality, or to a buyer of our business, which would be bound by this policy.

10. Transfers outside the EU

Some of the providers above are based in the United States. Where data leaves the European Economic Area, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework for certified providers, or on the Commission's Standard Contractual Clauses, together with the additional measures they require. You can ask us for a copy of the relevant safeguards at [email protected].

11. How long we keep data

Account and content data: while your account is open. A deleted project is removed after a recovery window (currently 72 hours). When you close your account, we delete your data within a reasonable time, normally within 30 days, except what we must keep by law.
Connected-platform tokens: until you disconnect the platform, the token expires, or the account is closed.
Invoices and accounting records: for the period Romanian tax and accounting law requires, generally up to 10 years.
Security and application logs: for a limited period, then deleted or anonymised.
Backups: overwritten on a rolling basis, so deleted data disappears from backups after a short period.

12. Your rights

Under the GDPR you have the right to:

  • access your data and receive a copy;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict how we process it;
  • receive data you gave us in a portable format;
  • object to processing based on legitimate interests, and at any time to direct marketing;
  • withdraw consent at any time, without affecting earlier processing.

Write to [email protected]. We answer within one month, and may ask you to confirm your identity first.

You can also complain to the Romanian supervisory authority, ANSPDCP (B-dul G-ral. Gheorghe Magheru 28-30, Bucharest), or to the authority in the EU country where you live or work.

13. Deleting your data

To delete your account and the data associated with it, including data received from Meta or Google:

  1. Disconnect the platform in Adplex (project settings → connections). This deletes the stored access token.
  2. Delete the project, or email [email protected] from your account address with the subject "Delete my account". We confirm by email when it is done.

You can also remove Adplex's access in the platform itself: on Facebook, under Settings & privacy → Settings → Business integrations; on Google, at myaccount.google.com/permissions.

Invoices and other records we must keep by law are retained for the legal period and then deleted.

14. Security

We protect data with encryption in transit (HTTPS), encrypted storage of platform tokens, hashed passwords, access controls that keep each project's data separate, and restricted administrative access. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the authority and, where required, you.

15. Changes to this policy

We may update this policy when our service or the law changes. We will tell you in the app or by email about material changes before they apply. The version and effective date are shown at the top of the page.