Legal
Privacy Policy
Last updated 2026-09-29
This policy explains what personal data Luflet collects, why, who we share it with and how you can control or delete it. Luflet is operated by [Company name SRL] ([CUI / Nr. Reg. Com.]), [Street, city, Romania], the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
1. Data we collect
Account data
Your name, email address, company name (optional) and profile picture, when you sign up with an email code, Google or Facebook.
Data from Facebook and Meta
When you log in with Facebook, you choose which permissions to grant. With your permission we receive your Facebook user ID, name, email and an access token, and we use the following permissions:
- ads_management, ads_read: to list your ad accounts, read campaign, ad set and ad performance, and create or edit campaigns when you ask us to.
- business_management: to find ad accounts and Pages that belong to your business portfolios.
- pages_show_list, pages_read_engagement: to let you pick the Facebook Page and Instagram account your ads run from.
We store the ad account, Page and pixel you select, daily performance figures (spend, impressions, clicks, purchases, revenue) and the campaigns you create in Luflet. We do not read your personal Facebook profile, friends, posts or messages.
Google data
If you connect Gmail, we request read-only access (gmail.readonly) to find store notifications you ask us to look for. We do not send, delete or modify emails. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is never used for advertising or to train AI models.
Content you add
Products, images, videos, ad copy, messages you send to the assistant and in the alert “Fix it” chat, and team invitations (the invitee's email address).
Usage and technical data
IP address, browser type, pages visited and actions taken in the app, collected through essential cookies and product analytics.
Billing data
Payments are handled by Stripe. We store your Stripe customer ID and subscription status, never your full card number.
2. How we use it
- To provide the service: sign you in, show reports, create and edit campaigns you ask for.
- To monitor your campaigns and alert you about problems, by email and in the app.
- To generate AI suggestions (ad copy, proposed fixes). AI never changes your ad account on its own; every change requires your explicit approval.
- To bill subscriptions, provide support and keep the service secure.
- To understand how the product is used and improve it.
Legal bases (GDPR art. 6): performance of our contract with you, our legitimate interest in securing and improving the service, your consent where required (for example connecting Facebook or Gmail), and legal obligations such as accounting.
We do not sell your personal data, and we do not use data received from Meta or Google to build advertising profiles or for any purpose other than providing Luflet to you.
3. Who we share it with
We use the following service providers (processors), bound by data processing agreements. Transfers outside the EU rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms | Facebook Login and the Marketing API: reading and managing your ad accounts, Pages and pixels | Ireland / USA |
| Vercel | Hosting the application | EU / USA |
| Supabase | Database and file storage (uploaded images and videos) | EU |
| Google sign-in, optional read-only Gmail connection, and the Gemini AI model (assistant chat, alert fixes, ad copy) | EU / USA | |
| Anthropic | Optional AI model for drafting ad copy in the ad studio | USA |
| Resend | Sending sign-in codes and alert emails | EU / USA |
| Stripe | Subscription billing and payments | EU / USA |
| PostHog | Product analytics about how the app is used | EU |
If you invite editors, they see the products and content you share with them, never your ad account or billing. We may disclose data if required by law.
4. How long we keep it
- Account and campaign data: while your account is active.
- Facebook and Google access tokens: until you disconnect or they expire.
- Invoices: as long as Romanian accounting law requires (currently 10 years).
- After you delete your account, we delete your personal data within 30 days, except what we must keep by law.
5. Your rights
You can access, correct, export or delete your data, object to or restrict its processing, and withdraw consent at any time. To exercise these rights, email [privacy@yourdomain.com]. See Data deletion for how to remove your data and disconnect Facebook. You may also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or your local authority.
6. Cookies
We use essential cookies to keep you signed in and product analytics cookies to understand usage. We do not use advertising cookies on this site.
7. Security
Data is encrypted in transit (HTTPS) and at rest. Access tokens are stored server-side only, and Meta API requests are signed with an app secret proof.
8. Children
Luflet is a business tool and is not intended for anyone under 18.
9. Changes
We will post updates on this page and change the date above. For significant changes we will notify you by email.
10. Contact
[Company name SRL], [Street, city, Romania].
Email: [privacy@yourdomain.com]