Privacy Policy
What we collect, why we have it, who else sees it, and how to get it deleted.
Last updated 24 August 2026
Who we are
GTM/ADS is a media-planning service operated by Serverkongen v/Claus Flø, organisation number 932 530 228, Teisenveien 43, 0666 Oslo, Norway. We are the data controller for the personal data described here.
Privacy questions and deletion requests: claus.flo@hotmail.com.
What we collect
What you type into the brief
- Your email address — so we can send you the link to your plan.
- What you're advertising, your website, who your customer is, your market, your monthly budget, your goal, and which channels you want.
Only the email address is personal data about you. The rest describes your business — but if you write personal details into a free-text field, they're stored along with it, so please don't.
Files you upload
Images and video you upload as ad creative. If those files show identifiable people, that's personal data about them, and you need a lawful basis for giving it to us and for advertising with it.
If you connect Meta
Connecting is optional — you get a media plan whether or not you do. If you connect, we receive and store:
- An access token for your Meta account, held server-side only. It is never sent to your browser.
- The name on the connected Meta account, shown in the form so you can tell whose login is active.
- The list of ad accounts and Facebook Pages that login can reach, plus whichever you select.
The token carries the permissions you granted at Meta's consent screen — reading your ad accounts and Pages, and creating campaigns. Everything we create is created paused. We do not activate campaigns, change account settings, or delete anything.
Your conversation with the setup agent
The chat used to build campaigns is stored in full, including the automated lookups the agent performs against your ad account. This is what lets you close the tab and pick the thread back up.
What we don't do
No analytics, no advertising pixels, no third-party trackers, and no cookies on this site. We don't profile you and we make no automated decisions with legal or similarly significant effects about you. The only thing stored in your browser is what you type before you submit it.
Why we're allowed to hold it (GDPR Article 6)
| Data | Purpose | Legal basis |
|---|---|---|
| Brief, uploads, generated plan | Producing the media plan you asked for | Performance of a contract |
| Email address | Sending you the link to your plan | Performance of a contract |
| Meta token, ad account and Page | Setting up the campaigns you asked us to set up | Consent, given at Meta's consent screen — withdrawable at any time |
| Chat history | Keeping the setup session usable across visits | Performance of a contract |
| Server logs | Keeping the service running and secure | Legitimate interests |
Who else processes it
We don't sell your data or share it for anyone else's marketing. We do use these processors to run the service:
| Processor | What it handles | Where |
|---|---|---|
| Supabase | Database and file storage | EU (Stockholm) |
| Netlify | Website hosting and server functions | Global CDN, US company |
| Anthropic | Your brief and chat are sent to the Claude API to generate the plan and run the setup agent | US |
| Meta Platforms | Reading your ad accounts and Pages, creating paused campaigns — only if you connect | US / global |
| Resend | Sending the one email with your plan link | US |
Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
Two things you should know about how links and files work
Your plan link is the key to your plan. Each plan lives at a long, random,
unguessable URL (/?t=…). We do this so you don't need an account — but it means
anyone you forward that link to can see the plan, the uploaded creative, and the setup
conversation. Treat it like a password.
Uploaded files are served from a public bucket. Creative you upload sits at its own long, random URL that requires no login. It isn't listed or indexed anywhere, but anyone holding the exact URL can open it. Don't upload anything you'd be unwilling to have seen by someone who obtained the link.
How long we keep it
We keep your brief, plan, uploads, and chat history for as long as your plan link is meant to work — there is no automatic expiry, so in practice we hold it until you ask us to delete it. Ask, and we'll remove it.
Your Meta token is kept until it expires or is replaced by a new connection. Disconnecting the app at Meta revokes it immediately at their end.
Your rights
Under the GDPR you can ask us for a copy of your data, correct it, delete it, get it in a portable format, restrict or object to how we use it, and withdraw any consent you gave. Withdrawing consent doesn't undo processing that already happened lawfully.
Email claus.flo@hotmail.com and we'll respond within 30 days. Please include your plan link if you have one — without it we may not be able to find your data.
Deleting your data
Email claus.flo@hotmail.com with the subject Delete my data and your plan link. We'll delete your brief, plan, uploaded files, chat history, and any stored Meta connection.
To cut off Meta access yourself without waiting for us, remove the app under Facebook → Settings & Privacy → Settings → Business Integrations. That revokes our token immediately.
Complaints
If you think we've handled your data badly, please tell us first. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority where you live.
Security
Data is encrypted in transit. Database access runs through row-level security, and credentials — including your Meta token — are held server-side and never exposed to the browser. No system is perfectly secure, so please read the note above about plan links and uploaded files, which are protected by the secrecy of their URLs rather than by a login.
Children
This is a business tool and isn't intended for anyone under 16. We don't knowingly collect their data.
Changes
If we change this policy we'll update the date at the top. Material changes affecting data you've already given us will be emailed to you where we have your address.