1. Data Controller

Adkumo GmbH Uetlibergstrasse 88 8045 Zurich, Switzerland Email: hello@adkumo.com

2. Data We Collect

We collect and process the following types of personal data:

• Account Information: Name, email address, password (encrypted)
• Brand Content: Brand names, logos, colors, fonts, ad campaigns, assets, and documents you upload
• Usage Data: How you interact with our service, feature usage, error logs
• Technical Data: IP address, browser type, device information, cookies
• AI-Generated Content: Ad campaigns, ad creatives, and assets created through our AI features

3. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b) GDPR): To provide our AI ad creative services
• Consent (Art. 6(1)(a) GDPR): For optional features and marketing communications
• Legitimate Interest (Art. 6(1)(f) GDPR): To improve our services, prevent fraud, and ensure security
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with applicable laws and regulations

4. How We Use Your Data

• Provide and maintain Adkumo services (ad creative generation, brand management)
• Generate AI-powered ad creatives tailored to your brand
• Store and manage your brand assets and ad campaigns
• Communicate with you about your account and our services
• Improve our AI models and service quality
• Ensure security and prevent fraud
• Comply with legal obligations

5. Data Sharing and Third-Party Processors

We share your data only with trusted third-party service providers who help us operate Adkumo, including:

• Cloud infrastructure and hosting providers
• Database and authentication services
• AI and machine learning service providers
• File storage and content delivery services

All processors are GDPR-compliant and operate under data processing agreements. We ensure adequate safeguards are in place for any international data transfers. We do not sell your personal data to third parties.

Google User Data (Google Ads & Google Drive)

If you choose to connect Google Ads or Google Drive to Adkumo, we access Google user data only as follows:

• Google Ads (scope https://www.googleapis.com/auth/adwords): We list the ad accounts you can access, sync your own campaign and ad performance metrics, create campaigns and ads only when you explicitly publish from Adkumo (always created paused), and query Google's Keyword Planner for keyword research
• Google Drive (scopes https://www.googleapis.com/auth/drive.file, userinfo.email, userinfo.profile): We read and import only the image files you explicitly select via the Google Picker into your asset library, and display your connected account's email address and name on the Integrations page
• Storage & protection: OAuth refresh tokens are encrypted at rest with AES-256-GCM and are never exposed to your browser
• No selling, no AI training: We never sell Google user data, never share it with third parties beyond the subprocessors required to operate Adkumo, and never use it to develop, improve, or train generalized AI or machine learning models
• Deletion & revocation: Disconnecting an integration in Adkumo immediately deletes the stored tokens, and you can revoke Adkumo's access at any time at https://myaccount.google.com/permissions

Adkumo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. For the full disclosure, see our Google API Disclosure page at https://www.adkumo.com/google-api-disclosure.

6. Data Retention

We retain your personal data for as long as:

• Your account is active and you use our services
• Required to comply with legal obligations (e.g., tax records: 10 years)
• Necessary to resolve disputes or enforce our agreements

You can request deletion of your account and data at any time by contacting us.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Limit how we process your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time

To exercise your rights, contact us at hello@adkumo.com

8. Cookies and Tracking

We use only essential cookies necessary to operate our service, including authentication and session management. These cookies are required for the platform to function and do not require consent under GDPR.

We do not currently use analytics, advertising, or tracking cookies. If we introduce optional cookies in the future, we will obtain your consent before doing so.

You can manage cookie preferences through your browser settings at any time.

9. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Secure authentication with encrypted passwords
• Regular security audits and monitoring
• Access controls and role-based permissions

10. International Data Transfers

Your data is primarily stored within the European Union. If data is transferred outside the EU, we ensure adequate safeguards through:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• GDPR-compliant data processing agreements

11. Children's Privacy

Adkumo is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through our service. Continued use after changes constitutes acceptance of the updated policy.

13. Supervisory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the supervisory authority: