Chatvertise

Privacy Policy

Last updated: September 1, 2026. The English version of this policy is the binding version.

1. Controller

Codeventure e.U., Mühlbachgasse 7, 4533 Piberbach, Austria — email: office@chatvertise.app. We are the controller for the personal data processed through Chatvertise ("the Service").

2. Data we process

  • Account data: name, email address, hashed password, organization name, chosen language and time zone — to provide login and the Service (Art. 6(1)(b) GDPR).
  • Advertising data: OpenAI Ads API keys (stored AES-256-GCM encrypted), campaign structures, ad creatives and performance metrics retrieved from the OpenAI Advertiser API on your behalf (Art. 6(1)(b) GDPR).
  • Billing data: subscription plan and payment status. Payment details (card numbers etc.) are processed directly by Stripe; we never see them (Art. 6(1)(b) GDPR).
  • Team and invitation data: names and email addresses of team members and of persons you invite to your organization — to provide multi-user access (Art. 6(1)(b) GDPR). Invitation records are deleted after acceptance or expiry (7 days).
  • Notification emails: we send operational emails (e.g. rejected ads, budget warnings, account status, weekly reports) based on our legitimate interest in a functioning service (Art. 6(1)(f) GDPR); you can disable each category in your settings. Product news is sent only with your prior consent (opt-in, Art. 6(1)(a) GDPR) and can be revoked at any time in your settings.
  • Custom-audience data: if you upload customer lists (email addresses, phone numbers, hashed identifiers) for OpenAI custom audiences, we transmit this data on your behalf and on your instruction directly to OpenAI and do not store it beyond the transfer. For this data you remain the controller and we act as your processor (Art. 28 GDPR — see our DPA); you are responsible for a valid legal basis for the persons on your lists.
  • Conversion tracking: measurement pixels and server-side conversion events run on your website and transmit data to OpenAI, not to us. We only manage the configuration (pixel IDs, event definitions). Informing your website visitors and obtaining any required consents is your responsibility.
  • Technical data: server logs (IP address, timestamps) for security and operation (Art. 6(1)(f) GDPR).

3. Cookies

We only use strictly necessary cookies: a session cookie for login and preference cookies for your language and interface settings (e.g. the collapsed sidebar). We do not use tracking, analytics or advertising cookies, which is why the Service shows no cookie consent banner.

4. Processors and recipients

  • Vercel Inc. — hosting and content delivery
  • Supabase — database hosting, region: EU (Frankfurt, eu-central-1)
  • Stripe, Inc. — subscription billing and tax calculation
  • Resend, Inc. — transactional email delivery (alerts, weekly reports, team invitations)
  • OpenAI — Advertiser API requests made on your behalf using your API key; additionally AI analysis features (Pro plan): campaign context is transmitted to generate recommendations; no end-customer personal data is included

Data processing agreements (DPAs) are in place with all processors. Transfers outside the EU/EEA rely on EU Standard Contractual Clauses.

5. Retention

Account data is kept for the duration of the contract and deleted upon account deletion. Billing records are retained as required by tax law (7 years under § 132 BAO, Austria). Synced performance data is deleted together with the connected ad account.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and to lodge a complaint with a supervisory authority — for us the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, dsb.gv.at). Contact: office@chatvertise.app.

7. Changes

We will update this policy when the Service or legal requirements change and indicate the date of the latest revision above.