Privacy policy

1. Who is responsible and how to contact us

BURIZA, 229 rue Saint-Honoré, 75001 Paris, France, registered as 930 929 252 RCS Paris, is the controller for Adspy account administration, billing, service security and the public research library it operates. Contact info@adspy.sh for privacy questions or to exercise rights. This policy covers visitors, account holders, workspace members and people whose information appears in advertising or social research.

Where an organisation supplies personal data for processing solely on its instructions, roles and duties depend on that processing and the applicable data-processing agreement. The organisation may be the controller for its research notes and downstream use. This does not remove BURIZA’s obligations for its own activities.

• Publisher details

2. Information we process and its sources

We receive information from you, your identity provider, workspace administrators, connected assistants, payment and infrastructure providers, and advertising and social sources. A person appearing in a public advertisement or post may not have an Adspy account.

• Accounts and teams: name, email address, authentication identifier, organisation and workspace memberships, roles, invitations and account settings.
• Research activity: followed brands, saved creatives, collections, notes, research requests, generated reports or analysis references, and exports requested by your organisation.
• Connections and security: authorised client information, scopes, token or key records, approval choices, access and revocation events, network and device information and diagnostic records needed for operation and abuse prevention.
• Payments and usage: Stripe customer, subscription, invoice and transaction references, billing details, licensed quantity, credit grants, reservations, debits, refunds and operation receipts. Stripe collects payment-card details; Adspy does not store full card numbers.
• Public advertising research: advertiser and page identifiers, names, logos, public ad text, media, landing-page information, source references, observed publication or activity dates, and automated transcripts, labels and analysis. Such material can include an identifiable person’s image, voice, name or other information.
• Public social accounts and posts: for the TikTok, YouTube and Instagram accounts of brands, the account’s public identifiers, name, handle, profile link, profile picture, verification badge and website link, follower counts over time, and its public posts with their captions, hashtags, publication dates, thumbnails, videos where available and public counts (views, likes, comments, shares and saves where the platform shows them), with automated labels and analysis. We do not collect comment text or the names of people who comment, like or follow.
• Support: your correspondence, request details and information needed to investigate an issue. Please do not send secrets, full payment-card information or unnecessary sensitive data.

3. Purposes and legal bases

We use the information needed to create and administer an account, provide requested research and exports, manage permissions, bill for purchases and answer service requests to perform the contract with an individual customer. For users acting for an organisation, the corresponding basis is our legitimate interest in delivering the organisation’s service and administering its authorised users.

We rely on legitimate interests for proportionate security, fraud prevention, service diagnostics and the organisation of public advertising evidence for professional research, subject to necessity, reasonable expectations and the rights of affected people. Public availability alone is not a legal basis. We consider objections, minimise unnecessary personal information and assess whether material should be corrected, restricted or removed.

Accounting, tax, dispute records and lawful authority requests may require processing under a legal obligation. Optional consent-based processing, where offered, requires a separate choice; service terms are not marketing consent. Information needed for authentication, billing or a requested operation is required for that feature, while optional notes and voluntary support details are your choice.

4. Public advertising sources and people shown in ads

The research library uses advertising evidence originating from Meta’s public advertising services and Google’s Ads Transparency Center, including available YouTube creatives, and the collection infrastructure supplying that evidence. Source details shown with a record identify its provenance where available. We do not access your private advertising-account performance as part of this library.

If you are shown or named in an ad, you may contact info@adspy.sh without creating an account. Provide the Adspy URL, source URL or a description sufficient to locate the record and explain your request. We will assess applicable access, correction, objection, restriction and erasure rights. Removal from one source may not immediately remove a previously collected copy or a lawful export held independently by a customer.

Research customers receive material within their authorised access and become responsible for their own downstream use. Public research does not authorise unlawful profiling, sensitive-trait inference or unsolicited outreach. A privacy request is assessed on its merits and is not rejected merely because information once appeared publicly.

5. Public social accounts of brands

Adspy collects the public posts of accounts that represent brands, so that customers can study a brand’s organic communication next to its advertising. It does not collect private accounts, direct messages or content behind a login.

YouTube: we read public channel and video pages, without an account and without storing or sending cookies.

TikTok: we read public profile pages and post lists without an account, through a proxy provider (when a customer asks for an account, Adspy reads its public profile page once itself to identify it), and stop when the platform shows a login, consent or verification page.

Instagram: we read professional accounts only, through Meta’s official Graph API (Business Discovery). We never scrape Instagram.

An account is collected when a customer asks for it, or when we identify it as the official account of a brand that customers follow or ask about, from evidence such as a link on the brand’s own website. It is then refreshed periodically: every few hours to every week while someone follows its brand, and about once a month otherwise. Posts can show identifiable people, such as founders, employees, creators or members of the public appearing in a brand’s video. Our legal basis is our legitimate interest in organising public brand communication for professional research, under the same safeguards as advertising evidence (section 3): we keep only brand-account content, collect no audience data, and do not use the material to profile the people shown.

If you manage an account, or appear in a post, and object to its collection, write to info@adspy.sh with the account or post link. We add the account (or the brand) to an exclusion list that our collection jobs check before they run, stop collecting it and remove or restrict what we hold, unless a compelling legitimate ground or a legal claim requires otherwise. From then on Adspy leaves the account and its posts out of every new research result and refuses any request to collect it.

Customers may only ask for accounts that represent a brand, a business or a creator acting professionally (Terms, section 15). An account that does not, such as a private person’s, is added to the exclusion list as soon as we learn of it.

When a customer searches for a brand’s accounts by name, the search results (the accounts found) are kept for 30 days, then erased by our nightly clean-up. An account the customer then asks us to collect is kept as described above.

When TikTok reports that a post we read again was removed, the post is marked as deleted and is no longer listed. YouTube and Instagram do not report removals, so a post removed there keeps the state we last observed.

Instagram content is not available through the REST API or in its exports.

6. Recipients, infrastructure and connected assistants

Authorised BURIZA personnel and service providers receive information needed for operation, support, security and legal compliance. Workspace members can see the research shared within their permissions; administrators manage membership and plan information. A customer’s export or separately authorised sharing can disclose material to additional recipients.

• Vercel supplies website and application hosting and related delivery infrastructure.
• Clerk supplies authentication and processes the identity and session information needed to sign users in.
• Neon supplies the PostgreSQL database used for accounts, organisation and research records, permissions and billing information.
• Stripe processes checkout, subscriptions, billing and payment risk. It may act as an independent controller for activities described in its own privacy terms.
• Advertising-library and export infrastructure uses database, object-storage and processing services, including Amazon Web Services. Relevant media and source records pass through the services needed for collection and delivery.
• Social collection uses a proxy provider for requests to TikTok, Meta’s Graph API for Instagram professional accounts (Meta sees which accounts we ask about) and Amazon Web Services for storage. REST API customers (Enterprise) receive public advertising and TikTok and YouTube post data through their API keys, under contractual limits on reuse; Adspy records each API request (key identifier, route, status, IP address, user agent and time) for security and limits.
• AI processing services used for creative analysis receive the material required for the relevant analysis. They are separate from an assistant you choose to connect through MCP; contact us for the applicable providers and processing arrangements before a use case requiring specific contractual safeguards.
• An MCP client or AI assistant you connect receives the research and workspace information authorised by your scopes and requests. Its provider’s own retention and use terms apply to its copy. Revoking a connection prevents future access but does not automatically delete information already supplied to it.

• Clerk privacy
• Stripe privacy
• Vercel privacy
• Neon privacy
• AWS privacy

7. International processing and safeguards

Some recipients operate outside France and the European Economic Area. A vendor’s postal address is not a promise that all processing occurs there, and this policy does not assert EU-only storage. Where GDPR restricts a transfer, the applicable arrangement must use a lawful transfer mechanism, such as an adequacy decision covering the recipient or standard contractual clauses and any necessary supplementary safeguards.

Contact info@adspy.sh for information about the locations, recipients and safeguards relevant to your processing, or to request a copy of applicable transfer safeguards subject to protection of confidential information. If your organisation needs a data-processing agreement or restricted provider list, arrange it before submitting data requiring those protections.

8. Retention, cancellation and deletion

We retain account and workspace information while needed to supply the service and administer access. Ordinary subscription cancellation or downgrade preserves saved research so it can be used again if access resumes; it is not an account-deletion request. You can request account closure and erasure at info@adspy.sh, subject to other members’ rights and records we must lawfully retain.

Financial and accounting evidence is kept for applicable statutory periods, including ten years where French accounting law requires it. Contract and dispute evidence may be retained for the applicable limitation period or an ongoing claim. Security and diagnostic records are retained for the period reasonably needed to investigate incidents, prevent abuse and meet legal requirements.

Public research records are retained according to their research relevance, source availability and applicable rights, with removal or restriction following justified requests and legal obligations. Temporary export access and authorisation tokens have their own expiry rules; expiry of a link or research permission is not proof that every related record or backup has been erased.

Social accounts are refreshed more often while someone follows their brand and about once a month otherwise, until they are excluded. Posts are kept as research records with their observation history; a post the platform reports as removed is kept, marked deleted, as part of the account’s research history, and is no longer listed. Accounts on the exclusion list are kept on that list, with the minimum needed to recognise them, for as long as the exclusion applies. API request records are kept for 90 days for security and the enforcement of limits.

Erasure requests are assessed against these purposes, retention duties and the rights of other users. Backups, technical logs and recipients can have separate retention cycles. We do not promise immediate physical deletion across every provider, but will explain any justified retention and the actions taken on a request.

9. Cookies and browser storage

The site and sign-in or payment providers use cookies and similar storage needed for authentication, security, session continuity and requested features. Local browser storage can also retain interface preferences or draft text. Blocking necessary storage can prevent sign-in, checkout or a selected feature from working.

Non-essential tracking that requires consent must be offered separately before activation. This policy is not consent to advertising cookies, and accepting service terms does not supply that consent. Your separately chosen assistant, an external page you visit or Stripe checkout may have its own notice and controls. Browser settings let you remove stored data, but removing cookies does not cancel a subscription.

10. Your rights and complaints

Subject to the conditions in applicable law, you can request access, correction, erasure, restriction and portability of your personal data, object to processing based on legitimate interests, and withdraw consent for processing that relies on it. Withdrawal does not affect earlier lawful processing. You may also provide applicable instructions concerning your data after death under French law.

Contact info@adspy.sh and identify the account or research record concerned. We may ask for proportionate information to verify identity or authority, but do not need your password, API key or full card details. Requests are normally answered within one month; if a lawful extension is necessary, we will explain it within that first month. Rights requests are normally free of charge, subject to the limited exceptions in law.

If your organisation is the controller for information it submitted, contact its administrator; we will assist as required. You may complain to the CNIL in France or the data-protection authority competent for your situation. Contacting BURIZA first is not a condition on that right.

• CNIL complaints

11. Security, automated analysis and changes

Safeguards include encrypted transport, authentication, workspace permission checks, scoped and revocable connections and controls over credit operations. No service is completely secure. We investigate personal-data incidents and notify the relevant authorities and affected people where legally required.

Adspy uses automated analysis to describe advertising and social material. It is not designed to make decisions producing legal or similarly significant effects about individuals. Customers must not treat model-generated labels as verified facts about a person or use the service to bypass legal safeguards for consequential automated decisions.

We update this policy when processing changes. The date above identifies this version. Material changes will be brought to users’ attention where required, and new processing that needs consent will require the appropriate choice.