Privacy Policy — Key points
v1.0 — April 2026 · Ametrix AdsIQ (Orbis Networks S.L.)
1. Controller
Orbis Networks S.L., a Spanish company. Privacy queries: privacidad@ametrix.io.
2. What we collect
Account identifiers (email, hashed password, company name), tax data (via Stripe), Amazon Ads OAuth tokens (encrypted AES-256-GCM), audit trail of write operations, technical session data (≤90 days).
3. Legal basis
Contract performance, legal obligations (tax/accounting), legitimate interest (audit trail, security), consent (commercial communications, withdrawable).
4. Recipients
Amazon Ads API (EU), Supabase (EU), Stripe (Ireland), Anthropic (US, under SCC), Hetzner (Germany). No commercial sale of data to third parties.
5. Retention
Account data: until you cancel + request deletion. Tokens: deleted ≤7 days post-cancel. Audit trail: ≥1 year post-cancel. Tax data: 6 years. Tech logs: 90 days.
6. Your rights
GDPR rights apply: access, rectification, erasure, objection, restriction, portability, consent withdrawal. Email privacidad@ametrix.io with ID copy. We respond within 30 days. Complaints: AEPD (www.aepd.es).
7. Security
TLS 1.3 in transit. AES-256-GCM at rest for tokens. Mandatory 2FA (TOTP) for admin. Immutable operation log. Per-plan tool isolation.