Privacy Policy
Last updated: 23 September 2026
This Privacy Policy explains how Plakard processes personal data of advertisers, publishers, visitors of our websites, and visitors of publisher websites that display Plakard ads.
1. Controller
Plakard Advertising OÜ, Pärnu mnt 139b, 11317 Tallinn, Harju maakond, Estonia ("Plakard", "we"). Contact: privacy@plakard.io.
2. Advertisers and publishers (account holders)
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, password, company or personal name, website | Creating and running your Account | Contract, Art. 6(1)(b) |
| Ads, placement designs, logos, default ads, settings | Providing the advertising services | Contract, Art. 6(1)(b) |
| Billing details: name, address, company registration number, VAT number; for EU consumers, evidence of location for VAT (billing country, card country, country derived from the IP address) | Invoicing and VAT | Legal obligation, Art. 6(1)(c) |
| Payment and payout data: payment status and amount, payout account, invoices | Taking payments, refunds, paying publishers | Contract and legal obligation, Art. 6(1)(b), (c) |
| Support requests | Answering you | Contract, Art. 6(1)(b) |
| IP address and request logs when you use the portals | Security and fraud prevention | Legitimate interest, Art. 6(1)(f) |
| Campaign and placement statistics | Reports, billing, fraud prevention | Contract; legitimate interest in preventing fraud |
Card details are handled by our payment provider; we do not receive full card numbers.
Account and billing data are needed to conclude and perform the contract and to meet our invoicing obligations. Without them we cannot open an Account, accept a Campaign Order, pay a publisher or issue an invoice.
Publishers: we analyse the public text of your website to detect its language, and use your placement settings to suggest texts and layouts, with the help of an AI service provider (section 6).
3. Visitors of publisher websites (the Plakard ad script)
Publishers embed our ad script on their websites to display Plakard ads. The script sets no cookies and stores nothing on your device.
When the script loads an ad or reports that an ad was viewed or clicked, your browser sends us, as with any web request, your IP address, browser type, language setting and the address of the page. We use this to deliver the ad, check that the placement is used on the publisher's own website, count valid views and clicks, filter automated or fraudulent activity, and keep our systems secure. Legal basis: our legitimate interest in delivering and measuring ads correctly, Art. 6(1)(f). We do not store your IP address with ad records.
If you use the "!" link to report an ad, we receive the reason, your optional comment, the ad address and the address of the page. We use it to review the ad (legitimate interest in keeping ads lawful and safe).
Joint responsibility with the publisher. The publisher and Plakard are jointly responsible for collecting this data through the script on the publisher's website and sending it to us. The publisher is responsible for embedding the script, informing you about it in its own privacy notice, and obtaining any consent that the law applicable to it requires. Plakard is responsible for all further processing of the data, for the information in this section, and for handling your requests. You can exercise your rights with either of us; the publisher forwards such requests to us.
4. Visitors of plakard.io
We count visits with self-hosted analytics that set no cookies and do not identify you (page, referrer, browser, device type, country). Legal basis: legitimate interest in understanding how our website is used.
If you join a waiting list on plakard.io or in the publisher portal, we use your email address to inform you when the service opens (consent, Art. 6(1)(a)).
5. Cookies
plakard.io and the ad script set no cookies. The advertiser and publisher portals use only cookies and local storage that are strictly necessary to keep you signed in, protect forms and remember choices you made in the portal. No consent is required for these.
6. Who receives your data
Service providers that process data on our instructions under data processing agreements:
- cloud hosting and databases (EU) and content delivery (EU, with edge locations worldwide);
- email delivery (EU);
- website analytics hosting (EU);
- accounting and tax reporting (Estonia);
- an AI service for publisher language detection and text and layout suggestions, which receives only publisher website text and placement settings (USA, see section 7).
Independent controllers:
- Stripe (Stripe Payments Europe, Limited, Ireland), for advertiser payments;
- Wise (Wise Europe SA, Belgium), for publisher payouts;
- our bank, tax authorities, auditors and legal advisers, and courts or authorities where the law requires it.
A publisher sees the advertiser's name and the ad submitted for its placement, to review it.
7. Transfers outside the EU/EEA
Content delivery edge locations outside the EU and the AI service provider in the USA are covered by the European Commission's standard contractual clauses in the providers' data processing terms, or by an adequacy decision where one applies. You can ask us for a copy of the safeguards.
8. Your rights
You have the right to access, correct and delete your data, restrict its processing and receive it in a portable format. You can withdraw consent at any time without affecting earlier processing.
Right to object. You can object at any time, on grounds relating to your situation, to processing based on our legitimate interest, including the ad script processing in section 3.
Send requests to privacy@plakard.io. We reply within one month, extendable where the law allows. We may ask you to confirm your identity. We generally cannot link ad script data (section 3) to a person, and will tell you if that is the case.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the supervisory authority where you live or work.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data, ads and placement content | While the Account exists, then up to 3 years |
| Unverified registrations | 2 days (advertisers) or 7 days (publishers) |
| Accounting documents (invoices, payments, payouts) | 7 years from the end of the financial year |
| VAT records for EU consumers, including location evidence | 10 years from the end of the year of the transaction |
| Support requests | Up to 3 years after closing |
| Ad reports from visitors | 12 months |
| Ad view and click records (no IP address) | Up to 400 days |
| Server and security logs (including IP addresses) | Up to 30 days, longer only to investigate a specific incident |
| Waiting list | Until the service opens or you withdraw consent, at most 12 months |
10. Changes
We may update this policy. The date at the top shows the current version.