Privacy policy

Who we are

Happyads is a service operated by Oaksmond ApS, CVR 43117785, Hovborgvej 1, 6623 Vorbasse, Denmark.

There are two halves to the data here, and they are not governed the same way. Reading them as one is the mistake that makes a data processing agreement look unnecessary.

We are the data controller

For your own account and sign-in, the workspace, your billing details, your acceptances, the waiting list, the abuse limits, and anything you write to us. We decide why and how we hold those, and the rest of this page explains it.

You are the data controller, we are your processor

For the personal data inside your advertising: the images you upload, the text you write in the campaign builder, and the figures attached to your own ad accounts and campaigns. It is your data about your own business, we only handle it on your instruction, and the data processing agreement sets out what that instruction is. It is linked at the bottom of this page.

Either way you can reach us at privacy@happyads.so, and we answer.

What we collect

Only what the product needs to work. Grouped by why it exists rather than by where it is stored.

Your account

Your email address. You normally sign in with a one-time link we email you; some accounts, Meta's reviewer among them, are given a password instead. Passwords are handled by our authentication provider, which stores a hash: we never see the password itself. A workspace is created for you automatically and named after the domain part of your email.

Your Meta connection

When you connect a Meta account we store your Meta user ID, an access token, when that token expires, which permissions you granted, and whether the connection is currently working. The token is encrypted before it is written down.

Your ad accounts

For each ad account you connect: its Meta ID, name, currency, status, the conversion action you pick, and when we last synced it.

Your campaign drafts

Every choice you make in the campaign builder: the goal, the conversion event, the audience (an age range and a country), the budget, and how the creatives are set up, each of them stored next to the framework's own recommendation and the reason for it, so the review step can show you both. The draft also holds what you write yourself: the ad text, the headline, the link you send traffic to and the button you pick. Once the campaign is created, the IDs Meta gives back are written on the same draft.

The images you upload

Ad images are stored in a private bucket of ours (JPEG or PNG, up to 8 MB each) on a path that begins with your workspace, and no other customer can read them: a signed-in session can only reach paths under its own workspace, and our server only reads an image or issues a link to one after checking its path against the workspace you are signed in to. We read the width, height, type and size to check the file, and nothing else about what is in it. The file itself is sent to Meta when you create the campaign.

Your sender

The Facebook Page your ads are shown as: its Meta ID, its name so we can show it without asking Meta again on every screen, and the ID of the Instagram account linked to it when there is one.

Performance figures

Per campaign, per day: spend, impressions, clicks, conversions, conversion value, frequency, CTR and CPM. Plus the name, ID and status of every campaign, ad set and ad, so the figures can be shown against the right names. Plus any revenue figures you enter yourself, so we can compare them against spend.

Your billing details

The company name, address and VAT number that go on your invoices, the address we send them to, and the record of what has been invoiced and paid. Plus the customer and subscription identifiers our payment provider gives us. We never see or store your card number: you type it into the payment provider's own fields, and an identifier is what comes back to us.

Your acceptances

Which agreement you accepted, which version of it and a fingerprint of its text, the name of your workspace, which user clicked and the email address they were signed in with, and when. We keep it because an agreement nobody can show the version of is not much of an agreement.

The waiting list

If you gave us your address for early access, that address is what we store. Nothing else: no name, no company, no tracking of how you got here.

Abuse limits

So that one person cannot flood the waiting list for everyone else, we store your IP address as part of the rate-limit key for up to a day; a daily clean-up deletes it, and no one can read it from a browser.

What we deliberately do not collect

This is the part most worth reading, because it is a design decision rather than a promise about the future.

• We do not pull audience lists, custom audiences or customer lists out of your Meta account.
• We do not pull lead data, form submissions or messages.
• We read the list of Facebook Pages you may advertise for, so you can pick which one your ads are sent as. We read the Page's ID, its name and whether an Instagram account is linked to it, and not its posts, its comments, its messages, its followers or its own statistics.
• We hold no personal data about the people who see or click your ads. Everything we read back is already aggregated into counts and sums by Meta before it reaches us.
• We run no analytics, advertising or third-party tracking scripts on this site. There is no cookie banner because there is nothing to consent to.

What we write into your ad account

The connection goes both ways, so it is worth saying plainly what the writing half does.

• When you finish the campaign builder we create, in the ad account you picked: one campaign, its ad sets, your images, one ad creative per ad, and the ads themselves.
• All of it is created paused. A paused campaign spends nothing, so a half-finished or abandoned build cannot cost you money.
• Turning it on is one action, behind a confirmation you have to accept: it sets that campaign, its ad sets and its ads to active. It is the only thing in the product that can make Meta spend your budget, and it lives in one file that nothing else in the code duplicates.
• We do not change, pause or delete campaigns Happyads did not build. Everything that was already in the account is read only.

What we send is what you entered: your ad text, your headline, your link, the button you chose, your images, and the settings the framework arrived at. Once it is in your ad account it is yours, and it stays there whether or not you keep using Happyads.

Why we are allowed to hold it

Performance of a contract (GDPR art. 6(1)(b))

Your account, your Meta connection, your ad accounts, your campaign drafts, the images you upload, the performance figures, your billing details and your acceptances. Without these the service cannot do the thing you asked it to do, and we cannot invoice you for it.

Legal obligation (GDPR art. 6(1)(c))

Invoices and the accounting records behind them. Danish bookkeeping law requires us to keep them for five years from the end of the financial year they belong to, so we cannot delete them earlier even if you ask us to.

Legitimate interest (GDPR art. 6(1)(f))

Your acceptances, once the agreement has ended. While you are a customer they are part of the contract. Afterwards we keep them for five years so that either of us can show what was agreed if there is ever a disagreement about it.

Consent (GDPR art. 6(1)(a))

The waiting list. You gave us the address so we could write to you about early access, and you can withdraw that at any time by asking.

Where it lives, and who else touches it

Four, and no others. We do not sell data, and we do not share it for anyone else's marketing.

Supabase

Database, file storage and authentication. Your data, the images included, is stored in the EU (eu-central-1, Frankfurt).

Vercel

Hosting for the website and the API. Requests may be routed via infrastructure outside the EU.

Meta Platforms

Both the source of the advertising data and where the campaigns you build end up. Figures flow from Meta to us under the permissions you grant, and stop the moment you revoke them. Your ad text, your link and your images flow the other way when you create a campaign, and are covered by Meta's own terms from then on. What has already been created stays in your ad account either way: it is yours.

Stripe

Payments and card details, when you pay by card. Your card number goes to Stripe and never to us; we hold the customer and subscription identifiers Stripe gives back. Stripe is its own controller for what it does to prevent fraud and to meet the rules that apply to a payment institution.

The list cannot change quietly. Before we add or replace a processor that handles data you are the controller of, we write to you at least 30 days in advance, and you can object. The full obligation, including what happens if you object, is in the data processing agreement.

How the Meta token is protected

The access token is the most sensitive thing we hold, because it is the key to your ad account. It is encrypted with AES-256-GCM before it is written to the database, using a key that lives only in the server environment and never in the database itself. Each token gets its own random initialisation vector, and the payload is authenticated, so a tampered value fails to decrypt rather than decrypting to something wrong.

The token is never shown in the interface, never sent to your browser, and never passed to a third party. If you revoke Happyads from inside Meta, the token stops working immediately regardless of what we hold.

How long we keep it

For as long as you have a workspace. A workspace whose subscription has ended stays in read access for 90 days and is then deleted. We write to you once, at least 14 days before that day, and say which day it is; you can also ask us to delete it sooner. When a workspace is deleted, everything attached to it in the database (connections, ad accounts, campaigns, daily figures and campaign drafts) is deleted with it in the same operation. Waiting list addresses are kept until you ask us to remove yours.

The images sit in storage rather than in the database, so that one operation does not reach them: we delete them as part of the same request, by hand, until deletion is self-service. Nothing expires them on a timer. An image belonging to a campaign that was actually created is kept on purpose, so you can build on it again rather than upload it twice.

Two things outlive the workspace. Invoices and the accounting records behind them are kept for five years from the end of the financial year they belong to, because Danish bookkeeping law says so. Your acceptances of the terms and the data processing agreement are kept for five years after the agreement ends, which is the day your workspace is deleted, and are then deleted. In the meantime they are detached from the workspace: we can read them, and no other customer can.

See the data deletion page for how to trigger any of this.

Cookies

One cookie, set by our authentication provider, which keeps you logged in. It is necessary for the service to work and is not used to track you.

Your light or dark theme preference is stored in your browser's local storage. It never leaves your device and never reaches us.

Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to receive it in a portable format, to restrict what we do with it, or to object to it. Write to us and we will answer within 30 days.

If you think we have handled your data badly, you can complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk.

Changes

If we change this policy in a way that affects what we collect or who we share it with, we will say so on this page and change the date at the top. We will not quietly broaden it.

Contact

Oaksmond ApS, Hovborgvej 1, 6623 Vorbasse, Denmark. privacy@happyads.so.