Privacy policy

1. Who is responsible

The data controller is MRAD Media, Napoli, Italy. Contact for all privacy matters: info@mradmedia.com. We have not appointed a Data Protection Officer because we are not required to; privacy requests are handled by our compliance contact at the address above.

2. The website mradmedia.com

The website is a set of static pages. It has no accounts, no contact form and no advertising. It processes:

Data	Purpose and legal basis	Retention
Server logs: IP address, time, requested page, browser string	Security, abuse prevention and capacity planning. Legitimate interest (Art. 6(1)(f)).	Up to 30 days at the hosting provider.
Web fonts requested from Google Fonts	Rendering the pages. Your browser sends your IP address to Google to fetch the fonts. Legitimate interest; see cookies and third parties.	Governed by Google's policy.
Email you send us	Answering you and keeping a record of the correspondence. Legitimate interest and, where applicable, pre-contractual steps (Art. 6(1)(b)).	Up to 24 months after the last exchange, longer if needed for legal claims.

The website sets no cookies of its own and uses no analytics or tracking scripts. If that changes, this notice and the cookie page will be updated before the change goes live.

3. Our applications

Our applications are used by businesses (advertisers, agencies, publishers) and their staff. We process personal data of the people who use the applications; we do not process personal data of the audiences who see or click advertisements, because advertising platforms return aggregated metrics only.

3.1 Account and usage data

Data	Purpose and legal basis	Retention
Name, email address, platform user ID of the person signing in	Creating and securing the account, audit logs, service notifications. Contract (Art. 6(1)(b)).	Until the account is deleted, then 30 days in backups.
Business, ad account, Page and pixel identifiers and names the user chooses to connect	Providing the service on the selected assets. Contract.	Until the connection is revoked or the account deleted.
Access tokens issued by the platform	Making API calls on the user's behalf. Contract. Tokens are encrypted at rest and never displayed.	Until revoked or expired.
Actions taken in the app (who changed what, when)	Audit trail and support. Legitimate interest and legal obligations.	24 months.
Technical logs (IP, device, errors)	Security and reliability. Legitimate interest.	90 days.

3.2 Data received from Meta

When a business authorizes MRAD Ads Console or MRAD Insights through Facebook Login for Business, we receive from Meta Platforms Ireland Ltd: the public profile and email of the signing-in user; the list of businesses, ad accounts and Pages the user chose to share; campaign, ad set, ad and creative objects on those ad accounts; and aggregated performance metrics (impressions, reach, clicks, spend, actions). We use this data solely to provide the features the business asked for: managing its campaigns and reporting on their performance. We do not use data obtained from one business to serve another, do not sell it, and do not use it to build profiles of individuals. Our use of Meta data is governed by Meta's Platform Terms and Developer Policies. Details per permission are on the Meta integration page.

3.3 Data received from other platforms

Equivalent principles apply to Google Ads, Microsoft Advertising and Yahoo integrations: we receive campaign objects and aggregated metrics for authorized accounts only, under each platform's API terms.

3.4 Server-side events (Signals)

Where a business uses Signals to send conversion events to an advertising platform, the business is the controller of those events and MRAD Media acts as its processor under a data processing agreement. Events are forwarded as the business configures them, hashed where the platform requires it, and are not retained beyond 30 days except as aggregated counts.

4. Who else receives data

• Hosting and infrastructure: Amazon Web Services EMEA SARL (EU regions) and our domain and DNS provider. Processors under contract.
• Advertising platforms you connect: Meta Platforms Ireland Ltd, Google Ireland Ltd, Microsoft Ireland Operations Ltd, Yahoo EMEA Ltd. They are independent controllers of the data they hold; you grant and revoke our access on their side.
• Email provider for info@mradmedia.com.
• Authorities where the law requires it.

Some processors operate outside the European Economic Area. Where that happens, transfers rely on adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified) or on Standard Contractual Clauses.

5. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to info@mradmedia.com; we answer within one month. You can also complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority in your country.

To delete data connected to a Meta login, follow the data deletion instructions; the same page explains the automatic deletion triggered when you remove our app in Meta.

6. Security

Data is stored in EU regions, encrypted in transit and at rest. Access tokens and secrets are encrypted with keys managed separately from the data. Staff access is role-based and logged. We review this setup when we change infrastructure and at least yearly.

7. Children

Our website and applications are for businesses and adults. We do not knowingly process data of anyone under 16.

8. Changes

We will post changes here with a new effective date. Material changes affecting application users are announced inside the application or by email before they take effect.