Privacy notice

Last updated 13 October 2026

This notice explains how AdStck Ltd uses personal data about the people at agencies who use AdStck, people who book a demo or get in touch, and people at agencies we contact about AdStck.

It does not cover the enquiries that come in through a funnel built on AdStck. Those belong to the agency and the business the funnel is for, and are covered by that business's own privacy policy. For those, AdStck acts only on the agency's instructions, under our data processing agreement.

Who we are

AdStck Ltd is the controller of the data described here. We are registered in England and Wales, company number 17410077. Our registered office is 1 Stainburn Drive, Leeds, England, LS17 6NY.

For anything about your data, email privacy@adstck.com.

What we collect, and why

When you create an agency account: your name, your work email address, your agency's name and details, your password (stored only as a secure hash by our sign-in provider), and a record of which version of our terms you accepted and when. We use this to give you the service, keep your account secure, and contact you about it. Our legal basis is the contract between us.

When you use AdStck: what you set up in your account, such as clients, funnels, branding and settings, and technical records such as sign-in times and the device and browser used. We use these to run the service, fix problems and protect accounts from misuse. Our legal basis is the contract, and our legitimate interest in keeping the service secure.

When you book a demo: your name, email address, agency name, roughly how many clients you run, and the time you choose. We use this to hold the call, send you the invitation and reminders, and follow up afterwards. Our legal basis is taking steps you asked for before a contract, and our legitimate interest in following up.

When you visit adstck.com or start booking a demo: the pages you visit, where you came from (for example a link or an ad), whether you are on a phone or a computer, roughly which town you are in (worked out on our own server from your internet address, which we do not keep), how long you stay on a page, and each step in the booking form: the day and time you pick, and the details you type, saved as you go, even if you do not press Book. These are joined by a random ID kept in your browser. We use this to see how people find us, where they get stuck, and to get in touch if you started booking and did not finish. Our legal basis is our legitimate interest in running and improving our website and in following up a demo you started to book. You can stop us counting your visits at any time.

When an agency registers or moves in a domain name: the domain owner's name or business name, postal address, email address and phone number, and for .uk domains the type of owner (for example a UK company or an individual) and any company number. Every registry requires these before a domain can be registered. We use them to register, renew and move the domain, to send renewal and confirmation emails, and to keep a record of who agreed to the domain terms and when. We send them to Openprovider, the registrar we use, and to the registry for the domain ending, such as Nominet for .uk; for endings such as .com, also to ICANN and the escrow providers it requires, which keep a copy so a domain survives if a registrar fails. For .uk domains owned by an individual, Nominet hides the owner's name and address from public lookup. For other endings, personal details are hidden from public lookup but may be disclosed to someone with a legitimate reason, such as a trade mark owner or the police. Our legal basis is the contract with the domain owner and the registry rules we must follow. [For the solicitor: whether AdStck or the agency is the controller here.]

When you connect Facebook, Instagram or Google Ads: when an agency connects its Facebook login or Google Ads account, or a business shares its accounts with its agency through an AdStck onboarding link, Facebook or Google gives AdStck an access key for that login, limited to the permissions approved on their own screen. We use it only to list the ad accounts, Pages, Instagram accounts and Google Ads accounts that login can reach, to share the ones chosen with the agency, and to run and report on ads for that agency's clients. We also keep the name and email address of the login, and which accounts were shared. Keys are stored encrypted and never shown in a browser. A Google key from an onboarding link is deleted as soon as the account is linked. A Facebook key from an onboarding link is deleted once the sharing is done, unless the agency needs it to reach a personal ad account, in which case it lasts until Facebook ends it, after about 60 days. You can remove AdStck's access at any time in your Facebook settings under Business integrations, in your Google account under Third-party connections, or by emailing us, and we will delete what we hold. Our legal basis is the contract, and, for a business using an onboarding link, our legitimate interest in providing the service its agency asked for. AdStck's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

When you email or call us: what you tell us and your contact details, so we can reply. Our legal basis is our legitimate interest in answering you.

When we contact you about AdStck: we may contact people at marketing agencies by phone or email to introduce AdStck. We use business contact details, such as your name, job title, work email, work phone number and your agency's name. We get these from your agency's public website and from business data providers such as Apollo.io. Our legal basis is our legitimate interest in telling agencies about a product that may be useful to them. You can tell us to stop at any time and we will, straight away, and keep only what we need to make sure we do not contact you again.

Who we share it with

We use a small number of providers to run AdStck: for storing data and signing in, for running the application, and for sending email. They act only on our instructions. The current list, and where each one is based, is on our providers page.

We do not sell personal data, and we do not share it with anyone for their own marketing.

Some of these providers are in the United States. Where data leaves the UK, it is protected by the safeguards UK law requires, such as the UK International Data Transfer Addendum or the UK–US data bridge.

How long we keep it

• Agency account data: while your account is open, then for up to 12 months after it closes, unless we need it longer to resolve a dispute.
• Billing records: six years, because tax law requires it.
• Demo bookings and emails: up to two years after our last contact with you.
• Visits and booking steps that did not lead to a booking: 90 days.
• Domain owner details: while the domain is registered through us, then for two years, which the registrar requires.
• Sales contact details: until you ask us to stop, or for up to two years with no response from you, whichever is sooner.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or to move it to another provider. You can object to us using it on the basis of our legitimate interests, and you can always object to direct marketing. Email privacy@adstck.com. We will reply within one month.

Complaints

If you are unhappy with how we have handled your data, email privacy@adstck.com with what happened. We will acknowledge your complaint within 30 days, look into it, and tell you what we have found and what we are doing about it.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Changes

If we change this notice, we will update the date at the top. If a change matters to you, we will tell you by email.