ChatvertiseChatvertise

Privacy Policy

Last updated: September 2, 2026. The English version of this policy is the binding version.

1. Controller

Codeventure e.U., Mühlbachgasse 7, 4533 Piberbach, Austria — email: office@chatvertise.app. We are the controller for the personal data processed through Chatvertise ("the Service").

2. Data we process

  • Account data: name, email address, login credentials, organization name, chosen language and time zone — to provide login and the Service (Art. 6(1)(b) GDPR). Authentication (including password storage and Google/GitHub sign-in) is handled by our provider Supabase (see section 4).
  • Advertising data: OpenAI Ads API keys (stored AES-256-GCM encrypted), campaign structures, ad creatives and performance metrics retrieved from the OpenAI Advertiser API on your behalf (Art. 6(1)(b) GDPR).
  • Billing data: subscription plan and payment status. Payment details (card numbers etc.) are processed directly by Stripe; we never see them (Art. 6(1)(b) GDPR).
  • Team and invitation data: names and email addresses of team members and of persons you invite to your organization — to provide multi-user access (Art. 6(1)(b) GDPR). Invitation records are deleted after acceptance or expiry (7 days).
  • Notification emails: we send operational emails (e.g. rejected ads, budget warnings, account status, weekly reports) based on our legitimate interest in a functioning service (Art. 6(1)(f) GDPR); you can disable each category in your settings. Product news is sent only with your prior consent (opt-in, Art. 6(1)(a) GDPR) and can be revoked at any time in your settings.
  • Custom-audience data: if you upload customer lists (email addresses, phone numbers, hashed identifiers) for OpenAI custom audiences, we transmit this data on your behalf and on your instruction directly to OpenAI and do not store it beyond the transfer. For this data you remain the controller and we act as your processor (Art. 28 GDPR — see our DPA); you are responsible for a valid legal basis for the persons on your lists.
  • Conversion tracking: measurement pixels and server-side conversion events run on your website and transmit data to OpenAI, not to us. We only manage the configuration (pixel IDs, event definitions). Informing your website visitors and obtaining any required consents is your responsibility.
  • Shopify data: if you connect a Shopify store, we store your Shopify API credentials (Client ID and Client secret, AES-256-GCM encrypted) and the product data you choose to import (product title, description, image URL, price, product URL). We read your store's product catalog via the Shopify Admin API using read-only scope (read_products) on your behalf; we do not access your Shopify customers' personal data, orders or payment information (Art. 6(1)(b) GDPR). When you generate ads from a product, its text is sent to OpenAI to draft ad copy and its image is uploaded to and hosted by OpenAI for the ad creative (see section 4). You are responsible for holding the rights to the product content you import and advertise.
  • Technical data: server logs (IP address, timestamps) for security and operation (Art. 6(1)(f) GDPR).

3. Cookies, analytics and consent

Strictly necessary cookies: a session cookie for login and preference cookies for your language and interface settings (e.g. the collapsed sidebar). These are required to operate the Service (Art. 6(1)(b) and (f) GDPR) and are always active.

With your consent (Art. 6(1)(a) GDPR) we additionally use the following services on our website:

  • Google Analytics 4 (provided by Google Ireland Limited) to understand how our website is used. It sets cookies and processes usage data such as pages viewed, approximate location (from a shortened IP address), device and browser type, and a pseudonymous identifier. We use Google Consent Mode v2: no analytics cookies are set and Google Analytics is not loaded until you consent.
  • OpenAI Ads conversion pixel ("oaiq", provided by OpenAI) on our own website to measure the success of our advertising in ChatGPT — for example completed sign-ups and subscriptions. It is only loaded after you consent.

On your first visit a consent banner lets you accept all cookies, allow only necessary cookies, or enable analytics and marketing separately. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer, with effect for the future. Your choice is stored in a "cv_consent" cookie for up to 180 days. Google Analytics and the OpenAI conversion pixel may transfer data to the USA; such transfers rely on the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses.

Independently of consent we use Vercel Web Analytics and Vercel Speed Insights, privacy-friendly, cookieless measurement provided by our hosting provider Vercel Inc. They record aggregated page views and web performance metrics (visited route, browser/device type, country derived from a discarded IP address) without cookies, without cross-site tracking and without building visitor profiles (Art. 6(1)(f) GDPR — legitimate interest in the stability and improvement of the Service).

4. Processors and recipients

  • Vercel Inc. — hosting, content delivery, and cookieless web analytics / performance measurement (see section 3)
  • Google Ireland Limited — Google Analytics 4 website usage analytics, only with your consent; may transfer data to Google LLC (USA) (see section 3)
  • OpenAI — in addition to the Advertiser API requests below, our own website loads the OpenAI Ads conversion pixel to measure our advertising, only with your consent (see section 3)
  • Supabase — database hosting and authentication (login, Google/GitHub sign-in, auth emails), region: EU (Frankfurt, eu-central-1)
  • Google and GitHub — only if you choose to sign in with them: they authenticate you and share your email address and name
  • Stripe, Inc. — subscription billing and tax calculation
  • Resend, Inc. — transactional email delivery (alerts, weekly reports, team invitations, auth emails)
  • OpenAI — Advertiser API requests made on your behalf using your API key; AI features (Growth/Pro): campaign context and, for AI campaign generation, imported Shopify product texts are transmitted to generate ad copy and recommendations, and product images are uploaded to and hosted by OpenAI for ad creatives; no end-customer personal data is included
  • Shopify — we read your connected store's product catalog on your behalf via the Admin API (read-only, read_products) using the credentials you provide; we are not affiliated with Shopify Inc.

Data processing agreements (DPAs) are in place with all processors. Transfers outside the EU/EEA rely on EU Standard Contractual Clauses.

5. Retention

Account data is kept for the duration of the contract and deleted upon account deletion. Billing records are retained as required by tax law (7 years under § 132 BAO, Austria). Synced performance data is deleted together with the connected ad account.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and to lodge a complaint with a supervisory authority — for us the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, dsb.gv.at). Contact: office@chatvertise.app.

7. Changes

We will update this policy when the Service or legal requirements change and indicate the date of the latest revision above.