> What Public Ads API keeps about you and the calls you make, and why.

Web version: https://publicadsapi.com/legal/privacy · Last updated: 2026-10-21

# Privacy Policy

Last updated 2026-10-29.

**Draft for review.** This page is a draft for review by the founder and a solicitor before launch. It is not yet in force and may change.

Sharp Studios Ltd (company number 15591412, England and Wales) runs Public Ads API and is the controller of the personal data described here, under the UK GDPR and the Data Protection Act 2018. Contact us at [matthew@publicadsapi.com](mailto:matthew@publicadsapi.com).

## 1\. Your account

-   Your email address, your name if you give it, your password if you set one (stored hashed), and sign-in sessions.
-   Your API keys, stored hashed, with their names and when each was last used.
-   Your plan, billing status and invoices. Stripe holds your card; we keep its customer id.
-   Messages you send us, and which onboarding emails we have sent you.
-   For an account an AI agent opened: the name and use case the agent gave, its user agent, and a one-way hash of the network address it signed up from.

We use these to run your account, bill you, keep the Service secure and answer you (the contract with you), and to send onboarding emails, which you can stop from any of them (our legitimate interest in helping you get started).

## 2\. Your calls

For each call to the API we log:

-   the time, the endpoint, the platform, which key made it and the request id;
-   the parameters you sent, as we read them: keywords, advertiser and page ids, domains, countries and dates, or the ad id;
-   the outcome, the credits used, how long it took and what it cost us to run;
-   for an unclaimed agent account, a one-way hash of the calling network address, for its daily limits.

We never log the ads we return. We use the log for your usage page and billing, to investigate failures and abuse, and to improve the Service (contract and legitimate interests). Each call's entry is kept for 7 days, then deleted; what billing needs, your credits used each month, is kept as a monthly total with your account. Please don't put personal data in a search: searching for private individuals is against our [terms](https://publicadsapi.com/legal/terms).

## 3\. The ads

The ads we return are published by the platforms in their public ad libraries. We fetch them when you ask and pass them to you. We don't store them or their content: there is no store or cache of ads, so the same search asked again is fetched again. The server keeps a few details in its memory between calls, such as an advertiser's name or a video's id, until it restarts.

Some ads include personal data, such as the name of a person who advertises in their own name, or a person in an ad's image. We process it only to return the ad to you, relying on our legitimate interest in giving access to advertising the platforms make public for transparency. What you then do with it is your responsibility.

Our requests to the platforms carry your search parameters, never your account details. Requests to Meta and LinkedIn go through a residential proxy network (DataImpulse), so those platforms see its addresses.

## 4\. The website

We measure visits and use of the website and dashboard with PostHog, in the EU, with session recording off and IP addresses discarded. The browser keeps a few things locally so the site works: see [Cookies](https://publicadsapi.com/legal/cookies). When you sign up we keep the page and link you first arrived from, to know which channels bring people.

## 5\. Who we share it with

We use these sub-processors, each under a contract that limits them to providing their service to us. We don't sell personal data or share it for advertising.

| Provider | What for | Where |
| --- | --- | --- |
| Fly.io | Runs the Service: the API, website and the browsers that read the libraries. | UK (London), USA (company) |
| Neon | The database: accounts, keys, plans and the call log. | UK (London), USA (company) |
| Stripe | Payments and invoices. Stripe holds your card details; we never see them. | USA, EU |
| PostHog | Website and dashboard analytics, and error reports. No session recording. | EU |
| OpenRouter | Language models used for two things only: reading the text of a Google text ad from its image, when you ask for that ad by id (off unless we turn it on; the model gets the ad image), and answering our own weekly questions about how AI search sees us (the model gets those questions). They never get your account details or your searches. | USA |
| DataImpulse | A residential proxy network: carries our requests to Meta and LinkedIn, so they see its addresses, not ours or yours. | USA, with exit addresses worldwide |
| Cloudflare | DNS, network protection, sending our emails (sign-in links, receipts, usage warnings), and the scheduler that starts our hourly jobs. | Global |

Where personal data goes outside the UK, it is protected by UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

## 6\. How long we keep it

-   Call log (each call's parameters, outcome, credits and cost): 7 days, then deleted.
-   Account, keys and each month's credit totals: while your account is open, then deleted.
-   Invoices and payment records: six years after the year they relate to, as UK tax law requires.
-   The daily counts behind an unclaimed agent account's limits: two days. Its address hash stays with the account, and with its calls in the call log for 7 days.

## 7\. Data processing agreements

We don't offer a data processing agreement. We don't process personal data on your behalf: you send us searches of public libraries, and we are the controller of your account and call data. If your use needs one, write to us.

## 8\. Your rights

You can ask for a copy of your personal data, or for it to be corrected, deleted, restricted or sent to you in a portable form, and you can object to processing based on legitimate interests. Write to [matthew@publicadsapi.com](mailto:matthew@publicadsapi.com); we answer within a month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

## 9\. Security

Everything is sent over HTTPS. API keys and passwords are stored only as hashes, and access to the database is limited to the people and systems that need it.

## 10\. Changes

We will update this page when what we keep changes, and email you about a material change before it takes effect.