Privacy Policy

1. Controller and contact

The controller for the processing described here is:

replient.ai Software GmbH
Derflerstraße 27/1
4040 Lichtenberg, Austria
FN 671718 x, Regional Court of Linz, VAT ID ATU82948615
Managing Directors: Markus Danninger, Thomas Danninger

Contact for data protection matters: Markus Danninger, office@uplads.com.

We are not required to appoint a data protection officer under Art. 37 GDPR: our core activity is neither large-scale regular and systematic monitoring of data subjects nor large-scale processing of special categories of data. Requests reach the contact above.

2. What data we process

• Account data: name, email address, password hash, company and billing details, plan and workspace membership.
• OAuth data: when you connect an advertising account (Meta, Google Ads and YouTube, TikTok, Snapchat, LinkedIn), we receive an access token and your ad account details. We never receive or store your password for those platforms.
• Ad account data: campaign structures, ad set and ad group configurations, ad creatives and aggregated performance metrics.
• Uploaded files: the creative assets (images, videos) you upload, and transcripts of their audio track where you use that feature.
• Comment data: where you use the comment features, the names and texts of the people who commented on your ads, as returned by the platform.
• AI data: prompts, selected ad account data, brand context, creative content and the generated output.
• AI billing data: provider, model, token counts, estimated provider cost, credit reservations and final credit usage.
• Support data: your name, email address, account identifier, support messages and any files you send.
• Usage and log data: IP address, browser and device type, pages and actions in the app, timestamps, job and error logs.
• Acceptance records: for each of the terms of service, this privacy policy and the data processing agreement we store which document you accepted, its version, the time, where the acceptance happened (signup, Facebook login, invite acceptance, re-acceptance after a change, Stripe checkout), a salted hash of your IP address and your browser identification. We never store the IP address itself, and we never change or delete these rows.
• Marketing consent: whether you ticked the marketing box at signup and when that value was last set. It is off for every account that never ticked it.
• Website data: the source of your visit, and the analytics and marketing data described in section 11, where you consented to it.

3. Purposes and legal bases

• Providing the Service (account, launches, reporting, AI features, support, billing through Stripe): performance of the contract, Art. 6(1)(b) GDPR.
• Invoices and tax records: compliance with a legal obligation, Art. 6(1)(c) GDPR, in particular Section 132 of the Austrian Federal Fiscal Code.
• Security, abuse prevention, error and job logs, rate limiting, backups: our legitimate interest in a stable and secure service, Art. 6(1)(f) GDPR.
• Product analytics and session replay, statistics cookies, attribution: your consent, Art. 6(1)(a) GDPR, withdrawable at any time.
• Marketing cookies (Google Ads, Meta Pixel, Referly): your consent, Art. 6(1)(a) GDPR.
• Marketing emails: your consent, Art. 6(1)(a) GDPR, or Section 174(4) of the Austrian Telecommunications Act 2021 where you are an existing customer for similar products; you can object at any time.
• Contacting businesses in sales outreach: our legitimate interest in offering our product to businesses, Art. 6(1)(f) GDPR. Details in our privacy notice for contacted businesses.
• Recording your acceptance of the terms, this policy and the data processing agreement: compliance with a legal obligation, Art. 6(1)(c) GDPR together with Art. 7(1) GDPR, which puts the burden of proving a consent on us, and our legitimate interest in being able to show which version of a contract was concluded, Art. 6(1)(f) GDPR. We keep those records for as long as the account exists and afterwards until the limitation period for claims from the contract has run out.
• Asserting or defending legal claims: Art. 6(1)(f) GDPR.

4. Advertising platforms you connect

4.1 Meta

Our app accesses Meta platform data through the Meta Marketing API. We request exactly the following permissions, and only those:

• ads_management: to create and manage your campaigns, ad sets and ads.
• ads_read: to read your campaign structures together with their performance and spend data.
• business_management: to access the business assets of your business portfolio, such as ad accounts and catalogs.
• pages_read_engagement: to read the Facebook Pages you use for ads, including existing posts you want to boost.
• pages_show_list: to list the Facebook Pages you administer so you can pick one.
• instagram_basic: to access the Instagram business accounts linked to those Pages.
• catalog_management: to read your product catalogs and product sets for catalog ads.
• instagram_branded_content_ads_brand: to run partnership ads with Instagram creators who have authorised you.
• facebook_branded_content_ads_brand: to run partnership ads with Facebook creators who have authorised you.
• threads_business_basic: to read the Threads profile linked to your account, so it can be used as an ad identity.

We only access data necessary to perform the services you request. We do not sell, share, or use your Meta data for any purpose other than providing our services to you.

4.2 Google Ads and YouTube

When you connect a Google account, our app accesses Google user data through the Google Ads API and the YouTube Data API. We request the following scopes:

• adwords: to list the Google Ads accounts you have access to, read your campaigns, asset groups and ad groups so you can choose where to launch, and to create asset groups and ads in the accounts you select.
• youtube.upload: to upload the video creatives you select to your own YouTube channel as unlisted videos, so they can be referenced by your Google Ads campaigns.
• youtube.readonly: to show you which YouTube channel is connected, so you can confirm that videos are uploaded to the correct channel.

Limited Use:uplads’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data solely to provide the features you request. We do not sell it, we do not transfer it to third parties except as necessary to provide those features or as required by law, we do not use it for advertising purposes of our own, and we do not use it to develop, improve, or train generalized artificial intelligence or machine learning models. Human access to this data occurs only with your explicit consent (for example when you ask our support team to look into a problem), for security purposes, or where required by law.

By uploading videos through uplads you also agree to the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy.

4.3 TikTok, Snapchat and LinkedIn

Where you connect a TikTok, Snapchat or LinkedIn advertising account, we access your advertiser accounts, campaign structures and creative assets through the TikTok Business API, the Snapchat Marketing API and the LinkedIn Marketing API for the same purpose: to let you select launch targets and to create the ads you configure. For LinkedIn that also covers the organization Pages you administer, because a sponsored post is published in the name of a Page. The same rule applies: we only access what is necessary for the services you request, and we do not sell or repurpose that data.

4.4 Signing in with Facebook

You can create an account and log in with Facebook instead of a password. If you do, Meta tells us your name, your email address and your Facebook user ID, and we create or match an uplads account with them. Meta learns that you logged in to uplads. We do not post anything to your profile. The legal basis is performance of the contract, Art. 6(1)(b) GDPR; using a password instead is always possible.

4.5 Revoking access

You can disconnect any advertising platform inside uplads at any time under Configuration and Connections. Disconnecting deletes the stored access and refresh tokens for that platform. You can also revoke our access directly at the platform: for Meta in your Facebook Business Integrations settings, for Google in your Google Account permissions page. After revocation we can no longer access data from that platform.

5. Comment management

Where you use the comment features on your ads, we read the comments of that ad from the platform so you can see and answer them. That includes the display name of the person who commented, the text of the comment and its timestamp. We store this snapshot only for as long as needed to show and process it in the interface, and we do not use it for any other purpose. The people who comment are the platform’s users; for the comments on your own ads you are the controller, and we process them for you under the data processing agreement.

6. MCP interface for AI clients

You can connect an AI client of your choice (for example Claude or ChatGPT) to uplads through our MCP endpoint. If you do, that client reads the account data it asks for and can carry out the write actions you allowed. Every write action through that interface writes a line into your account’s change log, with the tool used, the time and the result; plain read queries are not logged. The data leaves our system towards the provider of the AI client you chose, under your contract with that provider. Access rests on the contract with you, Art. 6(1)(b) GDPR; the logging rests on our legitimate interest in traceable write access, Art. 6(1)(f) GDPR. You can revoke a connected client at any time in your account.

7. AI features and your own API key

When you use an AI feature, the content needed for your request may be sent to OpenAI or Anthropic. This can include prompts, ad copy, brand context, selected creative content, campaign structure, and performance data. With uplads AI, we use our provider account and deduct credits based on actual token usage. If you add your own API key, the selected provider processes and bills the request under your provider account and no uplads credits are used. We process this data to provide the requested AI feature (Art. 6(1)(b) GDPR) and to calculate usage, prevent abuse, and secure the Service (Art. 6(1)(f) GDPR).

Your own API key is encrypted before storage and is never sent to the browser after saving. We store usage metadata such as provider, model, token counts, estimated cost, and credit debits. AI inputs and outputs may also be stored in your uplads workspace where needed to provide chat history, audit history, or reusable brand context. Neither provider uses API data to train their models. Both process the request in the USA: we asked both for EU data residency and zero data retention on 9 September 2026 and neither has granted it yet, so the transfer rests on the EU standard contractual clauses, not on an adequacy decision. OpenAI keeps API data for up to 30 days for abuse monitoring and the logging of our API calls is switched off; Anthropic keeps it for the period stated in its commercial terms. See OpenAI's business data information and Anthropic's commercial data information.

8. Hosting, storage and security

The application and its background workers run on servers of Hetzner Online GmbH in Falkenstein, Germany. The database and authentication run on Supabase in AWS eu-west-1 in Ireland. Uploaded creatives are stored in Cloudflare R2 in a bucket with EU jurisdiction: both the storage and the processing of those objects stay inside the EU, which Cloudflare owes us contractually and cannot change for an existing bucket. The job queue runs on Redis Cloud in AWS eu-central-1 in Germany. System and notification emails are sent from Resend in eu-west-1 in Ireland; Resend stores its account data, logs and delivery metadata in the USA.

Connections are TLS encrypted. OAuth tokens and any API keys you store are encrypted with AES-256 before they are written, with the key held separately from the database, and are never returned to the browser. Every query is limited to your account by row level security in the database. Uploaded creatives are reachable only through short-lived signed links, and error logs are stripped of tokens, keys and email addresses before they are stored. The technical and organisational measures in full are Annex 3 of the data processing agreement.

9. Who receives your data

We share data only with the service providers we need to run uplads, with the tools on our own website, and with the platforms you connect your own account to. We do not sell personal data. The current list is also published at uplads.com/subprocessors, and it is Annex 4 of the data processing agreement.

9.1 Processors acting for us

9.2 On your instructions

The advertising platforms you connect your own account to. That processing is governed by your own contract with the platform concerned.

9.3 Only if you connect them yourself

9.4 Tools on our website

These run on uplads.com and process visitor data. For the Meta Pixel we and Meta are jointly responsible for the collection and transmission of the data (joint controllership, Art. 26 GDPR); Meta is solely responsible for the subsequent processing. Everything marked as requiring consent runs only after you allowed the matching category in the cookie banner.

Beyond that we disclose data only where we are legally obliged to, or to our tax advisor and, where necessary, our lawyer.

10. Transfers to third countries

Where a recipient processes data outside the EEA, we rely on an adequacy decision, in particular the EU-US Data Privacy Framework where the recipient is certified under it, or on the EU standard contractual clauses under Art. 46(2)(c) GDPR together with additional measures such as encryption in transit and at rest. Which safeguard applies to which recipient is stated in the tables in section 9 and at uplads.com/subprocessors. You can request a copy of the safeguards from us.

We checked the Data Privacy Framework register on 9 September 2026. Listed there are Cloudflare, Inc., Stripe, LLC, PostHog Inc, Plus Five Five, Inc. (Resend), Google LLC and Meta Platforms, Inc.; for those the framework applies and the standard contractual clauses are an additional safeguard. Not listed are Anthropic, OpenAI, Redis, Supabase, Cal.com and Referly; every transfer to them rests on the standard contractual clauses alone, together with a transfer impact assessment we keep on file. Crisp needs no entry: it is a French company and stores support conversations in the Netherlands and Germany.

11. Cookies and the consent banner

On your first visit we ask you which categories you allow: Necessary (always on), Statistics and Marketing. Rejecting is as easy as accepting, and you can change your choice at any time through "Cookie settings" in the footer. Your choice is stored in the first-party cookie uplads_consent for 180 days.

Google Tag Manager loads on every page of the website, but never in the admin console and never on a shared report link, and always with Google Consent Mode v2 set to "denied" by default: the tags behind it (Google Analytics, Google Ads, the Meta Pixel) fire only once you consented to the matching category. The Crisp support chat is loaded only when you click the chat button, because at that moment it is strictly necessary to give you the chat you asked for. The attribution cookie is set only with Statistics consent.

The legal basis for the necessary entries is Art. 6(1)(f) GDPR together with Section 165(3) of the Austrian Telecommunications Act 2021; for everything else it is your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.

12. Product analytics and session replay

With your consent to Statistics we use PostHog (EU cloud, Germany) for product analytics and session replay: a reconstructed recording of page views, clicks and navigation in the interface, so we can find errors and drop-offs. Input in form fields is masked everywhere. Inside the logged-in application every line of page text is masked as well, so a recording from there shows the layout and your clicks but not the names of your customers, ad accounts or campaigns; on our public marketing pages the text stays readable. For logged-in users the recording is linked to your user ID, name and email address, so a reported problem can be found again. Our administrators watch those recordings. The admin console and shared report links are excluded from tracking entirely. You can withdraw consent at any time in the cookie settings, which stops the recording, opts you out of further capturing and clears PostHog’s identifier in your browser.

13. Emails we send

Notification and system emails (launch results, budget alerts, invoices, connection warnings) are part of the Service and rest on Art. 6(1)(b) GDPR. Which notifications you receive can be configured in your account.

Marketing emails about our product rest on your consent, Art. 6(1)(a) GDPR, or on Section 174(4) of the Austrian Telecommunications Act 2021 where you are an existing customer and the mail concerns similar products. At signup you can tick a box to receive them; it is not pre-ticked, and an account that never ticked it counts as not having consented. A broadcast goes only to the accounts that ticked it, unless the mail is flagged as a service notice, which is account mail rather than advertising. You can object at any time, at no cost beyond the transmission cost: use the unsubscribe link in every such email, the one-click unsubscribe your mail client offers (List-Unsubscribe under RFC 8058), or write to office@uplads.com. We keep a suppression list so that an objection also holds for future campaigns.

Open and click measurement: only marketing campaigns, the automated lifecycle sequences and those cold outreach campaigns where engagement tracking is switched on contain a tracking pixel and links that run through a redirect, so we can see whether a mail was opened and which link was clicked. Notification and system emails, team invitations and mails an administrator writes to you by hand carry no pixel and no redirect. The legal basis is your consent, Art. 6(1)(a) GDPR, and for outreach to businesses our legitimate interest in knowing whether our messages arrive, Art. 6(1)(f) GDPR. You can avoid the measurement by setting your mail client not to load remote images, and by objecting under section 17. Those records are deleted after 12 months.

14. Internal CRM, attribution and support drafting

We keep an internal record of our customer relationships: account and contact data, plan and trial state, notes from conversations, the answers to the onboarding survey, and how you found us (the first source of your visit, stored with Statistics consent, and the answer you gave at signup). We use it to run the customer relationship and to understand which channels work. Legal basis: performance of the contract, Art. 6(1)(b) GDPR, and our legitimate interest in running and steering our business, Art. 6(1)(f) GDPR.

Replies to support and sales emails may be drafted with the help of an AI model before a person reviews and sends them. No email is sent without a person releasing it, and no decision with legal effect is made this way.

15. How long we keep data

We keep personal data only for as long as it is needed for the purpose, or for as long as a statutory retention period requires. In detail:

Creative assets are deleted when you remove them from the platform. Data still held under a statutory retention period is restricted from other processing until the period ends.

16. Processing on your behalf

If you use uplads to run ad accounts for your own clients, we process personal data on your behalf. For that we provide a data processing agreement under Art. 28 GDPR, including the list of our subprocessors and the technical and organisational measures: view the data processing agreement. It is concluded together with the terms of service; the binding version is the German one.

17. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data rectified (Art. 16);
• have your data erased (Art. 17);
• have processing restricted (Art. 18);
• receive your data in a portable format (Art. 20);
• withdraw a consent at any time, with effect for the future (Art. 7(3)).

Deleting your account and exporting your data

You can do both yourself under Configuration and Account, without asking us. "Export my data" returns your workspace as one JSON file; it deliberately leaves out the access tokens of your connected platforms and any AI provider key you stored, because those are credentials, not data about you.

"Delete account" cancels a running Stripe subscription immediately, deletes the Stripe customer, deletes your uploaded files in Cloudflare R2, deletes your PostHog person together with their recorded events, removes the memberships of your workspace, clears the internal CRM rows about you (the log of mails we sent you, the sales mails themselves and your analytics sessions) and finally deletes the login itself, which removes everything hanging off it in our database.

Five things stay, and we say so rather than implying a clean sweep: ads you already launched, because they live in your own ad account at the platform and we cannot reach them once the connection is gone; invoices at Stripe, which we must keep for seven years under Section 132 of the Austrian Federal Fiscal Code; the receipt for a lifetime purchase, where only the link to your account is removed so the licence returns to unclaimed; business correspondence in our own mailbox, where only the link to your account is removed; and your contact in the support chat, which we have to delete by hand at Crisp and which you can ask us for by writing to office@uplads.com. Individual error events keep nothing more than a technical trace with tokens and email addresses already removed, and they are deleted after 30 days anyway.

Right to object, Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to processing that rests on our legitimate interest (Art. 6(1)(f) GDPR). We then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert or defend legal claims. Where we process your data for direct marketing, you may object at any time without giving reasons; we then stop it entirely.

To exercise any of these rights, write to office@uplads.com.

Right to complain

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien, Austria
dsb@dsb.gv.at

18. No automated decision-making

We do not use automated decision-making including profiling that produces legal effects concerning a person or similarly significantly affects them (Art. 22 GDPR). The automated features of the Service act on advertising campaigns, within the limits you configure, not on people.

19. Minimum age

uplads is a business service. It is not addressed to minors, and you must be at least 18 years old to use it. We do not knowingly collect data from children.

20. Changes and contact

We may update this privacy policy. The date at the top of this page shows the current version; we notify you of significant changes by email or in the app.

Questions about this policy: office@uplads.com.