DRAFT — requires lawyer review (UK/EU digital purchases, refunds, VAT)
Privacy policy
Draft of 13 October 2026. Square brackets mark details still to be filled in.
Elevate, [registered office address, United Kingdom] (company number [company number]), is the controller of the personal data described here and runs AdCosmos. Contact: [privacy email]. We are registered with the Information Commissioner's Office [ICO registration number]. We follow the UK GDPR and the Data Protection Act 2018, and the EU GDPR for people in the EU.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, display name, Google sign-in identifier if you use Google | Your account, receipts and notices (for example when your spot is taken over) | Contract |
| Purchases, prices, tax details, Claim Credit ledger | Delivering what you bought and keeping accurate records | Contract, legal obligation (tax and accounting) |
| Payment details | Handled by Stripe. We never see or store your full card number. We keep a card fingerprint and the last four digits so that nobody can take over their own spot with the same card | Contract, legitimate interest (fraud prevention) |
| Brand content you add (name, tagline, links, images) and your public price history | Showing your brand to visitors. This is public, and a spot's page can show past prices and brand changes | Contract |
| Visits and clicks: a random visitor id in a cookie, your account id if signed in, the first part of your network address | Counting one visit per visitor per day, rejecting automated traffic and limiting abuse. The network address part is deleted after 30 days | Legitimate interest, and consent where the law requires it for the cookie |
| Reports you send, and our decisions on them | Reviewing content. The holder is not told who reported | Legitimate interest, legal obligation |
| Messages you send us | Replying to you and keeping a record | Legitimate interest |
| Server error logs (message, stack trace, page address; no account details) | Fixing faults and keeping the service secure | Legitimate interest |
We do not sell personal data, use it for advertising or profile you, and we do not make decisions with legal effect on you by automated means. Our bot filter only decides whether a visit is counted.
Cookies
We use a sign-in session cookie, which is strictly necessary, and a visitor cookie (cc_vid) that lets us count visits and clicks and apply rate limits. We do not use advertising or analytics cookies. We ask for your consent to the visitor cookie where the law requires it, and the game works if you decline, but your visits will not be counted.
Who we share data with
Our service providers, acting on our instructions: Supabase (database and sign-in), Stripe (payments and tax; Stripe also acts as a controller in its own right for fraud prevention and legal compliance), Resend (email), Upstash (rate limiting), Vercel (hosting), Sentry (error reports) and, for link safety checks, Google Safe Browsing (which receives link addresses, not personal data). We may disclose data where the law requires it, to protect our rights, or in a sale of the business. Some providers are outside the UK and EU, mainly in the United States. We rely on UK and EU adequacy decisions (including the UK-US data bridge and EU-US Data Privacy Framework) or standard contractual clauses with the UK addendum.
How long we keep it
- Account details: while you have an account and for up to 12 months after it closes, to deal with queries.
- Purchase, tax and Claim Credit records: 6 years after the end of the tax year, as UK tax and accounting law requires.
- Network address prefixes: 30 days.
- Reports and moderation records: up to 3 years.
- Error logs: up to 90 days.
Your rights
You can ask for a copy of your data, to correct it, to delete it (subject to records we must keep), to restrict or object to our use of it, and to move it. Where we rely on consent you can withdraw it at any time. Email [privacy email]; we reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Children and security
AdCosmos is for people aged 18 and over and we do not knowingly collect data from children. We use encryption in transit, access controls and limited retention to protect your data, and will tell you and the regulator about a breach where the law requires.
Changes
We will post changes here and tell account holders about material changes. See also the Terms of Service.