Privacy policy

Who we are

Happyads is a service operated by Oaksmond ApS, CVR 43117785, Hovborgvej 1, 6623 Vorbasse, Denmark.

We are the data controller for the personal data described on this page. You can reach us at privacy@happyads.so.

What we collect

Only what the product needs to work. Grouped by why it exists rather than by where it is stored.

Your account

Your email address and a password, handled by our authentication provider — we never see the password itself, only a hash. A workspace is created for you automatically and named after the domain part of your email.

Your Meta connection

When you connect a Meta account we store your Meta user ID, an access token, when that token expires, which permissions you granted, and whether the connection is currently working. The token is encrypted before it is written down.

Your ad accounts

For each ad account you connect: its Meta ID, name, currency, status, the conversion action you pick, and when we last synced it.

Performance figures

Per campaign, ad set and ad, per day: spend, impressions, clicks, conversions, conversion value, frequency, CTR and CPM. Plus any revenue figures you enter yourself, so we can compare them against spend.

The waiting list

If you sign up for early access we store your email address. Nothing else — no name, no company, no tracking of how you got here.

What we deliberately do not collect

This is the part most worth reading, because it is a design decision rather than a promise about the future.

• We do not pull audience lists, custom audiences or customer lists out of your Meta account.
• We do not pull lead data, form submissions or messages.
• We hold no personal data about the people who see or click your ads. Everything we read back is already aggregated into counts and sums by Meta before it reaches us.
• We run no analytics, advertising or third-party tracking scripts on this site. There is no cookie banner because there is nothing to consent to.

Why we are allowed to hold it

Performance of a contract (GDPR art. 6(1)(b))

Your account, your Meta connection, your ad accounts and the performance figures. Without these the service cannot do the thing you asked it to do.

Consent (GDPR art. 6(1)(a))

The waiting list. You gave us the address to be told when we launch, and you can withdraw that at any time by asking.

Where it lives, and who else touches it

We use three processors and no others. We do not sell data, and we do not share it for anyone else's marketing.

Supabase

Database and authentication. Your data is stored in the EU (eu-central-1, Frankfurt).

Vercel

Hosting for the website and the API. Requests may be routed via infrastructure outside the EU.

Meta Platforms

The source of the advertising data. Data flows from Meta to us under the permissions you grant, and stops the moment you revoke them.

How the Meta token is protected

The access token is the most sensitive thing we hold, because it is the key to your ad account. It is encrypted with AES-256-GCM before it is written to the database, using a key that lives only in the server environment and never in the database itself. Each token gets its own random initialisation vector, and the payload is authenticated, so a tampered value fails to decrypt rather than decrypting to something wrong.

The token is never shown in the interface, never sent to your browser, and never passed to a third party. If you revoke Happyads from inside Meta, the token stops working immediately regardless of what we hold.

How long we keep it

For as long as you have an account. When your workspace is deleted, everything attached to it — connections, ad accounts, campaigns and daily figures — is deleted with it in the same operation. Waiting list addresses are kept until we launch or until you ask us to remove yours.

See the data deletion page for how to trigger any of this.

Cookies

One cookie, set by our authentication provider, which keeps you logged in. It is necessary for the service to work and is not used to track you.

Your light or dark theme preference is stored in your browser's local storage. It never leaves your device and never reaches us.

Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to receive it in a portable format, to restrict what we do with it, or to object to it. Write to us and we will answer within 30 days.

If you think we have handled your data badly, you can complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk.

Changes

If we change this policy in a way that affects what we collect or who we share it with, we will say so on this page and change the date at the top. We will not quietly broaden it.

Contact

Oaksmond ApS, Hovborgvej 1, 6623 Vorbasse, Denmark. privacy@happyads.so.