Your privacy matters to us. We collect only what we need to run AdBinge, protect what we collect, and give you control over it. This policy explains, in plain language, what personal information AdBinge collects, why, who we share it with, how long we keep it and the rights you have, wherever you live. Region-specific information is in sections 10 to 13.
1. Who we are
AdBinge is operated by Combined Intelligence (Pty) Ltd, a company registered in the Republic of South Africa (registration number [Registration number]), of [Address] ("AdBinge", "we", "us"). We decide why and how your personal information is processed, so we are the controller (GDPR / UK GDPR), the business (US state privacy laws) and the responsible party (POPIA) for it.
Privacy questions and requests: info@combinedintelligence.ai. Our Information Officer (POPIA) is [Information Officer name]. Representatives in the EU and UK are listed in section 10.
This policy covers the AdBinge mobile apps, the website at adbinge.io (including shared ad pages), our waitlists and related communications (the Service). It applies to viewers, brands and agencies, and visitors without an account. Brands that upload ads are responsible for any personal information that appears in their own ads (see our Terms).
2. Summary
- We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising.
- AdBinge is a feed of ads, but we do not run third-party ad trackers and we don't give brands your identity. Brands see aggregated statistics only.
- The website is cookie-light: only strictly necessary and functional storage, no analytics or advertising cookies (see Cookies).
- Web visitors are counted with a salted, one-way hash, not a raw IP address.
- You can access, correct, delete and export your data, and object to or withdraw consent for processing (section 9).
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Account details | Email address, display name, handle, account type (viewer or brand), confirmation that you meet the minimum age [age gate to be added at sign-up], and a password stored only in hashed form by our authentication provider. | You |
| Brand details & content | Brand or agency name, contact person, the ads you upload (video, title, category, call to action, landing page link), and review outcomes. | Brands and agencies |
| Activity | Ads viewed, watch time, likes, saves, shares, ratings, call-to-action taps and reports, with timestamps. | Your use of the Service |
| Points & referrals | Points earned and why, daily totals, leaderboard position (shown by display name), your invite code and who joined through it. | Generated by the Service |
| Web visitor data | When a shared ad is opened on the web: the ad, the referral code in the link, and an anonymous visitor key made from a salted, one-way hash of the IP address and a random browser ID. We do not store raw IP addresses for these events. | Your browser |
| Waitlist | Email address (for brands, also name and company), the consent wording you agreed to and when, and a salted hash of your IP address used only to prevent abuse. | You |
| Technical data | IP address, device and browser type, and request and error logs, processed by our hosting and video providers to deliver and secure the Service. | Your device |
| Communications & reports | Messages you send us, content and copyright reports, appeals, and our replies. | You |
We do not ask for, and ask you not to send us, special categories of personal information (such as health, religion or biometric data). We don't collect precise location, contacts or payment card details.
4. How we use it and our legal bases
Where the GDPR, UK GDPR, POPIA or a similar law applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Create and run your account; show you the feed; let you like, save and share | Contract (providing the Service you asked for) |
| Award points, run leaderboards and referral credits | Contract |
| Review, publish and measure brands' ads; give brands aggregated performance statistics and attention scores | Contract (with the brand); legitimate interests (operating a curated platform) |
| Moderation, preventing fraud, points abuse, spam and security incidents | Legitimate interests; legal obligation |
| Improve the Service using aggregated or de-identified statistics | Legitimate interests |
| Waitlist emails and product news | Consent, which you can withdraw at any time |
| Service messages (security, changes to terms) | Contract; legal obligation |
| Handle reports, copyright notices, appeals and legal requests; keep required records | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights. You can object (section 9). We do not use your information to build advertising profiles or to target you with third-party advertising.
5. Who we share it with
We share personal information only as described here. Our service providers act on our instructions under written data processing terms:
- Supabase: database, authentication and storage, hosted in [Supabase hosting region].
- Cloudflare: website hosting (Workers), content delivery, security and video streaming (Stream).
- Expo: app builds, updates and push-notification delivery.
- Apple and Google: app distribution and, if enabled, push notifications.
- [Email provider]: sending waitlist and account emails.
We may also share information:
- With brands, in aggregate only: views, watch time, likes, saves, shares and attention scores, never your identity or contact details.
- Publicly, by your choice: your display name and points on leaderboards, and anything you choose to share.
- For legal reasons: to comply with law, valid legal process or a regulator's request, and to protect people, our rights and the Service.
- In a business transfer: to a successor if AdBinge is reorganised, merged or sold. We will tell you before your information becomes subject to a different privacy policy.
6. International transfers
We are based in South Africa, and our providers process data in other countries, including the United States and the EU. When we transfer personal information across borders we use recognised safeguards:
- For the EEA: the European Commission's Standard Contractual Clauses, or an adequacy decision such as the EU–US Data Privacy Framework where the recipient is certified.
- For the UK: the UK International Data Transfer Addendum, or the UK Extension to the Data Privacy Framework.
- For South Africa: the conditions in section 72 of POPIA, such as binding agreements that give protection substantially similar to POPIA.
You can ask us for a copy of the relevant safeguards (commercial terms may be redacted).
7. How long we keep it
| Data | Retention |
|---|---|
| Account details, profile, likes and saves, points, invite code and referrals | While your account is open. When you delete your account they are deleted immediately |
| Activity and web visitor events | [24 months], then aggregated or anonymised. When you delete your account, your events are immediately unlinked from you (anonymised) and your invite code is removed from share records |
| Brand ads, their videos, statistics and moderation records | While the ad is live, plus [24 months] for disputes and transparency records. When a brand deletes its account, its ads, their Cloudflare Stream videos and the related statistics and reviews are deleted immediately |
| Waitlist | Until you unsubscribe or ask us to remove you, or [12 months] after launch, whichever is first. A waitlist entry with the same email address is deleted when you delete your account |
| Abuse-prevention hashes and server logs | [30 days], unless needed to investigate an incident |
| Messages, reports, copyright notices and appeals | [3 years] after the matter closes |
Account deletion. You can delete your account at any time in the app (Profile, then Delete account), or by following the steps at adbinge.io/delete-account. Deletion is permanent. Totals that no longer identify you stay, for example the number of likes or views an ad has received, as do moderation decisions you made as a curator, with your name removed. Copies in our providers' encrypted backups are overwritten within [backup retention period, e.g. 7 days]. We may keep specific records for longer only where the law requires it, for example to deal with an ongoing legal claim.
8. Security and breaches
We protect personal information with technical and organisational measures appropriate to the risk. These include encryption in transit, row-level access controls in our database, least-privilege access for staff, salted hashing of IP addresses, and provider security certifications. No system is completely secure. If a breach is likely to put you at risk, we will notify you and the relevant authorities as the law requires, for example within 72 hours to a lead supervisory authority under the GDPR, and as soon as reasonably possible to the Information Regulator and affected people under POPIA.
9. Your rights
Depending on where you live, you may have the right to:
- Access your personal information and get a copy (in a portable format where applicable);
- Correct inaccurate or incomplete information;
- Delete your information, subject to legal exceptions;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Restrict processing in certain cases;
- Withdraw consent at any time, without affecting earlier processing;
- Not be subject to solely automated decisions with legal or similarly significant effects (see section 15);
- Complain to a data protection authority (sections 10 to 13).
To use these rights, email info@combinedintelligence.ai or delete your account yourself in the app (Profile, then Delete account; see adbinge.io/delete-account). [In-app data export to be added]. We may need to verify your identity. We respond within one month (GDPR / UK GDPR), 45 days (US state laws) or 30 days (POPIA). These periods can be extended where the law allows, and we will tell you if we do. Requests are free unless they are manifestly unfounded or excessive.
10. EEA, UK and Switzerland
If you are in the European Economic Area, the United Kingdom or Switzerland:
- The legal bases we rely on are listed in section 4, and your rights in section 9.
- EU representative (GDPR Art. 27): [EU representative (GDPR Art. 27) name and address].
- UK representative (UK GDPR Art. 27): [UK representative (UK GDPR Art. 27) name and address].
- You can complain to the data protection authority where you live or work. In the UK that is the Information Commissioner's Office (ico.org.uk). In Switzerland it is the FDPIC.
- We will ask for your consent before setting any non-essential cookies or similar technologies (see Cookies).
11. United States
This section applies to residents of US states with comprehensive privacy laws, including California (CCPA as amended by the CPRA), Colorado, Connecticut, Virginia, Texas and others.
Categories we collect (past 12 months)
| Category (CCPA) | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Email, display name, handle, account ID, hashed IP address | Service providers (section 5) |
| Commercial information | Points, referral and brand account records | Service providers |
| Internet or other electronic network activity | Ads viewed, watch time, likes, shares, logs | Service providers; brands in aggregate only |
| Professional information | Brand or agency name and role (brand accounts) | Service providers |
| Inferences | Category interests used to order your feed [confirm whether the feed is personalised] | Not disclosed |
We do not collect sensitive personal information as defined by these laws, other than account login credentials used only to secure your account. Sources, purposes and retention are described in sections 3, 4 and 7.
No sale, no sharing, no targeted advertising
We do not sell personal information, and we do not share it for cross-context behavioural advertising or use it for targeted advertising, including that of consumers under 16. Because of this we do not offer a "Do Not Sell or Share My Personal Information" link. If that ever changes, we will update this policy, add that link and honour opt-out preference signals such as Global Privacy Control. We already treat a Global Privacy Control signal as a valid opt-out request.
Your US rights
You may request to know, access, correct, delete and port your personal information, and to opt out of sale, sharing, targeted advertising and profiling. You may also limit the use of sensitive personal information. You can use an authorised agent, and we may ask the agent for proof of authority. We will not discriminate against you for exercising your rights. If we deny your request, you can appeal by replying to our decision. If the appeal is denied, you can contact your state Attorney General.
12. South Africa (POPIA)
- We process personal information in line with the eight conditions for lawful processing in POPIA and its Regulations.
- Our Information Officer, [Information Officer name], is registered with the Information Regulator [registration confirmed: yes / pending]. You can reach them at info@combinedintelligence.ai.
- You can object to processing (Form 1 under the POPIA Regulations) and request correction or deletion (Form 2). You can also request access to records under PAIA; our PAIA manual is available on request [or link to PAIA manual].
- We send direct marketing by email only with your consent, or to existing users about similar services, and every message includes a free way to opt out (section 69 of POPIA).
- You can complain to the Information Regulator (South Africa) through inforegulator.org.za. Please contact us first so we can try to help.
13. Other regions
If you live elsewhere, for example in Brazil (LGPD), Canada (PIPEDA), Kenya, Nigeria or Australia, you have the rights your local law gives you. We will handle your request in line with that law, and you can complain to your local data protection authority.
14. Children
AdBinge is not directed at children. You must be at least 13, or older where your local law requires, to use the Service. For example, the minimum is 16 in EU countries that set the GDPR digital-consent age at 16, unless a parent or guardian consents. In South Africa, POPIA treats anyone under 18 as a child: users aged 13–17 need the consent of a parent or guardian[confirm age policy and how guardian consent is collected]. Brand accounts are for adults (18+) only.
We do not knowingly collect personal information from children under 13 (or the applicable age), in line with the US Children's Online Privacy Protection Act (COPPA) and similar laws. If we learn that we have, we will delete it. Parents or guardians can contact info@combinedintelligence.ai. Ads in restricted categories (for example alcohol or gambling) are not shown to users under 18 or under the local legal age.
15. Moderation and automated tools
Uploaded ads may be pre-screened automatically, for example for format and obvious policy issues. A human makes the final decision to publish or decline an ad. Your feed is ordered using signals such as recency, category and engagement (see Terms, section 4). We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. When we restrict content or an account, we tell the affected user why and how to appeal (see Terms, section 9).
16. Cookies
We use only strictly necessary and functional storage on our website. See our Cookie Policy for the full list.
17. Changes
We will post any update here with a new version date. If a change is material, we will tell you in the app or by email before it takes effect, and ask for your consent again where the law requires.
18. Contact and complaints
Combined Intelligence (Pty) Ltd · [Address] · info@combinedintelligence.ai
Information Officer: [Information Officer name]
If you are unhappy with how we handled your information, please contact us first. You can also complain to your local data protection authority (see sections 10 to 13).