Privacy Policy

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Further details are in our imprint. For any privacy question, write to the address above.

In short, this is what happens on this website:

• If you only browse the pages, we process nothing beyond the technically necessary server log data.
• Marketing tools (Google Tag Manager, Meta Pixel, LinkedIn Insight Tag) and embedded YouTube videos load only after you opt in through the consent banner. Before that, nothing is loaded for those purposes and nothing is stored on your device.
• If you fill in our enquiry form, we store your answers in our database and receive a notification in Slack. This also applies to abandoned forms (see section 6).
• We use Cal.com for scheduling and Stripe for payments.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes the data on our behalf as a processor under a data processing agreement.

On every request the server automatically records data that your browser transmits:

• IP address of the requesting device
• date and time of the request
• the address requested and the amount of data transferred
• the response status code
• the referrer, meaning the page you came from
• browser type, browser version and operating system

This data is technically necessary to deliver the website, to keep it stable and secure, and to defend against attacks. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). This data is not merged with other data sources.

Vercel is based in the United States. The transfer is safeguarded by the European Commission's standard contractual clauses, which form part of the data processing agreement (Art. 46(2)(c) GDPR).

We only store information on your device, or read information from it, where that is strictly necessary to operate the website or where you have consented (section 25 TDDDG, the German implementation of the ePrivacy rules). We collect your consent through our own consent banner. No external consent provider is involved.

No consent needed, technically necessary

• aot_consent (localStorage plus a cookie of the same name): stores your choice in the consent banner so we do not have to ask again on every visit and can evidence your decision. Lifetime: 12 months. It holds only the choice made and the time it was made, no identifier for you.
• aot_attribution (sessionStorage): see section 6, campaign parameters.

Only with your consent

• Marketing and measurement: Google Tag Manager, and through it the Meta Pixel and the LinkedIn Insight Tag (sections 9, 10 and 11).
• External media: embedded videos from YouTube (section 12).

The legal basis for these is your consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. Until you opt in, no script is loaded for these purposes, no connection to those providers is made, and nothing is stored on your device.

Changing or withdrawing your consent

You can change or withdraw your choice at any time with effect for the future. Use the "Cookie settings" link in the footer of every page, or open it here: Open consent settings. Withdrawing is as easy as giving consent and does not affect the lawfulness of processing carried out beforehand. Once you withdraw, we stop loading the tools concerned immediately. Cookies already set by those providers should additionally be deleted in your browser settings.

If you write to us by email, we process your details to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract, and otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR).

On our contact and landing pages, a multi-step form asks a few questions about your company and your advertising budget. It processes:

• email address and name
• your website or company web address
• monthly advertising budget (as a range) and whether a budget is allocated
• your biggest current challenge, with an optional free-text field
• the tier we calculate from those answers
• campaign parameters from the URL you arrived on: utm_source, utm_medium, utm_campaign, utm_content, utm_term, placement, fbclid, gclid, a landing page slug, plus the first page you opened and the time you did

Incomplete entries are stored too

The form saves your progress step by step. As soon as you have entered your email address in the first step and pressed continue, we transmit what you have entered so far to our database and store it there. This happens even if you abandon the form afterwards and never submit it. Such entries are marked as incomplete. The legal basis for storing abandoned entries is our legitimate interest in being able to attribute started enquiries and follow up where appropriate (Art. 6(1)(f) GDPR). You can object to this at any time under Art. 21 GDPR, an informal email to the address above is enough.

For a fully submitted enquiry the legal basis is Art. 6(1)(b) GDPR, because the processing serves steps taken prior to entering into a contract.

Campaign parameters

When you reach our site through an ad, the address bar carries campaign parameters. We put those parameters into your browser's sessionStorage so that they can be sent along when the form is submitted and we can attribute the enquiry to the right campaign. The entry is deleted as soon as you close the browser tab. The legal basis is our legitimate interest in correctly attributing our enquiries (Art. 6(1)(f) GDPR).

Recipients

• Supabase (Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992) operates the database that holds the form data, as a processor on our behalf. Where data is processed outside the European Economic Area, we rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
• Slack (Slack Technologies Limited, One Park Place, Hatch Street Upper, Dublin 2, Ireland): when you submit the form in full, we post a notification containing your answers into our internal Slack channel so we can respond quickly.

At the end of the form we embed a booking calendar from Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Only at that point is a connection to Cal.com's servers established, which transmits your IP address and technical details about your browser. If you book a slot, Cal.com also processes your name, email address, the chosen time and your time zone in order to handle the booking and the calendar invitation.

The legal basis is Art. 6(1)(b) GDPR, because the embed serves the purpose you initiated, namely arranging a call with us. The transfer to the United States is safeguarded by standard contractual clauses (Art. 46(2)(c) GDPR). If you would rather avoid this, stop before the final step of the form and email us instead.

We use Stripe for paid offers. No Stripe scripts run on our own website. Only when you click a payment link are you forwarded to a checkout page operated by Stripe. From that moment on, Stripe is responsible for the data collected there, in particular your payment and billing details. For customers in the European Economic Area the provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

The legal basis for processing a purchase you have asked for is Art. 6(1)(b) GDPR. Stripe's own privacy policy applies: stripe.com/privacy.

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is not itself an analytics tool and, according to Google, stores no cookies. It manages and delivers the tools listed below. Loading it transmits your IP address to Google.

Tag Manager loads only after your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Without consent the script is not added to the page, and so neither the Meta Pixel nor the LinkedIn Insight Tag loads either.

We advertise on Facebook and Instagram. To measure which ads lead to enquiries and to build advertising audiences, we use tools from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

Meta Pixel in the browser

The Meta Pixel is delivered through Google Tag Manager and therefore loads only after your consent. It sets the cookies _fbp and _fbc, records page views and reports to Meta when you have submitted an enquiry. This transmits, among other things, your IP address, details about your browser and device, and the page you were on.

Meta Conversions API on the server

In addition, we transmit the same events from our server to Meta so that they are still measured when the browser pixel is blocked. What we send:

• your email address and your first and last name, each irreversibly hashed with SHA-256 beforehand, so never in clear text
• your IP address and your user agent
• the cookie values _fbp and _fbc, where present
• the type of event (enquiry submitted, call booked), a calculated value for the enquiry, and the campaign parameters from section 6

Meta matches the hashed details against the user accounts in its networks. Both events carry a shared identifier so that the browser and server event are not counted twice.

The legal basis for the pixel and for the Conversions API alike is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Without consent for the marketing category we send no events to Meta, not from the server either.

For the pixel we assume that we and Meta are joint controllers under Art. 26 GDPR as far as collection and transmission are concerned. Meta alone is responsible for the further processing. Meta also transfers data to the United States. Details, and the rights you have towards Meta, are set out in Meta's privacy policy.

Google Tag Manager also loads the Insight Tag from LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. It measures how our LinkedIn ads perform and lets us build advertising audiences. It transmits your IP address, details about your device and browser, the page you opened and timestamps to LinkedIn, and sets cookies. LinkedIn can link this data to your LinkedIn account if you are logged in there. We ourselves receive only aggregated reports from LinkedIn, never details about individuals.

This tag too loads only after your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). LinkedIn also transfers data to the United States. See LinkedIn's privacy policy.

Some pages embed videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). These videos do not load automatically. You first see only a preview image and a notice. The connection to YouTube is made only once you explicitly press the button to load it. Google then learns your IP address, may set cookies, and, if you are signed in to Google, may associate your behaviour with your account.

The legal basis is your consent, given by that click or through the consent banner (Art. 6(1)(a) GDPR, section 25(1) TDDDG). We remember your decision for further videos until you withdraw it. Google's privacy policy applies.

The fonts on this website are served from our own server. There is no connection to Google Fonts or any other font service, and no IP address is passed to a third party for that purpose. Images and video files in our portfolio are served either from the same server or from our own Supabase storage (see section 6).

• Server log files: short term, at most 30 days, after which they are deleted or anonymised.
• Incomplete, abandoned form entries: no later than 6 months after the last input.
• Completed enquiries and the related correspondence: up to 24 months after the last contact, where no contract results.
• Contract, invoice and accounting records: for the statutory commercial and tax retention periods of 6 and 10 years respectively.
• Evidence of your consent: 12 months, after which we ask again.

Beyond that we delete personal data as soon as the purpose of the processing no longer applies and no statutory retention obligation stands in the way.

You have the following rights towards us:

• access to the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing we base on a legitimate interest, in particular the storage of abandoned form entries (Art. 21 GDPR)
• withdrawal of a consent you have given, with effect for the future (Art. 7(3) GDPR)

An informal email to daniel@adsontap.io is enough for any of these. Exercising your rights is free of charge.

If you believe that we process your data unlawfully, you can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

You may also turn to the supervisory authority where you live or work.

We update this policy when the law changes or when we change something on the website that affects processing. The version published here is the one that applies. This version: 19 August 2026.