Privacy Policy

Last updated: March 4, 2026

1. Introduction

CraftAds.ai ("Service") is operated by TRS Ecom ("Company", "we", "us"), registered in the Netherlands. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch privacy laws.

2. Data Controller

TRS Ecom is the data controller for personal data processed through CraftAds.ai. Contact: privacy@craftads.ai.

3. Data We Collect

Account Data

Data	Purpose	Legal Basis
Name	Account identification	Contract
Email	Authentication, communication	Contract
Password (hashed)	Authentication	Contract
Subscription plan	Service delivery	Contract

Usage Data

Data	Purpose	Legal Basis
Generated ad images	Service delivery, gallery	Contract
Store & product data	Ad generation	Contract
Generation count	Plan limits	Contract
IP address	Security, rate limiting	Legitimate interest

Payment Data

Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank details, or other payment instruments. Stripe acts as an independent data controller for payment data.

4. How We Use Your Data

Provide and improve the Service
Process your ad generation requests via Google Gemini API
Manage your subscription and billing
Send transactional emails (account confirmation, password reset)
Prevent abuse and ensure security

5. Third-Party Processors

Service	Purpose	Location
Google Gemini API	AI image generation	EU/US
Stripe	Payment processing	EU/US
Cloud86	Hosting & database	Netherlands

6. AI Image Processing

When you generate an ad, your product images and brand assets are sent to Google's Gemini API for processing. Google's AI processing is subject to Google's AI Terms. We do not use your images to train AI models. Generated images are stored on our servers for your access.

7. Data Retention

Account data: Retained while your account is active + 30 days after deletion
Generated images: Retained while your account is active
Rate limit logs: Automatically deleted after 15 minutes
Payment records: Retained as required by Dutch tax law (7 years)

8. Your Rights (GDPR)

Under the GDPR, you have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate personal data
Erasure: Request deletion of your personal data ("right to be forgotten")
Portability: Receive your data in a structured, machine-readable format
Restriction: Restrict processing of your personal data
Objection: Object to processing based on legitimate interest
Withdraw consent: Where processing is based on consent

To exercise these rights, email privacy@craftads.ai. We will respond within 30 days.

9. Cookies

We use essential session cookies for authentication. These are strictly necessary and do not require consent. We do not use tracking cookies or third-party advertising cookies.

10. Data Security

We implement appropriate security measures including: encrypted passwords (bcrypt), secure session management (httpOnly, Secure, SameSite cookies), prepared SQL statements, rate limiting, and CSRF protection.

11. International Transfers

Some data may be processed by Google (Gemini API) in the US under Standard Contractual Clauses. Our primary hosting and database are in the Netherlands.

12. Children

The Service is not intended for users under 18 years of age. We do not knowingly collect data from minors.

13. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users.

14. Contact & Complaints

For privacy inquiries: privacy@craftads.ai

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.

CraftAds.ai is a product of TRS Ecom. Registered in the Netherlands.