Privacy Policy

1. Data We Collect

We collect personal data including your name, email address, social media account information (via OAuth with your consent), financial information (processed by Stripe), and usage data (cookies, IP addresses, device information).

2. How We Use Your Data

We use your data to:

Provide the Adswish marketplace and payment-hold services
Track attribution for affiliate and hybrid campaigns
Run required outside-in uptime checks on your verified public domain
Process payments and payouts via Stripe (billed in pounds sterling, GBP)
Prevent fraud and enforce platform policies
Send transactional emails and notifications

We use cookies for attribution tracking and analytics. Attribution cookies are dropped by the business's own tracking setup (the Chrome extension, the desktop tracker, or a legacy installed script) and only after explicit user consent — if consent is not given, tracking runs in analytics-only mode. Consent is logged with timestamp, consent version, IP hash, and user agent.

What we store on your device. The consent decision itself is kept in your browser's local storage (adswish_cookie_consent) so we do not have to ask on every visit. Signed-in dashboard preferences are stored the same way (appearance settings, session-timeout preference, campaign-wizard drafts, and the business tracker's liveness history). None of these are used for tracking.

Analytics session identifier. If — and only if — you allow analytics cookies, first-party telemetry generates a random session ID (held in session storage, adswish_session_id) to group page views into a visit. Decline analytics and this identifier is never created and nothing is transmitted.

Withdrawing consent. Use the “Cookie choices” link in the site footer (or clear this site's data in your browser): your stored decision is erased, the banner reappears, and analytics capture stops immediately. Withdrawing is as easy as giving consent, as UK GDPR requires. Your earlier choices remain in our consent log as evidence that consent was — and that it was withdrawn.

Consent evidence. Every banner choice is recorded in our consent log as evidence that we obtained valid consent: timestamp, consent version, the choice made (accept-all vs saved choices), a hashed IP address, user agent, and — for visitors without an account — a hashed random device identifier generated at consent time. The device identifier is stored only as a one-way SHA-256 hash; we cannot reverse it to identify you, and it is used solely to evidence the consent decision.

The desktop tracker keeps a heartbeat alive by sending a small, unauthenticated ping (business identifier + timestamp) every 60 seconds while it runs; it never uploads your browsing history or screen contents.

Clipboard capture is opt-in — the app only reads the clipboard when you ask it to capture a pasted Adswish link.

4. Data Controller & Processor

For personal data on the Adswish platform itself, the data controller is the sole-trader operator of the “Adswish” trading name, contactable at hello@adswish.co.uk. Adswish is not a limited company.

For the tracking of their own site visitors, the business is the data controller and Adswish is the processor: we provide the tracking mechanism but do not assume legal coverage for the business's consent flow.

5. Data Retention

Personal data is retained for 7 years after account closure for financial record-keeping, then anonymized. Marketing/analytics data is retained for 2 years.

Click-tracking data. When someone clicks a creator's tracking link we log the click with a hashed IP address and hashed user agent (never the raw values). Click log data older than 90 days is archived to cold storage and dropped from the active database.

Consent records. Cookie-banner choices (including the hashed device identifier described in section 3) are kept for 2 years as evidence that valid consent was obtained, in line with the ICO's expectation that consent records outlive the consent itself. Analytics session identifiers live only in your browser for the duration of a browsing session and are never stored by us.

Under GDPR, you have the right to:

Access your personal data
Rectify inaccurate data
Request erasure (“right to be forgotten”)
Export your data (Article 20) in machine-readable JSON format
Object to processing of your data

To exercise these rights, contact hello@adswish.co.uk or by post (address available on request by email).

7. Subprocessors

We use third-party subprocessors to provide our services. The full list is published at /legal/subprocessors and updated within 30 days of adding any new vendor.

8. Google Ads & OAuth Data

When you connect Google Ads through the platform's integrations, you grant Adswish OAuth access to your Google Ads account. We use that access only to list, create, and manage campaigns you choose to amplify, and to read performance data for your dashboards.

Google OAuth tokens are stored encrypted and are never exposed to other users; you can disconnect the integration at any time, which revokes our access. Adswish never shares your Google Ads data with third parties without your consent, and paid (Google Ads) data is reported separately from organic creator traffic.

9. Outside-in Uptime Checks & App Updates

To satisfy the platform's required uptime check, Adswish's servers may fetch the public URL you asked us to watch (your verified domain or the public page you chose). We record only the HTTP status, response time, and timestamp — never the page content.

If you optionally connect an existing UptimeRobot monitor, we store only its numeric identifier and the reported up/down status.

The desktop tracker checks GitHub Releases for app updates automatically and downloads them with your consent; the download contains only the signed app package.

10. Session & Inactivity Data

For security, sessions end automatically after a configurable period of inactivity (1–30 minutes, default 1 minute) and when you leave the dashboard via the browser back button. No personal data is transmitted to us by these timeouts; they simply end the authenticated session on your device.

11. Contact

For privacy questions or data requests, contact hello@adswish.co.uk or by post (address available on request by email). You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Data protection fee. As a UK controller processing personal data, the operator is required to pay the annual data protection fee to the Information Commissioner's Office (Tier 1, micro-organisation — currently £52 per year, £47 by direct debit). Registration details are available on request from hello@adswish.co.uk.