Privacy Policy
In accordance with Regulation (EU) 2016/679 (“GDPR”) and Romanian Law No. 190/2018 implementing the GDPR, the information below explains how we process your personal data when you use the Optimads platform and its subdomains/sections (the “Service”).
The date above indicates the last revision. We recommend checking this policy periodically.
1. Data Controller
| Name | FLAMINGO INDUSTRY SRL |
| Tax ID (CUI) | 46833688 |
| Trade Register No. | J20/1521/2022 |
| EUID | ROONRC.J20/1521/2022 |
| Privacy contact | contact@optimads.ai |
2. Who the Service is for
The Service is intended for adults (18+). We do not knowingly collect data about minors. If you register on behalf of a company, you confirm that you are authorized to represent it.
3. What data we process, for what purpose, and on what legal basis
Each processing activity has a legal basis (consent, performance of a contract, legitimate interest, or legal obligation).
3.1. Browsing and security
When you use the Service, we automatically collect technical identifiers (IP address, device identifier, metadata such as browser / HTTP headers) to prevent fraudulent use, detect and mitigate attacks (bots, DDoS), and maintain system security.
Basis: legitimate interest (system security and integrity).
3.2. User account
On registration we process: email and name (required); the password is stored encrypted (hashed) by our authentication provider. If you use federated login (e.g. Google), we receive your email, name and profile picture from that provider, with your consent.
Basis: performance of the contract (providing the Service).
3.3. Platform connections (OAuth tokens)
When you connect an advertising account (Meta), a store (Shopify) or other platforms, we securely store the necessary access tokens. They are never displayed in the interface, never written to logs, and never shared with third parties.
Basis: performance of the contract.
3.4. Advertising and store data
Through the connected platforms' APIs we process data about campaigns, ad sets, ads, audiences and statistics (spend, impressions, clicks, conversions, ROAS), and — for Shopify — aggregated financial information about orders (total value, number of orders) needed to compute profitability. We do not collect personal data of the store's buyers (name, email, address) unless strictly necessary and permitted.
Basis: performance of the contract. (See also section 4 on our role as a processor.)
3.5. Artificial intelligence features
When you use the AI features (the in-app assistant, creative generation), the content you input (text, images) is sent to our AI providers (e.g. Anthropic, Google) acting as sub-processors, solely to deliver the requested result. We do not use your data to train our own or third parties' AI models.
Basis: performance of the contract and legitimate interest (improving the Service).
3.6. Communications (support and marketing)
When you contact us for support, we process the data needed to respond, based on your request. We may send you communications about the Service (legitimate interest) or marketing communications (if you are a customer or have given consent); you can unsubscribe at any time.
3.7. Data from Google (Google Ads and Google Drive)
If you connect a Google Ads account, we process data about your campaigns (spend, impressions, clicks, conversions) to show you reports and manage your ads. If you use the Google Drive import, we access only the files (images/videos) you select, solely to upload them as creatives into campaigns.
Optimads' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: we do not use Google data for personalized/retargeted advertising, we do not sell it or share it with data brokers, we do not use it for credit decisions, and we do not use it to train AI models.
Legal basis: performance of the contract.
3.8. Alerts and the phone assistant (WhatsApp, Telegram)
If you choose to connect WhatsApp or Telegram (from Settings or during account onboarding), we process: your phone number and WhatsApp profile name, or your Telegram chat identifier and username (or first name, if you have no username); the time you connected and the time of your last message to us (WhatsApp only allows free-form messages within 24 hours of your last message); the team member who connected the number; the messages you send us and the alerts we send you. If you are a member of a team, the account owner sees the number you connected, and other teammates see it partially masked.
Purpose: to send you the campaign alerts and reports you choose, important account notifications (for example expired connections or failed payments), and to let the Finny assistant answer you. To answer, we send our AI provider (Anthropic) your question, the latest messages of the conversation and the data of the account it refers to (campaigns, store figures, business profile and targets from onboarding), as with the in-app assistant (section 3.5). Messages travel through the WhatsApp Business Platform (Meta) or through Telegram. We do not keep the content of your conversations with the assistant in our database: the latest messages are held only in the server's temporary memory, for context, and are lost on restart. We keep only a technical record: the time of the messages, a fingerprint (hash) of each message identifier and the tokens used. We do not use your number for marketing and we do not sell it.
If you write to us on WhatsApp without having connected an account, we reply automatically, at most once a day, with the steps to connect. For this we keep only a fingerprint (hash) of your number, for at most 30 days; we do not keep the content of your message.
You can stop at any time: send STOP on WhatsApp or Telegram, or disconnect the number in Settings (the “Data and alerts” section).
Basis: performance of the contract — it is an optional feature that you turn on yourself. Connecting also means you agree to receive messages from us on WhatsApp or Telegram; you can withdraw at any time (STOP or in Settings) without affecting the rest of your account. The record of the team member who connected the number: our legitimate interest in managing access to your account.
4. Our role: controller vs. processor (important for business customers)
For your own account data (email, name) we are the controller. For the data you bring through your clients' accounts/stores (advertising data, orders), you (or the agency) are the controller, and we act as a processor, processing data only per your instructions and these terms. The Data Processing Agreement (DPA) is part of the Terms and applies automatically; for a signed copy, write to us at the contact address.
5. Providers and sub-processors
We use trusted providers that process data strictly to provide us their services, under contract and confidentiality:
- Meta Platforms — campaign management (Facebook/Instagram Ads) and delivery of alerts and assistant messages on WhatsApp (WhatsApp Business Platform), if you connect it;
- TikTok — TikTok Ads campaign management;
- Shopify, WooCommerce — reading order data for profitability;
- Google — Google Ads (campaign data) and Google Drive (importing creative files you select);
- Supabase — database and authentication;
- CyberFolks (our own VPS server, in the EU) — hosting;
- Anthropic, OpenAI, Google, fal.ai, xAI — artificial intelligence features (assistant, copy, creatives, video);
- Stripe — payment processing (we do not store card data).
Telegram, if you choose to connect it, delivers your alerts and assistant messages as an independent controller, under its own privacy policy; it is not our sub-processor.
We do not sell or rent your personal data. You can request the updated list of providers at the contact address.
6. International transfers
Some providers process data outside the European Economic Area (for example in the USA: Meta, Google, Anthropic, OpenAI, xAI, fal.ai, Stripe). The transfer is based on the EU–US adequacy decision (EU-U.S. Data Privacy Framework) where the provider is certified, or on the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
7. How long we keep data
- Security / anti-fraud: technical identifiers, up to ~13 months.
- Account and contractual relationship: for the lifetime of the account, then blocked until the limitation periods expire (generally 5 years; 6 years for accounting documents).
- Connection tokens: until you disconnect the platform or delete the account — then deleted.
- WhatsApp / Telegram connections: the number or identifier, profile name, and the time you connected and last wrote to us — until you disconnect them (in Settings or with STOP) or ask us to delete your account (we delete them within 30 days of the request). Technical record of messages (identifier fingerprint, time): at most 30 days. A copy of the alerts and reports we send stays in the app (Autopilot section) for the lifetime of the account. The content of conversations with the assistant is not kept in our database.
- AI inputs (images/audio): deleted immediately/shortly after the result is generated; results remain for as long as you have a relationship with us or until you delete them. AI sub-processors retain data for at most the period needed to deliver the service.
- Marketing communications: until you unsubscribe or object.
- Legal obligations: for the period required by law.
8. Security
We use encryption in transit (SSL/HTTPS) and at rest, access control, per-account data isolation, and we never expose access tokens in the interface or in logs.
9. Your rights (GDPR)
You have the right to: information, access, rectification, erasure (“the right to be forgotten”), restriction, portability, objection, withdrawal of consent, and the right not to be subject to automated decision-making with significant effects. You can exercise them by writing to contact@optimads.ai. We may ask you to verify your identity before acting on the request.
Note: deleting data from your account does not automatically delete it from the platforms that authenticate your identity (e.g. Google) — for those, contact that platform directly.
Deleting data obtained through Facebook/Meta: you can remove your connection token and associated accounts at any time, either from the app (Settings → Connections → Disconnect Meta) or by removing the Optimads app from your Facebook settings (Apps and Websites) — in which case Facebook notifies us automatically and we delete the data. Details and steps: Data Deletion page.
10. Complaints
You can lodge a complaint with us or with the supervisory authority — in Romania, ANSPDCP (the National Supervisory Authority for Personal Data Processing), dataprotection.ro.
11. Keeping data up to date
Please notify us of any change to your data, so that the information in our systems remains correct and current. You declare that the data provided is accurate and true.
12. Cookies
We use only strictly necessary cookies / local storage for authentication and platform functionality. We do not use third-party advertising cookies in the Platform.
13. Changes
We may update this policy. The current version is always available at this address, with the date of the last update.
14. Contact
FLAMINGO INDUSTRY SRL — contact@optimads.ai
© 2026 FLAMINGO INDUSTRY SRL. All rights reserved. · Terms & Conditions