1. Two kinds of data
Data about you — the person or company with an account. For this we are the controller, and this policy explains what we do with it.
Data about your visitors — the clicks you track. For this you are the controller and we are your processor: we hold it, we do not decide what it is for, and we act on your instructions. The terms are in the Data Processing Addendum.
The distinction matters. If one of your visitors asks us about their data, we refer them to you, because we cannot make decisions about it.
2. Data about you
| What | Where it comes from |
|---|---|
| Name, email address, password (stored as a hash, never in the clear) | You, at registration |
| Company name, billing address, tax identifiers | You, when a plan is purchased |
| Payment card details | Handled by our payment processor. We see the last four digits and the outcome, never the full number. |
| Sign-in records: time, IP address, browser | Generated when you use the app |
| Support messages and anything you send us | You |
| Questions you ask the Copilot — passed to the AI that answers them and not kept afterwards; see section 7 | You, when you use the Copilot |
3. Data about your visitors
When a click passes through one of your tracking links, the service records the IP address, the derived location and network (country, region, city, ISP, network number), the user agent and the device it describes, the referring URL, the campaign parameters, and the outcome — where the visitor was sent and whether the request scored as automated.
The IP address is used to derive the location, to detect fraud and to recognise a repeat visit within a short window. We do not build a profile of any individual across your account or anyone else’s, and there is no identity graph anywhere in this product.
The Copilot’s AI never receives a visitor’s IP address or click ID: it works from grouped figures. An IP address leaves the service only when you press a button to exclude it in your own advertising account, and then only to that platform — see section 7.
What you collect, why, and what lawful basis you rely on are your decisions as controller. Your own privacy notice is what your visitors read.
4. This website
This site runs our own tracking tag — the same UTMCAP tag our customers use — so we can see which of our campaigns bring visitors and which pages lead to a demo request. It sends the address of the page, the page you came from, your browser and your IP address (as every web request does) to UTMCAP, which we run ourselves. It sets two cookies on utmcap.com, _utmcap_cid and _utmcap_src, which last 30 days. In the EEA, the UK and Switzerland it does not load until you agree in the banner, and never loads if you say no. There are no third-party analytics, advertising pixels or trackers.
Typefaces, styles and scripts are served from this site rather than from anyone else’s. The one company involved is Cloudflare, which serves the page and processes the request in order to deliver it. The one exception is the booking page, which shows Google’s appointment calendar; what you enter there goes to Google under its own privacy policy.
The demo window. When you go to leave, a window may offer a demo. It remembers in your browser (local storage, utmcap-demo-popup) that it has been shown, so it never shows again. If you send it your name and email, we keep them with your country and the page you were on, email them to our team, and add you to our demo list in SendCoop, the email platform we use, which sends you a welcome email with a link to book a time. Every email has an unsubscribe link, and we delete your details whenever you ask.
The one exception is the support chat, and only if you open it. Pressing “Chat with us” loads our support chat from chat.utmcap.com, which we run ourselves. It sets one cookie, cw_conversation, which lasts up to a year, so your conversation is still there when you come back. If you write to us, we keep what you write, any name or email address you give, your browser and the address of the page you started from, so we can answer. Every answer comes from a person. We delete a conversation whenever you ask, and remove old ones we no longer need.
5. Why we hold it
- To provide the service — the contract between us. Account data, sign-in records and billing details.
- To keep it secure — our legitimate interest. Sign-in records, rate limiting, abuse investigation.
- To bill and to meet tax obligations — legal obligation.
- To answer you — support correspondence, kept while a question is open and for a period afterwards in case it recurs.
- To arrange a demo you asked for — your consent, given by sending the form. Withdraw it with any email’s unsubscribe link.
- To measure our own marketing — your consent in the EEA, the UK and Switzerland, and our legitimate interest elsewhere. The tag described in section 4.
We do not use your data to advertise to you, and we do not send marketing email to people who have not asked for it.
6. Who else sees it
Only the suppliers needed to run the service, each for one purpose, each under a contract that forbids using the data for anything else. The current list is in the DPA, which is the document that gets updated when it changes.
We disclose data to an authority only where legally required, and where we are permitted to tell you, we will.
We never sell personal data. There is no arrangement under which we could.
7. The Copilot
The Copilot reads your campaigns’ figures each morning and suggests what to block, scale or fix. Its checks are plain arithmetic run on our own servers, and nothing about your visitors is sent anywhere to produce them. Where you have connected a Google Ads or Microsoft Advertising account, it also reads that account’s search terms, through your connection.
Asking it a question. The question, and the figures its AI looks up to answer it, go to the AI provider that answers. Those figures are grouped — totals by campaign, zone, placement, country or device, and the names of your campaigns, sources and offers — never a visitor’s IP address, a click ID or any of your keys. We keep neither the question nor the answer: only that a question was asked, by whom, when, through which provider, and its size, which is how a plan’s monthly questions are counted.
Which provider answers depends on you. UTMCAP’s built-in AI is run by a provider named as a sub-processor in the DPA. If you connect your own AI with your own API key, your questions go to that provider under your own agreement with it.
Changes in your advertising accounts. Where you connect an advertising account and press a button to apply a Copilot change — block a zone, add a negative keyword, change a bid or a budget, pause a campaign — we make that change in your account there. Nothing is changed without that press. Excluding an IP address is the one change that sends a visitor’s data to the platform: the address itself, to your own account. Every change is logged, and can be undone.
8. How long
- Account and billing records: while the account is open, then as tax law requires.
- Click records: in full for the retention period of your plan. After that, the visitor’s personal details — IP address, browser string, the full referring address, and query strings in page addresses — are removed; what remains (country, device, campaign, revenue) no longer identifies anyone, and is deleted after two years at most.
- Copilot questions: the question and answer are not kept; the record that one was asked is kept with the account’s usage records.
- Changes the Copilot made in your advertising accounts: logged while the account is open.
- Sign-in and security logs: 12 months.
- Support correspondence: 24 months.
- After an account closes: 30 days, then deletion. See the Terms, section 8.
9. Security
Passwords are stored using a memory-hard hashing function, never reversibly. Traffic is encrypted in transit. Backups are encrypted, and are verified by restoring them rather than by assuming they worked. Access to production systems is limited to those who need it, by key rather than password.
If a breach affects your data, we will tell you without undue delay and with what we actually know at the time, rather than waiting for a complete account.
To report a vulnerability: [email protected]. We will not pursue anyone who reports one in good faith and does not access or alter other people’s data while doing so.
10. International transfers
The service runs on infrastructure in more than one country, and clicks are answered from whichever of Cloudflare’s locations is nearest the visitor. Where personal data moves outside the country it was collected in, it moves under the Standard Contractual Clauses or an equivalent recognised mechanism.
11. Your rights
Depending on where you live, you may have the right to a copy of your data, to correct it, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form. To exercise any of them, write to [email protected]. We answer within one month and we do not charge for it.
You may also complain to the data protection authority where you live. We would rather you told us first, but it is your right either way.
12. Contact
Adspayingmedia LLC, 558, 447 Broadway, 2nd Floor, New York, NY 10013, United States.
Privacy questions: [email protected]. Anything else: [email protected].