← Back to the site

Privacy

Privacy Policy

Last updated 10 October 2026 · MakeThatAd

MakeThatAd works on one input: a product page link, plus the photos, reviews and notes you choose to add. This policy says exactly what we collect around that, which companies process it for us, how long it stays, and what you can ask us to do with it.

01Who is responsible

The data controller is KEROO LTD, registered in England and Wales (company number 16887762), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. For anything in this policy, write to support@makethatad.com.

This policy applies to makethatad.com and the app at makethatad.com/app. It is written to satisfy the UK GDPR and the Data Protection Act 2018, the EU GDPR for people in the European Economic Area, and the Turkish Personal Data Protection Law (KVKK, Law No. 6698) for users in Türkiye.

02What we collect

Account

  • Your name, email address and a password. The password is stored only as a salted hash by our authentication provider; we never see it.
  • Your plan, remaining credit, and the identifiers our payment processor gives us (customer and subscription IDs). We do not receive or store card numbers.
  • Your interface language, stored in your browser.

What you put into the service

  • Product page links, and the text and images we fetch from those pages
  • Product photos and reference images you upload
  • Customer reviews, evidence and notes you paste, and brand rules you save
  • Your decisions on creatives (approved, rejected) and the notes you attach to them

What the service produces

  • Product analyses, advertising angles, ad copy, image briefs and generated images, kept in your campaign history
  • Quality flags the service attaches to creatives (for example "check this image")

What we record automatically

  • Usage of the two meters (links and creatives) and purchases, so we can bill correctly and refund failed work
  • For each AI model call: which step ran, how many tokens it used, how long it took, and which campaign it belonged to. This record does not contain the content of the call.
  • Server logs from our hosting provider, which include your IP address, the request and any error. These are kept for a short time to fix problems.

We run no analytics or advertising trackers on the site or in the app.

03Product pages, reviews and web searches

When you paste a link we fetch that page's public text and up to a handful of its images. We only fetch pages that are reachable without a login; we do not sign in anywhere on your behalf. Pages that point at private networks are refused.

If the page uses a public review widget (currently Judge.me, Okendo or Stamped), we read the same public review feed the widget reads, so the analysis can use real customer language. We keep the extracted facts and a sample of up to 40 reviews with the campaign. Reviews can contain other people's names and words; we process them as part of your content, for the sole purpose of analysing your product, and you are responsible for having the right to use them.

The analysis step may run web searches about the product, its category and its competitors through our AI provider's search tool. The search terms are derived from the product page, not from your account details.

04Why we use it, and on what basis

  • To run the service — analyse pages, write copy, generate images, keep your history. Basis: performing our contract with you.
  • To bill you and prevent abuse — meters, purchases, refunds, rate limits. Basis: contract and our legitimate interest in running a fair service.
  • To keep the service working — logs, error traces, model-call records, aggregate quality measurement. Basis: legitimate interest.
  • To send service messages — sign-up confirmation, password reset, receipts, important changes. Basis: contract. We do not send marketing email.
  • To meet legal duties — tax and accounting records, responding to lawful requests. Basis: legal obligation.

We do not sell personal data and we do not share it with advertisers.

05The AI providers that see your content

Generation happens on third-party models. Each provider receives only what its step needs, under API terms that prohibit using the data to train their models.

  • Anthropic (Claude) — reads the product page text and images, the reviews and evidence, your brand rules and your uploaded photos to write the analysis, the ad copy and the image briefs; it also reads each generated image once to proofread it. Servers in the United States.
  • Google (Gemini image models) — receives the image brief and your uploaded product photos to generate the ad image. Paid API tier; inputs are not used to improve Google's models. Servers in the United States.
  • OpenAI (GPT Image) — used only when you choose that engine; receives the image brief and your product photos. API data is not used for training. Servers in the United States.

Providers may keep API inputs for a short period for abuse monitoring under their own policies (typically up to 30 days), after which they are deleted.

06Other services we rely on

  • Supabase — authentication, database and file storage. Hosted in the United States (AWS us-west-2).
  • Vercel — hosting for the site and the server functions that call the AI providers; short-lived server logs.
  • Stripe — payments, subscriptions and receipts. Stripe is an independent controller for the card data it collects; see Stripe's privacy policy.
  • Resend — delivery of account emails (confirmation, password reset).
  • Google Fonts — when the analysis detects your brand's web fonts, our server fetches them from Google to draw a type reference. Your browser does not contact Google for this.

All of these are processors bound by contract to use the data only to provide their service to us. Your data is transferred to and stored in the United States. For transfers from the EEA and the UK we rely on the providers' standard contractual clauses and, where applicable, their participation in the EU–US Data Privacy Framework. For transfers from Türkiye we rely on your explicit consent given at sign-up, until the Personal Data Protection Board's adequacy or contractual mechanisms apply.

We may also disclose information where the law requires it, to enforce our terms, or to protect the service and its users from fraud and abuse.

07Where generated images live

Generated ad images are stored in a public storage bucket at long, unguessable web addresses so that you can download them and share them with clients without logging in. Anyone who has one of those addresses can view that image. The images are not listed anywhere and search engines are not pointed at them.

Your uploaded product photos are stored in a private bucket. Only you, while signed in, and our server can read them.

Deleting a campaign, or closing your account, removes the images from storage.

08Training

We do not train AI models on your content or your output, and our providers are contractually barred from doing so with API data. We do measure the service in aggregate (for example, how often a step fails or how long a prompt is) using records that contain no content. If we ever want to use content to improve the service, we will ask first and make it an opt-in setting you can switch off.

09How long we keep it

  • Account details — while your account is open, then deleted within 30 days of closure
  • Campaigns, uploads, copy and images — until you delete them or close your account, then deleted within 30 days; backups roll off within a further 30 days
  • Purchase and credit records — for the period required by applicable tax and accounting law
  • Model-call records (tokens, durations, no content) — 12 months
  • Hosting server logs — days, not weeks
  • Support email — 2 years after the last message

10Your rights

Under the UK GDPR, the EU GDPR where it applies, and KVKK Article 11 for users in Türkiye, you can ask us:

  • whether we process your personal data, and for a copy of it
  • to correct data that is wrong or incomplete
  • to delete your data, or to close your account
  • to restrict or object to certain processing
  • for your data in a portable format
  • to withdraw consent where processing is based on it
  • to know which third parties your data was sent to
  • for compensation where unlawful processing caused you damage

Write to support@makethatad.com from the email address on your account. We answer within 30 days. We may ask you to confirm your identity first. You can also complain to the UK Information Commissioner's Office (ICO), to your local supervisory authority in the EEA, or, in Türkiye, to the Personal Data Protection Board (KVKK Kurulu).

Deleting a campaign or your account removes your uploads, copy and images as described above. Purchase records are kept for the legal period even after deletion.

11Cookies and browser storage

We set no cookies of our own. The app keeps two things in your browser's local storage: your sign-in session token and your interface language. Both stay on your device and are removed when you sign out or clear site data. When you buy credit, Stripe's checkout page sets its own cookies under Stripe's policy. There are no advertising, analytics or cross-site tracking cookies. If we ever add analytics, we will update this section first.

12Security

Data is encrypted in transit (TLS) and at rest. Passwords exist only as salted hashes. Each account can read only its own rows in the database, enforced at the database level. Keys that can do more than a signed-in user are kept on the server and never sent to the browser. Production access is limited to the people who need it. No system is perfect; if a breach affects you, we will tell you promptly and, where the law requires, notify the authority.

13Children

The service is for adults running businesses. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, write to us and we will close it.

14Changes and contact

If we change this policy in a way that matters, we will say so on this page and email the address on your account before the change takes effect. Questions, requests or complaints go to support@makethatad.com.

© 2026 KEROO LTD · MakeThatAd is a trading name of KEROO LTD · Registered in England and Wales, Company No. 16887762 · 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom · One link is enough.

Back to the site