Privacy Policy

1. Introduction

a.Lab ("Company", "we", "us", or "our") operates autoAdfit, an AI-powered ad creative optimization platform. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service, and describes your rights regarding that information.

2. Information We Collect

We collect the following categories of information to provide the Service:

3. How We Use Your Information

• Account registration, identity verification, and account management
• Delivering AI image transformation results
• Processing subscription billing and managing payment records
• Analyzing usage statistics and improving Service quality
• Complying with legal obligations and resolving disputes
• Sending service-related notices and updates (via email)

4. Data Retention

5. Disclosure to Third Parties

We do not sell or share your personal information with third parties, except in the following circumstances:

• You have given your explicit prior consent
• Disclosure is required by applicable law, regulation, or a valid legal request from a government authority

6. Sub-processors

We engage carefully selected third-party sub-processors solely to operate the Service. Each sub-processor is bound by confidentiality obligations and appropriate data protection agreements. Our current sub-processors are:

• AI image processing: OpenAI and Google — uploaded images are transmitted to these providers solely to analyze the creative and generate your resized outputs
• Authentication & database: Supabase
• File storage & hosting: Cloudflare (R2 object storage, Pages)
• Payments (Merchant of Record): Lemon Squeezy
• Advertising: Google AdSense (free plan only — see Section 8)

Questions about sub-processors can be sent to autoadfit@hotmail.com.

7. Cookies & Similar Technologies

We use cookies and local storage to provide and improve the Service for the following purposes:

• Maintaining login sessions
• Saving user preferences (theme, settings, etc.)
• Analyzing Service usage and performance

You may configure your browser to refuse cookies, but doing so may limit access to certain features of the Service.

8. Advertising & Third-Party Ad Vendors

For Free plan users, autoAdfit displays advertisements served by Google AdSense to help keep the Service free. Pro plan users do not see advertisements.

Google, as a third-party vendor, may use cookies to serve ads based on your prior visits to this and other websites. We do not control these third-party cookies and are not responsible for their privacy practices. You may manage your ad preferences directly through your browser settings or Google's own ad controls.

EU / UK users (GDPR): We are in the process of deploying a Google-certified consent management platform for personalized advertising. Until it is live, you can control advertising cookies through your browser settings and through Google My Ad Center, or contact us at autoadfit@hotmail.com to request that we stop processing your data for advertising purposes.

California residents (CCPA/CPRA): We do not sell personal information for monetary consideration. To opt out of cross-context behavioral advertising or to exercise any California privacy right, contact us at autoadfit@hotmail.com.

Children's privacy: The Service is not directed to children under the age of 13 (or 16 in the EEA/UK). We do not knowingly collect personal information from children.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your account and associated data
• Restriction: Request that we restrict processing of your data
• Portability: Request your data in a portable, machine-readable format

To exercise any of these rights, please contact us at autoadfit@hotmail.com or through your account settings. We will respond within 10 business days of receiving your request.

10. Security Measures

We implement the following technical and organizational safeguards:

• Passwords are hashed with Bcrypt; plaintext passwords are never stored
• All data in transit is encrypted via HTTPS (TLS 1.3)
• Principle of least privilege applied to all internal system access
• Row Level Security (RLS) enforced at the database layer
• Uploaded images are purged promptly — immediately after processing on the Free plan, within 7 days on the Pro plan

11. Data Protection Contact

12. Revision History

• April 19, 2026 — Current version