Legal

Privacy Policy

Last updated: June 2026

Your privacy matters to us. This policy explains how Ads By Virtue collects, uses, protects, and shares your personal information.

1. Information We Collect

We collect information you provide directly to us, information collected automatically when you use our platform, and information from third-party sources.

1.1 Information You Provide

Account information: Name, email address, password, phone number, and profile photo.
Profile information: For influencers — niche, follower counts, social handles, rates, portfolio. For brands — company name, website, industry, halal certification. For publishers — website URL, category, traffic data.
Payment information: Processed securely through Payoneer. We store your Payoneer account email and payout ID for processing purposes. We do not store credit card numbers, bank account numbers, or full payment card details on our servers. Transaction history (amounts, dates, status) is retained for accounting and legal compliance.
Communications: Messages sent through our contact form, support tickets, and email correspondence.
Content: Campaign briefs, ad creatives, sponsored content, and other materials uploaded to the platform.

1.2 Information Collected Automatically

Usage data: Pages visited, features used, clicks, search queries, and timestamps.
Device information: Browser type, operating system, device type, screen resolution, and language preferences.
Log data: IP address, access times, referring URLs, and error logs.
Cookies: Session cookies for authentication, preference cookies for settings, and analytics cookies to understand platform usage.

1.3 Information from Third Parties

OAuth providers: If you sign up with Google, we receive your name, email, and profile picture from Google.
Social platforms: Public social media data (follower counts, engagement metrics) used for influencer verification and campaign matching.
Halal certifiers: Public certification data to verify brand halal status.

2. How We Use Your Information

We use the information we collect to:

Provide our platform: Create and manage your account, process campaigns, facilitate payments, and enable communication between brands, influencers, and publishers.
Shariah compliance: Screen ads and content through our 2-layer compliance shield, including automated filtering and policy review.
Automated decision-making & profiling: We use transparent matching algorithm to connect influencers with campaigns based on niche overlap, audience demographics, engagement rates, and budget alignment. Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. While our matching algorithm suggests pairings, final hiring decisions are always made by human users (brands choosing influencers, influencers accepting campaigns). If you believe an automated decision has unfairly affected you, you may request human review by contacting privacy@adsbyvirtue.com.
Improve our services: Analyze usage patterns, fix bugs, develop new features, and optimize performance.
Communicate: Send transactional emails (campaign updates, payment confirmations), platform announcements, and respond to support requests.
Ensure security: Detect and prevent fraud, enforce our terms of service, and protect the safety of our users.
Legal compliance: Comply with applicable laws, regulations, and legal processes.

3. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

Platform participants: Influencer profiles (niche, follower counts, rates) are visible to brands. Brand campaign details are visible to influencers. Publisher site data is visible to sponsors (brands). This is essential for platform functionality.
Service providers: We share data with trusted third parties who provide services on our behalf — Payoneer (payments), Supabase (hosting/auth), Resend (email), and Plausible or PostHog self-hosted (analytics). These partners are contractually obligated to protect your data.
Legal requirements: We may disclose information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect rights, safety, or property.
Business transfers: In a merger, acquisition, or sale of assets, user information may be transferred. We will provide notice before your data is transferred under new ownership.

4. Data Protection & Security

Encryption: All data is encrypted in transit (TLS/SSL) and at rest.
Authentication: We use Supabase Auth with secure session management. We support multi-factor authentication for brands, publishers, and admins.
Access controls: Row-Level Security (RLS) on every database table ensures users can only access their own data. Role-based access control restricts admin functions.
Data minimization: We practice data minimization, collecting only the information strictly necessary to provide our services. Payment details are never stored on our servers.
Audit logging: All Shariah compliance decisions and admin actions are logged in an immutable audit trail.
Incident response: In the event of a data breach, we will notify affected EU users within 72 hours as required by GDPR. For non-EU users, we will notify you within a reasonable timeframe, typically within 7 days.

5. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you may have the following rights:

Access: Request a copy of all personal data we hold about you.
Correction: Request correction of inaccurate or incomplete data.
Deletion:Request deletion of your personal data ("right to be forgotten"). Note that we may retain certain data as required by law or for legitimate business purposes.
Portability: Request your data in a structured, machine-readable format.
Objection: Object to processing of your data for specific purposes.
Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at privacy@adsbyvirtue.com. We will respond within 30 days.

5.1 California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
Right to delete: Request deletion of your personal information, subject to certain exceptions.
Right to opt out of sale:We do not sell, rent, or share your personal information for monetary or other valuable consideration. Under CCPA, "sale" includes sharing for cross-context behavioral advertising. We do not engage in such practices.
Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact privacy@adsbyvirtue.com with the subject line "CCPA Request." We will verify your identity before processing your request.

6. Cookies

We use the following categories of cookies. You can control which categories are active by clicking "Manage preferences" in the cookie banner, or by re-opening the banner from the footer (look for the "Cookie Preferences"link in the "Legal & Privacy" column).

Strictly necessary cookies: Required for authentication, session security, and fraud prevention. These cannot be disabled — without them, you cannot log in or use the platform.
Functional cookies: Remember your settings (e.g., dark mode, language). These are off by default and only loaded if you opt in.
Analytics cookies: Help us understand how users interact with our platform in aggregate. We use privacy-focused, self-hosted analytics (Plausible or PostHog self-hosted) — no cross-site tracking, no personal identifiers. Off by default.
Marketing cookies: Conversion tracking pixels (e.g., Meta Pixel, Google Ads) for measuring campaign performance. Off by default. Only loaded if you explicitly opt in.

We do not use third-party advertising networks that engage in cross-context behavioral advertising. We do not sell or share cookie data with advertisers for monetary or other valuable consideration.

Consent enforcement:Analytics and marketing scripts are programmatically blocked from loading until you grant consent for their respective category. Consent state is stored in your browser's local storage under the key abv-cookie-consent-v2 and is also dispatched as a browser event (abv:consent-change) that our analytics wrappers listen for. If we add Google Analytics 4 in the future, it will use Google Consent Mode v2 and will default to "denied" for all storage until you opt in.

Global Privacy Control (GPC): If your browser sends the Sec-GPC: 1 header (Global Privacy Control), we treat it as a permanent opt-out request and suppress all non-essential cookies and any future sharing. The GPC state is also recorded in a non-identifying cookie (abv-gpc-opt-out) so client-side code can read it.

Do Not Track (DNT) signals: Our platform does not currently respond to the legacy DNT header because we do not use third-party advertising trackers that would be affected by DNT. We honor GPC (above), which is the modern successor to DNT.

Withdrawing consent:You can withdraw your cookie consent at any time by clicking "Cookie Preferences" in the footer, by clearing your local storage, or by submitting a privacy request through our Privacy Requests portal.

7. Data Retention

We retain personal data for as long as your account is active or as needed to provide our services. When you delete your account, we will:

Delete your profile information within 30 days.
Retain anonymized transaction records for legal compliance (up to 7 years).
Retain immutable Shariah audit log entries (these are append-only by design).
Remove your data from backups within 90 days.

8. Children's Privacy

Our platform is not directed to children under 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will delete it immediately.

9. International Data Transfers

Your data may be processed in Pakistan, the EU, or other countries where our service providers operate. For transfers from the EEA to Pakistan, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. For transfers to the United States (where some service providers are located), we rely on the EU-US Data Privacy Framework or SCCs as applicable. We ensure appropriate safeguards are in place for all international data transfers.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or through a prominent notice on our platform. Continued use after changes constitutes acceptance.

11. Contact

For privacy-related inquiries, contact us at:

Email: privacy@adsbyvirtue.com
Data Protection Officer (DPO): Our data protection contact is available at privacy@adsbyvirtue.com. This inbox is monitored by a qualified data protection contact responsible for GDPR and CCPA compliance.
Or use our contact form.

Exercise your rights: Submit a request through our Privacy Requests portal (GDPR Art. 15–22, CCPA) or the Do Not Sell My Info page (CCPA opt-out).

Accessibility: For accessibility-related inquiries, see our Accessibility Statement or email accessibility@adsbyvirtue.com.