Privacy Policy
Version 1.0
Effective date: 1 November 2026
This Privacy Policy explains how we process personal data of advertisers, publishers, visitors of our websites, and visitors of publisher websites and apps that display our ads in Plakards (ad placements that publishers embed on their websites and in their apps), and of contact persons at businesses we contact.
1. Controller
Plakard Advertising OÜ, Pärnu mnt 139b-14, 11317 Tallinn, Harju maakond, Estonia ("we", "us", "our"). Contact: privacy@plakard.io.
2. Advertisers and publishers (account holders)
This section also covers people who act for an advertiser or publisher company, such as representatives and Account users.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, password, company or personal name, website | Creating and running your Account | Contract, Art. 6(1)(b) |
| Ads, Plakard designs, logos, default ads, settings | Providing the advertising services | Contract, Art. 6(1)(b) |
| Copies of the ads we display | Keeping a copy of each ad for at least 20 days after its last display and giving it to the supervisory authority on request (Estonian Advertising Act § 12); proving what we displayed | Legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
| Billing details: customer type (Consumer or Business Customer), name, address, company registration number, VAT number and the result of its check in the EU VIES system (validity, the name and address VIES returns, the request identifier) and, where VIES returns no name or address, your confirmation that the number belongs to the name and address you gave; for a business outside the EU, its tax number, proof of business registration and, where needed, our check of its VAT registration in its country's register; for publishers, VAT status and whether they account for VAT on a cash basis; for sales to EU consumers, or taxed as such, evidence of location for VAT (billing country and the card issuer's country) | Invoicing and VAT; deciding whether we can accept a Campaign Order from outside the EU (Terms 4.2, 7.4, 11.5) | Legal obligation, Art. 6(1)(c); contract, Art. 6(1)(b) |
| Payment data: payment status and amount; the publisher's bank account, held in its own name, for our payments, and our check that the account holder is the publisher; the bank account and proof of ownership of the holder of the original payment method for a refund that failed (Terms 8.5); amounts we keep available after a refund or a payment to a publisher failed (Terms 8.5, 11.2) | Taking payments, refunds, paying publishers | Contract and legal obligation, Art. 6(1)(b), (c) |
| Accounting records: our invoices, credit notes and claims; self-billed invoices, and objections to them or to monthly amounts (Terms 11.3 and 11.4); the monthly amounts and payments to each publisher with the batch files of our bank transfers; the monthly reports for our accountant | Invoicing, paying publishers, accounting and tax reporting | Legal obligation, Art. 6(1)(c); contract, Art. 6(1)(b) |
| Order records: the accepted Terms version with the refund and contractual-penalty terms that apply to the order, the ad ordered, prices, VAT and payment, the position of the Plakard on the page shown before ordering, with copies of any screenshots of it, the political-advertising declaration and the other declarations the order requires (Terms 6.13, 6.14) and, where a licence is needed, the licences named and our check of them, the early-start request and acknowledgement, the results of the automated checks of the ad, our confirmation of the order, withdrawal statements and our confirmations | Concluding and proving the contract, consumer withdrawal, the rules on political advertising and on regulated categories of ads (Terms 6.1, 6.2, 6.13, 6.14, 9, 19.3) | Contract and legal obligation, Art. 6(1)(b), (c) |
| Notices of changes to the Terms (the version, when and to which email address we sent them) and acceptances of a new version | Informing you of changes to the Terms, asking for your acceptance where the Terms require it, and proving both (Terms 19.1, 19.2) | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Verification documents (identity, company, address, tax status), licences required for regulated categories of ads, and sanctions-list checks of you and, for companies, of your representatives, directors, shareholders and beneficial owners, including data from public business registers | Verifying Accounts; tax and sanctions compliance; checking licences required for regulated categories of ads; linked-account checks (Terms 4.5, 4.6, 6.14, 10.6, 11.7) | Legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
| Order, delivery and account records | Handling chargebacks and payment disputes; establishing, exercising or defending legal claims (Terms 6.10, 10.10, 11.7, 17) | Legitimate interest, Art. 6(1)(f) |
| Support requests, measurement disputes, complaints with any files attached to them, and content reports sent by email | Answering you and handling complaints, disputes and reports (Terms 20.3) | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f); legal obligation for reports of illegal content, Art. 6(1)(c) |
| IP address and request logs when you use the portals | Security and fraud prevention | Legitimate interest, Art. 6(1)(f) |
| Identifiers compared between advertiser and publisher accounts and stored with each payment: the person behind the account, email, receiving bank account, the payment card (an identifier our payment provider gives it, not its number), the device (IP address and browser type of the latest 20 portal sign-ins) and which Account created or manages another Account; with each payment also the card issuer's 3-D Secure result and, where known, the countries of the billing address, the card issuer and the IP address; for a publisher, the advertiser payments for its Plakards that were declined or reversed as unauthorised or refunded as fraudulent | Preventing payment fraud; detecting a publisher or its Linked Persons ordering or paying for ads in its own Plakards, and applying holds and adjustments to such payments (Terms 10.6, 11.6 and 11.7) | Legitimate interest in preventing fraud, Art. 6(1)(f) |
| Results of automated checks of the pages where publishers embed Plakards | Checking that Plakards are displayed and used as the Terms require (Terms 6.12, 10.3, 10.8 to 10.10) | Contract, Art. 6(1)(b); legitimate interest in preventing fraud, Art. 6(1)(f) |
| Campaign and Plakard statistics | Reports, billing, fraud prevention | Contract, Art. 6(1)(b); legitimate interest in preventing fraud, Art. 6(1)(f) |
Card details are handled by our payment provider; we do not receive full card numbers.
Account and billing data are needed to conclude and perform the contract and to meet our invoicing obligations. Without them we cannot open an Account, accept a Campaign Order, pay a publisher or issue an invoice.
Automated checks. We check each ad against the Terms by automated means, with the help of an AI service provider (section 6); a person reviews an ad the check flags, and the publisher then decides whether to supply its space (Terms 6.4). Automated checks can also stop an ad when the page it links to is listed for malware or phishing: a person reviews such a stop without undue delay and decides on it, and you can object (Terms 15.6, 20.3). A person decides every other stop and every payment hold (Terms 11.6, 15.6).
Publishers: we analyse the public text of your website to detect its language, and use your Plakard settings to suggest texts and layouts, with the help of an AI service provider (section 6).
3. Visitors of publisher websites and apps (our ad script)
Publishers embed our ad script on their websites and in their apps to display ads in Plakards. The script sets no cookies and stores nothing on your device.
When the script loads an ad or reports that an ad was viewed or clicked, your browser, or the app, sends us, as with any web request, your IP address, browser type, language setting and the address of the page. If you open a link in a Plakard that leads to our advertiser portal, the script adds only the address of the page, without its query string, to the link, and the advertiser portal sends it to us. We use this to deliver the ad, check that the Plakard is used as the Terms require, for example on the publisher's own website or app, count valid views and clicks, filter automated or fraudulent activity, and keep our systems secure. From your IP address we derive the country, and from the browser type the type of device (desktop, mobile, tablet or other); we keep them as hourly and daily counts of views and clicks per ad, for 400 days, and show them only to the advertiser of that ad. Legal basis: our legitimate interest in delivering and measuring ads correctly and the publisher's legitimate interest in financing its website or app through advertising, Art. 6(1)(f); where the publisher obtains consent for the script, the collection is based on that consent, Art. 6(1)(a). We do not store your IP address with ad records.
If you use the "!" link to report an ad, we receive the reason, your optional comment, the ad address and the address of the page, and your name and email if you give them. We use them to review the ad, confirm receipt and tell you our decision (legal obligation under Article 16 of Regulation (EU) 2022/2065, Art. 6(1)(c), for reports of illegal content; otherwise our legitimate interest in keeping ads lawful and safe, Art. 6(1)(f)). Reports sent by email are handled the same way. If we restrict an ad after a report, we name the person who reported it to the advertiser only where strictly necessary (Article 17(3)(b) of Regulation (EU) 2022/2065).
Joint responsibility with the publisher. We and the publisher are joint controllers for collecting this data through the script on the publisher's website or app and sending it to us. The publisher is responsible for embedding the script, informing you about it in its own privacy notice, and obtaining any consent that the law applicable to it requires. We are responsible for all further processing of the data, for the information in this section, and for handling your requests. You can exercise your rights with either of us; the publisher forwards such requests to us.
4. Visitors of plakard.io
We count visits with self-hosted analytics that set no cookies and do not identify you (page, referrer, browser, device type, country). Legal basis: legitimate interest in understanding how our website is used.
If you join a waiting list on plakard.io or in the publisher portal, we use your email address to inform you when the service opens (consent, Art. 6(1)(a)).
5. Cookies
plakard.io and the ad script set no cookies. The advertiser and publisher portals use only cookies and local storage that are strictly necessary to keep you signed in, protect forms and remember choices you made in the portal. No consent is required for these.
6. Who receives your data
Service providers that process data on our instructions under data processing agreements:
- cloud hosting and databases (EU) and content delivery (EU, with edge locations worldwide);
- email delivery (EU);
- website analytics hosting (EU);
- accounting and tax reporting (Estonia);
- an AI service for publisher language detection and text and layout suggestions, which receives only publisher website text and Plakard settings (USA, see section 7);
- Telnyx (Telnyx LLC, USA), for our phone calls to businesses we contact: it carries the call and receives the number called, our caller ID, the call times, the duration and the call signalling; it processes these call records as an independent controller for its own billing, fraud prevention and telecommunications obligations (see section 7).
For the automated check of ads against the Terms we send an AI service provider in the USA only the address an ad links to and the address it finally leads to, the text of the ad and the text of the page it links to, after removing e-mail addresses, phone numbers and similar identifiers. It processes this data under its own terms. Images of ads are checked by our cloud provider in the EU.
Independent controllers:
- Stripe (Stripe Payments Europe, Limited, Ireland), our payment provider, for advertiser payments, refunds and the prevention of payment fraud;
- Wise (Wise Europe SA, Belgium), for our bank transfers to publishers and refunds by bank transfer;
- the European Commission's VIES system and the tax authority of the EU Member State that issued a VAT number, which receive the number with the business's name and address to check them (Terms 7.4);
- our bank, tax authorities, auditors and legal advisers, and courts or authorities where the law requires it.
A publisher sees the advertiser's name and the ad submitted for its Plakard, to decide whether to supply its advertising space for it. Visitors of a publisher's site see every ad with the label "Ads by Plakard", and the advertiser's domain, which is the domain the ad links to, when they point at the ad or open "About this ad". If we hold or deduct an amount because of a linked payment (Terms 11.6, 11.7), we tell the publisher which payments are concerned and which link we found, and nothing else about the advertiser.
7. Transfers outside the EU/EEA
Content delivery edge locations outside the EU and the AI service provider for publishers outside the EU/EEA are covered by the European Commission's standard contractual clauses in the providers' data processing terms, or by an adequacy decision where one applies. Telnyx relies on its certification under the EU-U.S. Data Privacy Framework (an adequacy decision of the European Commission) and, where that does not apply, on the standard contractual clauses in its data processing addendum. You can ask us for a copy of the safeguards.
8. Your rights
You have the right to access, correct and delete your data, restrict its processing and receive it in a portable format. You can withdraw consent at any time without affecting earlier processing.
Right to object. You can object at any time, on grounds relating to your situation, to processing based on our legitimate interest, including the ad script processing in section 3.
Send requests to privacy@plakard.io. We reply within one month, extendable where the law allows. We may ask you to confirm your identity. We generally cannot link ad script data (section 3) to a person, and will tell you if that is the case.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the supervisory authority where you live or work.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data, draft ads and Plakard content | While the Account exists, then up to 3 years |
| Unconfirmed registrations | 7 days |
| Advertiser registrations confirmed through the link in our email but not finished | 30 days from the confirmation, including the ads drafted during the registration and their images |
| Accounting records (section 2), including amounts we keep available after a failed refund or payment, with the bank account and proof given for them | 7 years from the end of the financial year in which the document was issued or the record last changed |
| VAT records of sales to EU consumers, or taxed as such, including location evidence | 10 years from the end of the year of the transaction |
| Support requests, disputes and complaints | Up to 3 years after closing |
| Your requests under section 8 and our answers | 3 years after we close the request |
| Ad reports, through the "!" link or by email | 12 months, longer only for a specific open dispute, hold or claim |
| Moderation decisions, stops and payment holds, with their statements of reasons and notices | 3 years after the decision or after the stop or hold ends, longer only for a specific open dispute, hold or claim |
| Ad view and click records (no IP address), and their country and device counts (section 3) | Up to 400 days, longer only for a specific open dispute, hold or claim |
| Server and security logs (including IP addresses) | Up to 30 days, longer only to investigate a specific incident |
| Records of automated checks of pages with Plakards (the position shown before an order is kept with the order records) | Up to 12 months, longer only for a specific open dispute, hold or claim |
| Campaign and Plakard statistics (totals, no visitor data) | While the Account exists, then up to 3 years |
| Order records (section 2), including the ads ordered and the results of their automated checks | 3 years after the Campaign Order ends |
| Copies of the ads we display | 3 years after the Campaign Order ends, and at least 20 days after the last display |
| Verification documents, proofs of business registration, licences and sanctions checks | While the Account exists, then up to 3 years, longer only while order records or an amount we keep available for the Account still need them |
| Fraud-prevention identifiers stored with a payment (section 2) | 18 months after the payment, longer only while a dispute about the payment or another specific case is open |
| Portal sign-ins (IP address and browser type) and records of advertiser payments we check under Terms 11.6 | 18 months after the sign-in or after the decline, reversal or refund, longer only for a specific open case |
| Notices of changes to the Terms and acceptances of a new version | While the Account exists, then up to 3 years |
| Waiting list | Until the service opens or you withdraw consent, at most 12 months |
| Contact data and contact records of businesses we contact (section 10) | Deleted at once when you object, except the contact data and the date of the objection, which we keep so that we do not contact you again; otherwise 24 months after the last contact |
If a specific dispute, hold or claim is still open, including a hold under Terms 4.6 or 11.6 or an amount we keep available under Terms 8.5 or 11.2, we keep the data needed for it until it is closed.
10. Businesses we contact
We contact businesses we would like to work with, such as owners of websites that could supply advertising space to us, to present Plakard to them. This section covers the people at those businesses whose contact data we use, such as owners, employees and other contact persons.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Business name and website; your name, role, business email address and phone number | Presenting Plakard to the business and following up | Legitimate interest in presenting Plakard to businesses, Art. 6(1)(f) |
| Records of our contacts: date, type (call, email, meeting, message), the person contacted, a summary, the outcome and planned next steps; our notes; files exchanged with you; for our phone calls, the number called, the start and end time and the outcome | Keeping track of our contacts and following up | Legitimate interest in presenting Plakard to businesses, Art. 6(1)(f) |
We obtain the data from public sources, such as the business's website and public business registers and directories, and from you. We make calls through our telephony provider (section 6) and do not record them.
Objection and no further contact. You can object to this processing at any time without giving reasons (Art. 21(2) GDPR) and ask us not to contact you again: write to privacy@plakard.io, or tell us during a call or in a reply to our message. We then stop contacting you and delete your data as section 9 states.
11. Changes
We may update this policy. The date at the top shows the current version.