This notice explains, in plain terms, what data the AdFlowHQ managed ad service does and does not process, and how. It describes the service's actual data flow.

What AdFlowHQ does not do

• No raw IP is stored. Only anonymous sha256 digests are kept; the original IP address is not retained.
• Cookieless serving and measurement. The ad serving and measurement endpoints set no visitor-side cookies.
• No selling of personal data. Data is not sold and is not shared with third parties for advertising.
• No third-party trackers on these pages. The public site loads no third-party scripts, fonts or tracking tags.

What is processed, and why

Ad serving & measurement. For each ad request, anonymous signals (an sha256 digest derived from the request, coarse user-agent attributes and event timestamps) are processed to select an ad, count an impression / viewability / click and prevent double counting (idempotency key). Impression and click beacons are HMAC-signed. No cross-site visitor profile is built.

Admin panel. For account holders, an email address and an authenticated session cookie are used to sign in and operate the panel. This session cookie applies to the admin panel only.

Cookies

The ad serving and measurement endpoints are cookieless. The only cookie used is the admin panel session cookie, which is necessary for authenticated access and is not used for advertising or cross-site tracking.

Consent-aware measurement

Measurement narrows according to the visitor's consent state, as signalled by the publisher's own consent setup on the page where the ad tag runs.

Retention

Event records are summarised into daily statistics; detailed event data is kept only as long as needed for measurement, reporting and invalid-traffic checks, then aggregated. Backups are taken regularly.

Security

Access tokens are HMAC-signed with expiry; API keys are stored only as sha256 hashes (never in clear text); the installation is locked after setup. Transport is over HTTPS with a strict content-security policy.

Sharing & international transfer

Data is not sold and is not shared with advertising third parties. Where hosting or processing takes place outside the visitor's country, the operator ensures an appropriate basis for the transfer.

Your rights (KVKK / GDPR)

Subject to applicable law, you may request access to, correction of, deletion of, or restriction of / objection to the processing of your personal data, and may withdraw consent where processing is based on consent. Requests can be made to the operator of the AdFlowHQ service through your account or the service's published contact channel.

Free usage and advertising inventory model

AdFlowHQ is an ad-supported managed ad service provided to the user free of charge. No subscription, license, setup fee, invoice or payment is taken from the user; no price is set and nothing is sold. The infrastructure, software, hosting, maintenance and operation costs are borne by AdFlowHQ.

In return for these costs, on eligible accounts up to 50% of the advertising inventory may be reserved for the display of AdFlowHQ-selected ads (AdFlowHQ house campaigns). The remaining inventory is used for the publisher's own campaigns, sponsorships and direct-sold advertising. This arrangement is not a sale, lease or monetary exchange of goods or services; it is based on ad-supported free usage.

Contact

Data controller: the operator of the AdFlowHQ service. For privacy or data-subject requests, contact the operator through your account or the service's published contact channel.

This is an informational notice and does not constitute legal or financial advice. The tax, accounting and legal characterisation of the free-usage model may vary by country, user type and implementation; for binding regulatory specifics (effective date, controller legal identity, jurisdiction) confirm with qualified legal counsel.