Privacy notice

1. Who is responsible

DGI WORKS AB is the controller for international accounts, subscriptions, payments and use of the international Adlizer site. DijitalPi operates Adlizer on our behalf as a processor in Turkey, under our instructions. This notice is governed by the GDPR and applicable Swedish and EU data protection law.

2. What data we collect

Account and contact data: email address, password hash (one-way argon2id, never the raw password), plan tier, role and creation date.

Usage data: brand lookups, dates and IP addresses in server logs. Your watchlist contains saved brands and historical ad counts. The browser extension sends the current site’s domain only when you click its icon. There is no continuous background monitoring or stored browsing history.

Payment data: selected plan, account and Stripe customer and subscription identifiers, and payment and subscription status. Stripe collects payment details directly, together with your name, email, billing address and tax ID where requested. Neither DGI WORKS AB nor DijitalPi receives full card numbers or security codes. We also use the browser storage and cookies described below.

When provided, we also collect your telephone number for WhatsApp and phone login, Slack and Discord webhook addresses, a custom webhook address, brand name and logo URL, and billing type, name or company name, tax ID, tax office, address, city and billing email. We store AI chat messages, including your messages and assistant replies, their dates and their association with your account and the tracked brand, as well as WhatsApp assistant messages.

3. Why we use it and our legal basis

Under GDPR Article 6(1)(b), we use data to verify accounts, manage sessions, provide chosen brand tracking, AI analyses, chat and assistant functions, administer subscriptions, collect payments, issue invoices and receipts, and handle cancellations and payment questions where this is necessary for a contract with you personally. For company representatives, the basis is our legitimate interest in providing and administering the company’s service and communicating with its representatives, under Article 6(1)(f), subject to their rights and interests.

Daily quota tracking, abuse and fraud detection, preventing data leakage, protecting payments, cookie-free visit measurement on our own server (Umami), error monitoring with Sentry, bot protection with Cloudflare Turnstile and establishing or defending claims rely on legitimate interests under Article 6(1)(f), after considering the effect on individuals. Accounting, tax and other mandatory records rely on legal obligations under Article 6(1)(c). Google Analytics measurement using cookies and Meta Pixel advertising measurement rely on consent under Article 6(1)(a). Acknowledging this notice is not consent.

4. Cookies and analytics

Session information is stored in your browser’s localStorage rather than session cookies. Google Tag Manager and Google Analytics load only if you accept in the cookie banner. If you accept, Google Analytics sets _ga and _ga_* measurement cookies (up to 2 years). If you reject or make no choice, these tools do not load and no measurement request is sent to Google. Our self-hosted Umami counter uses no cookies.

Meta Pixel, provided by Meta Platforms Ireland Ltd., loads through Google Tag Manager only if you accept in the cookie banner. It measures advertising results and uses the _fbp cookie, which lasts 90 days. To change your choice, delete the adlizer.app site data in your browser; the banner will appear again.

5. Who receives the data

DijitalPi processes data on our behalf in Turkey. Hostinger provides server infrastructure in Europe, with data centres in Germany/Netherlands. Brevo sends transactional emails, such as password resets; only your email address is passed on. Umami runs on our own server.

Stripe processes payments, recurring billing and checkout data, with United States and EU operations. Stripe acts as processor for some activities and as controller for its own purposes, including certain fraud prevention and legal compliance activities. See https://stripe.com/privacy and https://stripe.com/legal/dpa.

We read public advertising data from Meta Ad Library. We do not sell your data. Data for advertising measurement is shared through Google and Meta tools only if you accept in the cookie banner. Relevant records may be disclosed to competent authorities when legally required, limited to the information needed.

Sentry (Functional Software Inc.) provides error monitoring through an ingestion endpoint hosted in Germany in the European Union. From the browser it receives error records, page addresses with secret parameters removed, browser and device information, and account identifiers. Session replay is recorded when an error occurs, with all text masked and images and media blocked. Automatic inclusion of default personal information is disabled.

Cloudflare Turnstile (Cloudflare, Inc.) checks for bots in email registration, phone registration and code login, the WhatsApp signup flow after a public scan, public scan and contact forms. The browser loads a component from Cloudflare; the server sends the verification token and IP address to Cloudflare.

Anthropic PBC in the United States receives brand and advertising data for AI analyses and chat, together with the last 20 conversation messages, including your messages and assistant replies. Do not enter unnecessary personal data in chat.

Phone registration and verification codes, WhatsApp alerts and assistant messages use Meta's WhatsApp Cloud API. Your telephone number and message content are passed to Meta. Assistant messages, including the previous user message when available, are sent to TypeSafe (Jev) for intent classification.

If you connect your own Slack or Discord webhook address, alerts are sent to that service on your instructions.

6. International transfers

Servers are in Europe. Access by DijitalPi in Turkey involves a transfer from Europe to Turkey. This requires appropriate safeguards: EU Standard Contractual Clauses, controller-to-processor module, supported by the required transfer assessment and any necessary additional protections. This notice does not confirm that the clauses have been signed.

Anthropic, Cloudflare, Google and Meta may process data in the United States or outside the European Economic Area (EEA). TypeSafe may process data outside the EEA. The safeguard depends on the recipient, role and transfer. Contact DGI WORKS AB for information and a copy of relevant clauses, subject to lawful redactions protecting confidential information.

7. How long we keep it

Account data is kept while your account is active. If you delete your account, your information is permanently erased within 30 days, except where legal obligations, such as invoice records, require longer retention. IP addresses in server logs are kept for 7 days. Google Analytics cookies last up to 2 years.

Subscription administration data is kept for the subscription’s duration. Records needed for accounting and tax obligations are retained afterwards; other records are kept only as long as needed for their purposes, including justified claims. We delete or anonymize data when no longer needed. Stripe’s retention when acting as controller follows its own legal obligations and privacy information.

The _fbp cookie lasts 90 days. Sentry error monitoring data is kept for a limited period.

8. Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests and withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. To withdraw your consent for Google Analytics and Meta Pixel, delete the adlizer.app site data in your browser and reject in the banner when it reappears. Contact us to exercise your other rights or for help withdrawing consent.

Rights are not absolute: legal recordkeeping may prevent immediate erasure, and portability applies only to qualifying processing. We may need proportionate information to verify your identity. You may complain to Sweden’s Integritetsskyddsmyndigheten (IMY) or another competent authority without contacting us first: https://e-tjanster.imy.se/en/klagomal.

9. Contact

Contact DGI WORKS AB about this notice or your rights: info@dgiworks.com. Registered address: Nordanväg 18, 222 28 Lund, Sweden.

DGI WORKS AB, org. no 559385-5074, VAT SE559385507401, Nordanväg 18, 222 28 Lund, Sweden.

If there is a difference between the English version and a translation, the English version prevails.