What is collected, and how to have it deleted

Who is responsible

Adkiro is the trading name of Kinsides 777 Ltd (КИНСАЙДС 777 ЕООД), UIC 207572707, registered office Matochina 13, Dragalevtsi, 1415 Sofia, Bulgaria. That company is the data controller for everything described on this page.

Questions about anything here, including requests to see or delete what is held, go to kinchev@adkiro.com. Processing of this kind does not require a data protection officer; the managing director answers personally.

What is collected when you enquire

The forms on this site collect only what is needed to respond to an enquiry and to assess whether an engagement is a fit. Nothing is sold, and nothing is shared with third parties for their own marketing.

• Account review requests: name, email address, website and an indication of monthly advertising spend, plus, if you choose to give them, what the review should focus on and a WhatsApp number, used only to reply to that request.
• Client onboarding: name, email address, and the Meta identifiers you choose to provide — Business Portfolio ID, ad account ID, Page reference, Instagram username and Pixel or dataset ID.
• Technical data sent with a form submission: IP address and browser user agent, used to attribute the enquiry and reduce automated abuse.
• The assistant: the messages you type into it, used to generate the reply. Adkiro does not keep a record of the conversation.
• A tap on a WhatsApp link: that a tap happened, on which page, and the campaign tag of the link you arrived by, so Adkiro knows which advertisement led to it. No name, number, IP address or browser is stored with it.
• The campaign tag of the link you arrived by is also saved with a review request, for the same reason.

What a connected Meta account shares

Connecting a Meta account is optional and separate from granting Adkiro partner access to manage advertising. The connection requests the ads_read permission only. It can read advertising performance data; it cannot create, edit, pause or delete anything in the account.

When a connection is made, Adkiro stores the Meta user ID, the display name on that Meta account, the list of ad accounts the connection can see, and an access token. The access token is encrypted before it is stored and is never displayed, logged or sent to a browser.

The connection is used to prepare reporting and diagnostics — spend, impressions, clicks, cost metrics and campaign structure. It is not used to read personal messages, contact lists, customer records or audience membership.

• Permission requested: ads_read only, which is read-only.
• Access tokens are encrypted at rest with AES-256-GCM.
• A Meta access token issued this way expires after roughly 60 days.
• You can revoke the connection at any time in Meta's Business Integrations settings, which stops any further access immediately.

Why it is processed, and on what basis

The GDPR requires a lawful basis for each use of personal data. These are the ones Adkiro relies on.

• Answering an enquiry and assessing fit: steps taken at your request before entering a contract (Article 6(1)(b)).
• Reading a connected ad account: the contract or pre-contractual steps you asked for, together with the permission you granted inside Meta (Article 6(1)(b)).
• Measurement cookies and the matching server-side event: your consent, where the law requires it (Article 6(1)(a)). Consent can be withdrawn at any time, and withdrawing it does not affect what was done while it stood.
• Recording the IP address and browser on a submission, and keeping server logs: Adkiro's legitimate interest in preventing abuse of the forms and keeping the service running (Article 6(1)(f)).
• Keeping invoices and accounting records: the legal obligations of a Bulgarian company (Article 6(1)(c)).

Cookies and measurement on this site

This site sets very few cookies, and only one of them concerns advertising.

Where the law requires a choice before a measurement cookie is set — the EU and EEA, the United Kingdom and Switzerland — the Meta Pixel stays off until you accept it, and nothing is sent to Meta in the meantime. Elsewhere it loads by default, as is customary. Your choice is stored in a cookie so the question is not repeated, and it can be changed below at any time, wherever you are.

When the Pixel is active, a server-side copy of the enquiry event is also sent to Meta so that Adkiro's own advertising can be measured accurately. Where an email address is included it is hashed before transmission, never sent in the clear. This measurement concerns Adkiro's advertising of this website; it is separate from any connected client account.

• adk_consent — records your cookie choice. Strictly necessary; kept for a year after accepting or six months after declining.
• _fbp and _fbc — set by the Meta Pixel to attribute enquiries to Adkiro's advertising. Only after consent where consent is required; Meta keeps them for 90 days.
• A session cookie for Adkiro's internal dashboard. Set only for Adkiro staff who sign in; never for visitors.
• adkiro-motion — not a cookie: a note in your browser's own storage, written only if you turn the site's animation on or off, so the page stays as you set it. It is never sent to Adkiro and stays until you clear the site's data in your browser.

Who else handles the data, and where

Adkiro does not sell data and does not share it with anyone for their own marketing. The providers below process it on Adkiro's behalf, under written terms that bind them to Adkiro's instructions.

Data is stored on a server operated by netcup GmbH in its data centre in Vienna, Austria. Where a provider below is outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.

• Meta Platforms Ireland Limited and Meta Platforms, Inc. — the Pixel, the Conversions API, the account connection itself, and WhatsApp when you message there or leave a number for the reply. Meta's own use of that data is described in Meta's privacy policy.
• Cloudflare, Inc. — the network in front of this site, which also supplies the country used to decide whether to ask for cookie consent.
• netcup GmbH, Germany — the server and the database, in Vienna, Austria.
• Resend, Inc., United States — delivers the email that tells Adkiro an enquiry has arrived, and the confirmation sent to the address given in the form.
• Telegram — the same notification, delivered to Adkiro's own device. The message contains what you typed into the form.
• Google LLC, United States — provides the Gemini language model behind the assistant on this site. What you type into the assistant is sent there to generate the reply, so do not enter anything confidential.

How long data is kept

Nothing is kept indefinitely. The periods below are the defaults; a specific request to delete sooner is honoured unless the law requires the record to be kept.

• Enquiries and onboarding details: 24 months after the last contact, then deleted. If an engagement follows, for its duration and 24 months after it ends.
• Meta connection records and the encrypted access token: until you revoke the connection or ask for deletion, whichever comes first. Meta's own tokens expire after roughly 60 days in any case.
• Deletion confirmations: 90 days, so the confirmation code Meta issues remains checkable. The record holds the code and the date — not the data that was deleted.
• Server and security logs, including IP addresses: 30 days.
• Invoices and accounting records: for the period Bulgarian accounting and tax law requires.

Deleting your data

There are two routes, and both result in the stored access token being deleted rather than merely disabled.

Revoking the connection inside Meta triggers a deletion request to Adkiro automatically. You can also email kinchev@adkiro.com and ask directly. Either way you can be told what was held and confirm that it is gone.

• In Meta: Settings → Business Integrations → select Adkiro → Remove.
• By email: kinchev@adkiro.com, from the address associated with the enquiry where possible.
• Deletion status can be checked with the confirmation code issued at the time of the request.

Your rights

Under the GDPR you can request access to the personal data held about you, ask for it to be corrected or deleted, restrict or object to its processing, withdraw any consent you have given, or ask for it to be provided in a portable form. Requests go to kinchev@adkiro.com and are answered within one month.

If you believe your data has been handled improperly, you may also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg), or to the supervisory authority in your own country.