Data Protection & Privacy Architecture

Privacy Policy

Last Updated: September 14, 2026 • Compliant with GDPR (EU 2016/679) & CCPA/CPRA (Cal. Civ. Code § 1798.100)

Our Privacy Commitment

AdsOnIt is engineered around principles of data minimization and zero-trust security. We never sell your personal data. Creator bank details are protected via application-layer AES-256-GCM encryption, government identity documents are rendered exclusively through 15-minute ephemeral presigned links with anti-leak watermarking, and staging buffers automatically purge unpaid uploads after 2 hours.

01.Information We Collect & How It Is Used

Account & Profile Information

When you register, we collect your email address, display name, username, and profile biography to administer your creator or sponsor account.

Creator Banking Coordinates

Account numbers, routing numbers, and PayPal emails needed for disbursements. Strictly encrypted via AES-256-GCM before entering the database.

KYC Verification Documents

Government-issued photo identification submitted by creators to verify payout eligibility and deter fraud. Stored in private, non-public storage.

Telemetry & Audit Trail

IP addresses and browser user-agents recorded in immutable administrative logs for zero-trust security compliance and fraud prevention.

02.Cryptographic Security & Zero-Trust Defense

AES-256-GCM Bank Encryption: Banking data is encrypted using authenticated AES-256-GCM with unique initialization vectors and authentication tags per record. The cryptographic key is isolated in secure server environment variables and never written to database storage.

Ephemeral Presigned URLs: Government ID uploads are never accessible via static URLs. Administrative reviewers view documents through time-limited presigned URLs that expire in 15 minutes.

Anti-Leak Watermarking: ID previews are dynamically watermarked in real-time with the administrative reviewer's email, IP address, and UTC timestamp to eliminate internal data leaks.

Two-Factor Step-Up Authentication: Accessing decrypted banking details or triggering disbursements requires on-demand step-up re-authentication by verified administrators.

03.Data Retention & Automated Lifecycle Purging

Staged Checkout Logos (2-Hour Purge): Unpaid checkout sponsor logos uploaded to our temporary staging bucket (staged-logos/) are automatically purged after 2 hours. Permanent storage is only assigned upon verified payment completion.
Financial & Transaction Records: In compliance with federal tax and banking laws, transaction ledgers and disbursement receipts are retained for 7 years.
Published Artwork & Sponsor Placements: Base artwork and winning sponsor graphics are maintained for the active and historical duration of the campaign card.

04.Cookies & Local Storage

AdsOnIt uses strictly necessary HTTP-only cookies (SameSite=Lax, Secure) to maintain authenticated sessions and protect against cross-site request forgery (CSRF). We do not deploy third-party advertising tracking pixels or cross-site data brokers.

05.Your Rights (GDPR & CCPA/CPRA)

Under the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), you enjoy statutory rights regarding your personal information:

Right to Access: Request a complete machine-readable copy of your personal data held by AdsOnIt.

Right to Rectification: Update inaccurate or incomplete profile or financial coordinates.

Right to Erasure (“To Be Forgotten”): Request permanent deletion of your profile and uploaded media.

Right to Non-Discrimination: We will never deny service or degrade quality for exercising your privacy rights.

Exercising Data Deletion & Contact

To request full account deletion, export your data, or submit privacy inquiries, email our Data Protection Officer at:

privacy@adsonit.comResponse SLA: Within 30 calendar days