Privacy policy

AIVA by RepairAds and RepairAds are products operated by Adpilot AI Limited, a company registered in Hong Kong.

Controller and scope

Controller: ADPILOT AI LIMITED, Hong Kong SAR (operator of RepairAds). Because we offer services to businesses and individuals in the European Union and monitor campaign behaviour there, we accept that the GDPR applies to this processing under Art. 3(2) GDPR, even though we are established outside the EU. UK GDPR applies on the same basis for the United Kingdom. For processing in Hong Kong we also comply with the Personal Data (Privacy) Ordinance (PDPO, Cap. 486) and its six Data Protection Principles.

Data we collect

Account: email, shop name, country, phone or WhatsApp, website, business tax details when provided, onboarding data, and service messages. Analytics: campaign performance (impressions, clicks, CTR, spend) and optional anonymous product analytics when consent is granted. Billing: invoices and payment method handled by our payment provider — we do not store card numbers.

How we use it and legal bases

To operate your microsite and Google Ads campaign, send invoices and important service updates, and improve the product. Legal bases (Art. 6 GDPR): contract performance for account, campaign, and billing data; legitimate interests for service security, fraud prevention, and business-to-business outreach; consent for optional analytics and marketing email; legal obligation for accounting records. We do not sell your data.

Third parties and processors

Google Ads (campaign delivery), Lovable Cloud (hosting, auth, database and storage), Stripe (payments and tax handling), Resend or Lovable Email (transactional email), Instantly and Apify (outreach when used), and WhatsApp/Twilio (customer communication when enabled). The full, current list with purposes and locations is in the Data Processing Agreement.

Google Ads and measurement data

We manage campaigns inside advertising accounts that the customer owns and authorises, or through a provider connection that the platform permits. We do not sell, rent or supply pre-verified advertising accounts. Google acts as an independent controller for its own advertising purposes and as our processor for account-management operations, under the Google Ads Data Processing Terms and Google's own privacy policy. Conversion measurement on your microsite records events such as tracked calls, form submissions, and clicks, together with technical data (IP address, user agent, referrer, timestamp) needed to attribute them. Where such measurement or advertising cookies are not strictly necessary, they run only after consent. We do not upload special-category data, customer email lists, or hashed customer identifiers to Google.

Retention

Ad performance and campaign analytics: 24 months from collection. Billing and accounting records: 7 years, as required under Hong Kong Inland Revenue Ordinance and Companies Ordinance. Support and outreach communication logs: 24 months. Auth security logs: 12 months. Lead records (tracked calls, form submissions) generated for a customer: 24 months, or deleted earlier on that customer's instruction. Account profile data: kept while the account is active and deleted within 30 days of account closure, matching the deletion window in the Data Processing Agreement, unless legally required to retain longer.

International transfers

RepairAds is operated from Hong Kong, and some processors are located in the United States and the EEA. Hong Kong is not covered by an EU adequacy decision. Transfers of EU/UK personal data to ADPILOT AI LIMITED and to processors outside the EEA rely on the European Commission Standard Contractual Clauses (Implementing Decision 2021/914, module two controller-to-processor and module three processor-to-processor as applicable), the UK International Data Transfer Addendum for UK data, together with a transfer impact assessment and supplementary technical measures (encryption in transit and at rest, access control, minimisation). A copy of the clauses relied on is available on request at hello@repair-ads.com. Under PDPO we do not disclose personal data for a new purpose without a lawful basis or consent.

EU representative (Art. 27 GDPR)

We are appointing a representative in the European Union in accordance with Art. 27 GDPR; the named contact will be published on this page as soon as the appointment is in force. Until then, and at any time afterwards, EU and UK data subjects may exercise all of their rights directly with us at hello@repair-ads.com, and we respond within 30 days.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection (including to processing based on legitimate interests and to direct marketing), and withdrawal of consent at any time without affecting prior processing. We do not make decisions based solely on automated processing that produce legal effects for you. Email hello@repair-ads.com; we reply within 30 days and never charge for a first request. EU and UK data subjects may also lodge a complaint with their national supervisory authority, and Hong Kong data subjects with the Privacy Commissioner for Personal Data.

Cookies

Essential cookies keep authentication and security working. Optional anonymous product analytics and measurement run only after consent. You can reopen Cookie settings from the footer and withdraw consent at any time.

Privacy and security contact

Privacy and data-protection requests, and security reports, go to hello@repair-ads.com, attention: Data Protection Contact, ADPILOT AI LIMITED. We are not required to appoint a Data Protection Officer under Art. 37 GDPR; this named contact handles the same requests. Company details: Impressum. This page is maintained by ADPILOT AI LIMITED for RepairAds and is not a certification.