Privacy Policy

Last updated October 12, 2026

Who we are

Four.ad is operated by DELAB, s.r.o., a company registered in Slovakia. When you use Four.ad, DELAB, s.r.o. is the data controller for the information described on this page — meaning we decide what is collected and why. For order and campaign data that belongs to your own end customers, we generally act as a processor on your behalf as the business; see our GDPR page for that distinction.

This policy explains, in plain language, what data we collect when you use Four.ad, why we process it, who it is shared with, how we protect it, how long we keep it, and what you can ask us to do with it. If anything here is unclear, email us at hello@four.ad and we will explain it.

What we collect

We only collect what Four.ad needs to run your ads and report on the results.

• Account information — your name, email address, and the business details you provide when you sign up (such as company name, website, and country).
• Advertising platform data — when you connect Meta (Facebook and Instagram), Google Ads, TikTok, Amazon Ads, or X, we store an encrypted access token (and, where a platform issues one, an encrypted refresh token) for that connection, plus the campaign, ad set, ad, and performance data (spend, impressions, clicks, conversions) needed to show and manage your campaigns inside Four.ad. We also store identifiers the platform gives us for that connection — such as the connected ad account, page, or pixel/conversion-tracking ID — so the integration keeps working correctly. Snapchat, Reddit, and Pinterest are coming soon; we will update this policy before they go live.
• Order-tracking data — when you connect a store (Shopify, WooCommerce, Wix, BigCommerce, Squarespace, Magento, PrestaShop, OpenCart, Ecwid, Shift4Shop, or a custom webhook), we read order records to attribute sales to your ad campaigns. For each order we store the order ID, amount, currency, and order date. We do not store your customers' names, plaintext email addresses, plaintext phone numbers, or shipping or billing addresses.
• One-way hashed contact identifiers, for ad-platform conversion matching only — where a connected ad platform supports server-side conversion reporting (sometimes called a "Conversions API"), we compute a one-way SHA-256 cryptographic hash of the customer's email address and/or phone number from the order and send only that hash to the platform, so it can privately match the sale to the ad click that likely caused it. A SHA-256 hash cannot be reversed back into the original email or phone number by us or by the ad platform; it can only be compared against another hash of the same value. This is standard practice across the advertising industry (all major ad platforms support and often require it) and is what makes "server-side" order tracking possible at all after browser ad-blockers and privacy features break traditional pixel tracking. We treat these hashes as personal data under GDPR (because they are used to help re-identify or match a specific person) even though they cannot be read in plain text, and we apply the same protections described in this policy to them.
• Retargeting and lookalike audience data — where you enable this feature, we instruct a connected ad platform to build a "custom audience" (for retargeting) or a "lookalike audience" (for prospecting) from visitor or customer data collected by that platform's own pixel or SDK on your store. That audience is built, stored, and used entirely within the ad platform's own systems under its own privacy terms — we store only the platform's reference ID for the audience, not the underlying visitor list.
• Product catalog and creative data — when you import products from a connected store, we store the product name, price, and image URL so you can turn them into ad creative. Images and creative you upload or generate are stored so they can be reviewed and published.
• Chat and AI data — the messages you send to the in-app assistant, and the goals and instructions you give when building a campaign, are stored with your account so the assistant can keep context and so you can see the history.
• Technical and log data — like any web service, our servers automatically record basic technical information when you use Four.ad: your IP address, browser type and version, device and operating system, the pages or API endpoints you request, and timestamps. The app also reports errors it runs into, and repeated rapid clicks on the same element (a sign that something isn't working), to our own servers. We use this to keep the service running, diagnose errors, and detect abuse.
• Website analytics (only with your consent) — if you accept analytics cookies, Google Analytics 4 records how the website and app are used (pages viewed, device and browser type, approximate location derived from your IP address, and an analytics cookie identifier). If you decline, it is never loaded.
• Bot-protection data — on the sign-up and contact forms, Cloudflare Turnstile checks that you are a person rather than a bot, using your IP address and browser and device signals.
• Billing data — our payment processor, Stripe, handles your payment method and billing details directly; we store only what's needed to identify your subscription and plan (such as your Stripe customer reference and subscription status), not your full card number.
• Support and communications — if you email us, use the contact form, or message us in the app, we keep that correspondence so we can respond and maintain a record of the conversation.
• Cookies and similar technologies — a session cookie that keeps you signed in, browser storage for your preferences and your cookie choice, and — only if you accept them — Google Analytics cookies. See our Cookie Policy for the full list and how to control them.

Why we process this data

We use this data solely to provide Four.ad's own functionality to you: running and optimizing your ad campaigns, attributing orders to those campaigns (including through hashed conversion matching), building retargeting/lookalike audiences you've enabled, and powering the in-app assistant that answers questions about your campaigns and can make changes on your behalf when you ask it to. We do not sell your data or your customers' data, and we do not use it for any purpose beyond operating Four.ad for your account.

If you are in the EU/EEA, our legal bases for processing are:

• Performance of a contract — processing your account, connected platform, order, hashed-matching, audience, product, chat, and email data is necessary to deliver the service you signed up for.
• Legitimate interest — keeping Four.ad secure and available, preventing fraud and abuse (including bot protection on our forms), and fixing problems, using technical and log data.
• Consent — for Google Analytics cookies, and where you choose to enable optional features like retargeting/lookalike audiences. You can withdraw consent at any time through the "Cookie settings" link in the footer of every page; see the Cookie Policy.
• Legal obligation — where we must keep certain records, for example for accounting or tax purposes.

EU/EEA users can find a fuller breakdown of rights and legal bases on our GDPR page.

Automated decision-making and the AI assistant

Four.ad uses AI (Anthropic's Claude models) to plan campaigns, write ad copy, answer questions in the chat, and suggest optimizations. By default every suggestion waits for your approval. If you turn Automatic optimization on in Settings (available on the Meta + Google plan and above), the system may — without a fresh confirmation each time — pause underperforming campaigns or ads, lower budgets, and move budget from a weaker campaign to a stronger one while keeping your total daily budget the same. It increases your total daily spend on its own only if you have also set a daily budget ceiling in Settings, and then only up to that ceiling and within the limits described in our Terms of Service. These are operational automations that carry out your own goals and settings for your business's ad campaigns; they are not automated decisions that produce legal effects or similarly significant consequences about you as an individual, so Article 22 GDPR does not apply to how the product works today. If that ever changes, we'll say so plainly and give you a way to request human review.

Who we share it with

We share data only where it is needed to run the service, and never with third parties for their own marketing.

• Ad platforms you choose to connect — Meta (Facebook and Instagram), Google Ads, TikTok, Amazon Ads, and X. When you publish or edit a campaign, or when we report a hashed conversion or build an audience you've enabled, that data (campaign content, targeting, budgets, creative, and hashed conversion identifiers) is sent to the platform because you directed us to do it. Once it reaches the platform, that platform's own privacy terms apply to it.
• Store platforms you choose to connect — such as Shopify or WooCommerce; we read order and product data from the store you connect, using the access you granted.
• Creative tools you choose to connect — Higgsfield, which you connect under your own Higgsfield account and credits. When you generate an image or video, the product images and creative instructions for it are sent to Higgsfield.
• Our payment processor — Stripe, which handles billing and payment details directly and acts as an independent controller for that data under its own privacy policy.
• The service providers listed below, which process data on our instructions only and may not use it for their own purposes.

Service providers (processors) we use

We may also disclose data if we are legally required to do so, or where it is necessary to protect our rights, our users, or the safety of any person.

We do not sell your data to third parties, and we do not share it with advertisers or data brokers for their own purposes.

Google user data

When you connect Google (including Google Ads) to Four.ad, we access a limited set of Google user data through Google's APIs, using your explicit OAuth consent: your Google account identifier and email address (to identify the connection), your Google Ads account and customer IDs, and the campaign, ad group, ad, and performance data needed to show and manage your campaigns.

Who we share Google user data with: we do not sell, rent, or transfer Google user data to any third party for advertising, market research, or any other purpose unrelated to providing Four.ad's functionality to you. Google user data is accessible only to our hosting provider (Hetzner) and to our AI provider (Anthropic), which processes your Google Ads campaign and performance data solely to produce the campaign plans, suggestions, and chat answers you ask Four.ad for, and does not use it to train models. It is disclosed to no one else except where legally required or necessary to protect our rights, our users, or the safety of any person.

How we protect Google user data: Google access and refresh tokens are encrypted at rest using authenticated encryption, transmitted only over encrypted connections (HTTPS/TLS), and accessible only to the systems and personnel that operate Four.ad, never exposed through customer-facing admin tooling. We retain Google user data only for as long as the connection stays active or as described in "How long we keep it" below, and delete it on request or on account deletion.

Four.ad's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

International data transfers

Four.ad is operated from Slovakia (EU), and our servers are hosted in Germany. Some of the providers listed above — Anthropic, Cloudflare, and, for some processing, Google and Stripe — and the ad platforms and other tools you choose to connect, may process data outside the EU/EEA, mainly in the United States. Where that happens, we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses, so your data stays protected to an equivalent standard. You can ask us for more detail at hello@four.ad.

How we protect it

• Access tokens and other credentials are encrypted at rest.
• All traffic to and from Four.ad is encrypted in transit (HTTPS).
• Access to production data is limited to the operators of Four.ad, and only for running and supporting the service — we have no customer-facing admin tooling that exposes your data more broadly than that.
• We minimise what we store in the first place — most notably, we deliberately do not store plaintext customer personal details from your orders, only order metadata and, where needed for conversion matching, one-way hashes as described above.

No online service can promise perfect security, but we treat your credentials and your customers' data as the most sensitive things we hold, and we design around storing as little of it as possible.

How long we keep it

We keep connected-platform data for as long as the integration stays connected and your account exists. If you disconnect a platform, we stop syncing new data from it, though previously synced data may remain for a reasonable period afterward. If you delete your account, we delete your account data within a reasonable period. There is currently no automated self-service export or deletion tool in the app — you can request either at any time by emailing hello@four.ad, and we'll action it manually.

Basic technical and log data is kept for a short period for security and troubleshooting, and records we are legally required to retain (such as billing records) are kept for as long as the law requires.

Your rights

You can ask us what data we hold about your account, correct it, or have it deleted, by emailing hello@four.ad. We will respond as quickly as we can — there is no self-service tool for this yet, so these requests are handled manually.

If you are in the EU/EEA, you also have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Correct data that is wrong or incomplete.
• Delete your data ("right to be forgotten").
• Restrict processing in certain circumstances.
• Data portability — receive your data in a structured, commonly used format.
• Object to processing we carry out on the basis of legitimate interest.
• Withdraw consent at any time, for example to analytics cookies, using the "Cookie settings" link in the footer. Withdrawing doesn't affect processing that happened before.
• Lodge a complaint with your local supervisory authority — in Slovakia, the Office for Personal Data Protection of the Slovak Republic.

Our GDPR page explains each of these rights and how to exercise them in more detail.

Children's privacy

Four.ad is a business tool for people who run ads for their company. It is not directed at children, and it is not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as Four.ad changes or as legal requirements change. When we do, we will post the updated version on this page and update the "last updated" date at the top. If a change materially affects how we handle your data, we will make a reasonable effort to tell you directly.

Contact

Questions about this policy or your data: hello@four.ad.

DELAB, s.r.o. — operator of Four.ad
Slovakia
hello@four.ad