What we do with your data, and what we never do.

1. Who we are and what this policy covers

Adella is operated by CPK Ventures LLC, doing business as Adella, Cedar Park, Texas, United States ("Adella", "we", "us"). This policy covers the website at adella.com (and adellainsight.com, which redirects to it), the application at the sign-in address linked from this site, and every Adella app: Adella Insight, Adella Strategist, Adella Creative Lab, Adella Account Manager and Adella CRM.

It applies to three kinds of people: visitors to the website, people who hold an Adella account ("you"), and people whose data reaches Adella through an account holder's connected accounts, for example the customers of a store whose orders Adella reads. The last group are covered in section 3 and in the Data Processing Addendum.

For the data in your connected accounts, you are the controller and Adella is your processor: we handle it only to provide the service and on your instructions. For your own account details, billing and the website, Adella is the controller.

2. The website

Server logs. The website is served by Cloudflare. Cloudflare records the IP address, the page requested, the time, the browser and the referring page in its logs, which it keeps for a short period for security and to serve the site. We see aggregate traffic figures, not individual visitors.

Analytics. If you accept analytics cookies, Google Analytics 4 records which pages are visited, how visitors arrive and which buttons are used, with IP addresses anonymized. Google Signals, advertising features and any linking to Google Ads are switched off: nothing from the site is used to target advertising to you. Until you accept, no analytics cookie is set and nothing is sent. You can change your choice at any time from the Cookie settings link in the footer. The cookie policy.

The contact form. When you write to us through Talk to us, Book a demo or Request access, the name, email address, company, topic and message you enter are sent to a private channel in Adella's Slack workspace together with the page you wrote from and the country of your IP address, so that a person can reply. The form carries no tracking. We keep the message for as long as the conversation is open and for up to two years afterwards so we can pick it up again if you write back.

Email. If you email us, we keep the correspondence in our Google Workspace mailbox for as long as it is useful to answer you.

3. The data we handle in the apps

Your account. Your name, email address, company name, the role you hold in each workspace, your sign-in method (Google sign-in or an email address and password, stored as a salted hash), the time of each sign-in, and your settings. On the agency path, the names of the clients you create and which of your users can see each one.

Billing. The level you are on, invoices and payment history. Card details are entered on a form served by Stripe and held by Stripe; Adella sees the card's last four digits and expiry date, not the number.

Connected accounts. When you connect an account, Adella reads what the account's own permission screen lists. Today the connections are Google Ads, Meta (Facebook and Instagram), Microsoft Ads, TikTok, Pinterest, X, Criteo, Klaviyo, Google Analytics 4, Shopify and Magento. From ad accounts: campaigns, ad sets, ads, keywords, search terms, audiences, placements, budgets, bids and daily performance figures. From your analytics property: the standard reports on traffic, sources, pages and conversions. From your store: orders, line items, discounts, refunds, shipping, product costs, inventory and the customer record attached to each order, which includes the customer's name, email address and shipping region. From Klaviyo: lists, flows, campaigns and their results. Adella loads up to 450 days of history on the first night and reads each account nightly after that.

Mailbox and calendar. Adella Account Manager and Adella CRM can be connected to a user's Google mailbox and calendar. With that connection Adella reads the messages and events in the threads with the clients and leads you work with, drafts replies into your drafts folder when you ask, and keeps a timeline of promises and meetings. A draft is sent only when you send it. Each user connects their own mailbox; nobody else's mailbox is read through yours.

What you type in. Briefs, brand rules, notes, questions to the strategist, approvals and the reasons you give for them, and the content you upload to Creative Lab's brand memory.

What Adella produces. Findings, prices in dollars, plans, drafted ads, drafted replies, reports, the approval queue and the audit record of every change. These belong to your workspace and are removed with it.

4. Why we use it, and the legal basis

• To provide the service you signed up for (performance of a contract): reading your accounts every night, finding and pricing problems, producing plans and drafts, applying the changes a named person approves, keeping the record, and billing you.
• To run the business (legitimate interests): keeping the service secure, preventing abuse, fixing faults, answering support requests, and understanding, in aggregate, which parts of the product are used. Where we rely on legitimate interests we have checked that they do not override your rights.
• To improve the service (legitimate interests): we use data that has been aggregated and stripped of anything that identifies you, your customers or your accounts to tune the checks Adella runs and the benchmarks it compares against. This data cannot be traced back to a business. We do not use your data, in any form, to train general-purpose AI models, ours or anyone else's.
• Website analytics (consent): only after you accept analytics cookies.
• To meet legal obligations: tax and accounting records, and lawful requests from authorities, as described in section 7.
• To tell you about the service (legitimate interests, with an opt-out): emails about findings, changes to the product and billing. Product news goes only to account holders and every such email has an unsubscribe link. We do not buy lists and we do not send marketing to people who have not signed up.

5. Connected platforms and their rules

Every connection is made through the platform's own authorization screen, which shows you exactly what Adella is asking for. Adella asks for read access to reporting data. Write access, which lets Adella apply a change you have approved, is a separate permission that is requested only on the channels where changes can be applied and only when you turn it on. You can revoke any connection from inside Adella or from the platform's own settings.

Google. Adella's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice: data from Google Ads, Google Analytics, Gmail and Google Calendar is used only to provide and improve the features you see, it is not used for advertising, it is not sold, and no person at Adella reads it except with your permission to solve a support problem, for security, or as the law requires.

Meta. Data from Meta's Marketing API is used only to provide the service to the account holder who connected it, in line with Meta's Platform Terms and Developer Policies.

Shopify, Magento and the other platforms. The same rule applies: the data is read to provide the service to you, and for nothing else. Each platform's own terms also apply to your use of it.

The platforms you connect are your own providers, not Adella's subprocessors. Their handling of your data is governed by their terms with you.

6. How AI is used, and which providers

Adella uses two kinds of model. Adella's own models, run on Adella's infrastructure, decide what is wrong in an account and what it costs; they work on your numbers. Frontier language models from outside providers turn those findings into sentences, answer strategy questions, and draft ads and replies when you ask. Every figure in anything Adella writes is passed through from your data. The writing is generated; the numbers never are.

The outside providers are Anthropic (text), OpenAI (text and image generation in Creative Lab) and Google (image generation in Creative Lab). Each receives only the data needed for the task at hand, under commercial terms that forbid using it to train their models, and none of them keeps it beyond the short period their terms allow for abuse monitoring. The full list, with what each receives, is on the subprocessor page.

AI drafts nothing that goes out of your workspace on its own. A drafted ad passes a compliance check and a person's approval before it can go live. A drafted reply sits in your drafts until you send it.

7. Changes to your accounts, and who sees your data

No change is made to any connected account without a person in your workspace approving it. Every approved change is recorded with the person, the time, the change, the predicted effect and the measured effect. The record is kept for the life of the workspace and is never edited.

Inside your workspace, the people you have added see what their role allows. You decide which users see which clients and what each can approve. Permissions can be changed at any time and take effect immediately.

At Adella, staff do not look at your workspace unless you ask for help and give permission, or when it is needed to investigate a security problem or a fault. That access is limited to the people who need it and is logged.

Our subprocessors handle data on our behalf for hosting, billing, email, error monitoring and AI, under contracts that bind them to the same obligations we have to you. The list, with what each receives.

The law. We disclose data when a court order, subpoena or other lawful request requires it. Where the law allows, we tell you first.

A change of ownership. If Adella is sold or merged, your data moves to the new owner under this policy, and we tell you before it does.

We never sell your data, and we never share it with anyone for their own advertising or marketing.

8. Where it is kept, and for how long

Adella runs on a managed cloud provider (to confirm) in the United States (to confirm). Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 (to confirm)). Backups are encrypted and kept for 30 days (to confirm). Security, in detail.

Connected-account data is kept on a rolling basis for 25 months, so that year-on-year comparisons work, and older data is dropped as it ages out.

Your findings, plans, drafts and the audit record are kept for as long as your workspace exists.

Account and billing records are kept for the life of the account and for 7 years after it closes, as tax and accounting law requires. Everything else goes when the account closes.

Server logs are kept for 12 months (to confirm).

If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States to be processed. We rely on the European Commission's Standard Contractual Clauses and the UK Addendum, which are part of the Data Processing Addendum.

9. Disconnection and deletion

Disconnect an account and Adella stops reading it that night. Its data is removed from Adella's production systems within 30 days (to confirm) and from backups when the backup window ends. Findings that were priced from it stay on the record, without the underlying data, so your history still makes sense.

Remove a client (agency path) and the client's workspace and everything in it go with them, on the same schedule.

Close your workspace and everything goes on the same schedule, apart from the billing records we are required to keep. You can export your findings and the audit record before you close it.

Disconnect a mailbox and the messages Adella read are removed on the same schedule. Drafts already in your drafts folder stay there; they are yours.

To close a workspace, use the settings page or write to hello@adelladigital.com.

10. Your rights

You can ask us at any time to show you the data we hold about you, correct it, delete it, give it to you in a usable form, stop a particular use of it, or stop processing it altogether where the law gives you that right. Write to hello@adelladigital.com. We answer within 30 days and we never charge for a reasonable request. We will ask you to confirm you are who you say you are before we act.

Much of this you can do yourself: your profile, your connections and your workspace are all under your control inside Adella.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to complain to your data protection authority. We would rather hear from you first.

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be treated differently for exercising those rights. The categories we collect are listed in sections 2 and 3: identifiers, commercial information, internet activity, and professional information. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is no opt-out to offer and no "Do Not Sell or Share" link; we also honor the Global Privacy Control signal from your browser by treating it as a refusal of analytics cookies. We do not use or disclose sensitive personal information for anything other than providing the service. You may use an authorized agent to make a request; we will ask the agent for proof of your permission.

Other US states with privacy laws give similar rights; the same address handles them.

If your data reached Adella through one of our customers, for example because you bought from a store that uses Adella, the store is the controller of that data. Write to the store, and we help them answer. If you write to us directly we will tell you which customer to contact where we can.

11. Security

Workspaces are separated at the data layer on every query. Access is by role. Everything is encrypted in transit and at rest. Every change to a connected account and every access by Adella staff is logged. We test for vulnerabilities and we take reports at hello@adelladigital.com. If a breach affects your data we tell you without undue delay, and within 72 hours of confirming it. Security and your data, in full.

12. Children

Adella is a business service. It is not directed at anyone under 18, and we do not knowingly collect data from anyone under 16 as a visitor or account holder. If you believe a child has given us data, write to us and we will remove it. The customer records in a connected store may include anyone the store sells to; the store is responsible for its own customers' data and its own age rules.

13. Changes to this policy

When we change this policy we update the version and the effective date at the top. For a change that reduces your rights or widens what we do with your data, we email every account holder at least 30 days before it takes effect. Earlier versions are available on request.

14. Contact

CPK Ventures LLC, doing business as Adella, Cedar Park, Texas, United States.
Privacy and data requests, and everything else: hello@adelladigital.com.

If you are in the EEA or the UK and need a representative under Article 27 of the GDPR, write to the privacy address and we will give you the details.