Privacy Policy

I. Introduction

Capitalised terms that are not defined in this Privacy Policy have the meaning given in the General Terms of Service.

Data protection and data security are priorities for AdBooks, a product of Admonet LLC ("AdBooks", "we", "us"). AdBooks processes and uses personal data only to the extent necessary to provide the Services to the User. Please read the General Terms of Service, this Privacy Policy and the Data Processing Agreement ("DPA") in part III, which together form the agreement between AdBooks and the User.

Roles. For the data that Users and their customers enter into the Software, the User is the "controller" and AdBooks is the "processor". AdBooks processes this data on behalf of the User and only on the User's instructions, and not for its own purposes. The User is responsible for the data they upload, and can change or delete it at any time. For data that AdBooks collects to run its own website, accounts, billing and security (see part II), AdBooks acts as controller.

Principles.

• AdBooks treats the personal data of the User and of their customers as confidential, in line with applicable data protection law, and does not disclose it to third parties unless this is needed to perform contractual obligations or required by law.
• To make processing auditable, the creation, modification and deletion of data are recorded with the name of the User, the name of their customer and the date of processing.
• The User confirms that they may instruct AdBooks to process the data and that all instructions will be lawful. The User must own, or be entitled to use, all data provided to AdBooks.
• The Software lets the User export their data and records, and the User can export all data before the Subscription ends.
• AdBooks shares data only to provide its Services to the User or when a court or regulatory authority requires it, and then only to the extent necessary.
• The User agrees that a copy of a bank certificate or bank statement may be stored in the AdBooks database and in external databases, and that data retrieved from the User's bank through a bank feed may be available in and stored by the Software.
• AdBooks keeps all confidential information provided by the User confidential, unless the information has become public other than by breach of this obligation, was received from a third party without an obligation of confidentiality, or must be disclosed by a regulator, government agency or competent court, and then only to the extent necessary.
• AdBooks takes the technical and organisational measures needed to protect the User's data against accidental or unlawful destruction, loss or alteration and against unauthorised disclosure or access. AdBooks complies with the data protection laws that apply to it as a processor and follows the General Data Protection Regulation (GDPR) as guidance.
• Where consent is obtained from the User in connection with the Services, the User may withdraw it at any time.

II. Data privacy statement

1. Who we are and how to reach us

AdBooks (company name: Admonet LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA, EIN 30-1290301) operates the website https://adbooks.co and its subdomains and provides the Services and the Software. AdBooks has a Data Protection Officer ("DPO") who can be reached by email at info@adbooks.co or by post at the address above.

This statement explains which personal data is collected when you visit the Website or use the Services and the Software, how we use it and which rights you have.

AdBooks is established in the United States. If the GDPR requires AdBooks to appoint a representative in the European Union (Article 27 GDPR), the representative's name and contact details will be published on this page.

2. Data security

To protect the data of the User and their customers, all data provided by the User is encrypted in transit with the TLS (Transport Layer Security) standard. You can see the secure connection from the "s" after "http" in the address shown by your browser (https://...).

AdBooks also takes appropriate technical and organisational measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction and unauthorised access. To prevent data loss, AdBooks runs a "mirror" database configuration, so User data is always stored in two separate locations, and it saves data to an off-site backup every 24 hours. Passwords are stored using a secure, encrypted process. AdBooks will never ask for your password by email; if you forget it, AdBooks can reset it. AdBooks continuously improves its security measures as technology advances.

Personal data collected by AdBooks is stored in a secure environment in data centres in Germany operated by our hosting provider and is treated as confidential. Access is limited to selected employees and suppliers of AdBooks. Because AdBooks is established in the United States, access to this data by AdBooks personnel from outside the EU/EEA is a transfer of data, which is safeguarded as described in section 4.

AdBooks does its best to keep the data of Users and their customers secure, but it cannot guarantee the security of data transmitted over the Internet. When data travels over the Internet there is always a risk that third parties access it without authorisation. AdBooks is not responsible for data leaks or unavailability caused by force majeure. Security of data during transmission is the responsibility of the User as the controller.

3. What data we collect, why, and on what legal basis

3.1 Visiting the Website. You can visit the Website without saying who you are. Your browser automatically sends certain information to our servers, which is temporarily stored in a log file: the IP address of the requesting computer, the date and time of access, the name and URL of the requested file, the referring website (referrer URL), and the browser and, where relevant, the operating system and the name of the access provider. We use this data to make the Website usable (to establish a connection), to keep the system secure and stable and to administer the network technically. We do not draw conclusions about you as a person from this data. Legal basis: our legitimate interest in secure and stable operation.

3.2 The marketing website (https://adbooks.co). The public landing page does not set any cookie on its own and only sets an analytics cookie if you accept it in the cookie banner (see section 6), and never uses advertising tools. It stores only two entries in your browser's local storage: the language you chose and, once you have made a cookie choice, that choice itself. This is needed for the site to work as you expect. Fonts are served from our own server. Contact links open WhatsApp, Viber or your email program; those services apply their own rules. If a presentation video is shown, it is loaded from the video provider (for example YouTube in privacy-enhanced mode, or Vimeo) only after you press play, and that provider may then set cookies and process your data under its own policy.

3.3 Registration for the online services. To use the invoicing and quoting services you must register with an email address and a password so that we can create your account. If you use country-specific features you select the country of your business. To generate a lawful invoice you enter data such as your company name, address, account number and payment details. We use your name and contact details to identify you, to set up, perform and manage the contract, to check that the data entered is correct and, if needed, to contact you. Legal basis: performance of the contract.

3.4 Phone number verification (SMS 2FA). If you choose to add and verify your mobile number in the app.adbooks.co application, we process the number only for account security and authentication, for example to send SMS verification codes. By providing and verifying your number you consent to this processing. Phone numbers are stored securely and are never shared with third parties for marketing. Legal basis: consent.

3.5 Newsletter and blog. If you agree to receive a newsletter, we may use your email address to send regular newsletters and information about the Services. We ask for your consent first, which can be given during registration. You can withdraw consent at any time in your account settings, by unsubscribing with the link in a newsletter or by writing to info@adbooks.co. After you unsubscribe, we keep the email address only to make sure you no longer receive these emails. Legal basis: consent.

3.6 Third-party data. Through the Services, Users can enter data of third parties (developers, customers, suppliers, accountants, teams and so on), give third parties access to their account, link their account with third parties or offer third-party applications. AdBooks respects the privacy of this data and may access it as a result of the User's use of the Services. If you believe a change is needed, contact us. The User is responsible for any third-party data entered. AdBooks has no control over compliance with data protection standards outside the Website, the Software and the Services it provides; in those cases the User, or the third party they authorised, is responsible.

3.7 Messages to us. When you write to us by email, WhatsApp or Viber, we receive your message and the contact details you use, and we use them to answer you and to provide support. Legal basis: performance of the contract or our legitimate interest in answering enquiries.

3.8 Legal obligations. We may process data where a law requires it, for example for accounting, tax or in response to a valid request from an authority.

3.9 Advo AI assistant. Advo is an optional AI assistant that runs on Gemini models provided by Google. Nothing is sent to Google unless you use Advo. When you use it, the text you enter and any content you choose to include in the request (for example item descriptions or parts of a Document) is sent to Google to generate the answer, and the answer is returned to you. Google acts as our subprocessor for this purpose. Google's terms differ by service tier: under Google's terms for unpaid services, submitted content may be used by Google to improve its products and services and may be read by human reviewers, while under paid services it is not used to train Google's models. For this reason, please do not enter into Advo personal data of third parties (for example names, addresses or tax numbers of your customers), special categories of personal data (such as health, biometric, political or religious data), payment card numbers, passwords or other secrets, or confidential information that you do not want Google to receive. Advo does not make decisions that have legal effects on individuals. You are interacting with an artificial intelligence system, not a person, and you must check its outputs before use. Legal basis: performance of the contract (providing the feature you request).

4. Sharing of data and international transfers

AdBooks may pass on personal data to third parties (for example to send invoices or quotes electronically) if the User gives explicit consent or makes a direct request, or if there is an obligation to do so. AdBooks may share data within its group of companies where necessary to provide the Services, for example with a sister company for billing purposes, and keeps data secure at all times. By registering with AdBooks, the User consents to the processing of their data and to the sharing of data with third parties where necessary to use the various Services.

We use service providers, called subprocessors, to provide the Services. They include our hosting provider (data centres in Germany), the payment provider Stripe, Inc. for card payments, PayPal for payouts, Google (Gemini models for the Advo AI assistant), and providers for sending SMS and email. The current list with the purpose of each is in Annex C of the DPA. AdBooks makes sure that User data is shared only with third parties that maintain an adequate level of data security in line with data protection law.

International transfers. AdBooks is established in the United States and our data is hosted in Germany. Where personal data is transferred to AdBooks or to a subprocessor in a country outside the EU/EEA that the European Commission has not recognised as providing adequate protection, AdBooks ensures a lawful transfer mechanism, in particular the European Commission's Standard Contractual Clauses (see section 6 of the DPA), and applies the supplementary technical and organisational measures described in Annex B. You can request a copy of the relevant safeguards by writing to info@adbooks.co.

You may withdraw your consent to the processing or sharing of your data at any time by deactivating your AdBooks account or by contacting AdBooks to ask for the account to be closed, which will be handled as soon as possible.

5. Retention

AdBooks keeps data only as long as needed for the purpose for which it was collected and for as long as the law requires. AdBooks deletes all User data 12 months after the Subscription ends for any reason. A User can delete data at any time by deleting the account. Free trial accounts that have not been used for 12 months may be deleted without prior formal notice. After the Subscription ends, AdBooks keeps only the minimum data needed to meet legal requirements, for the shortest possible period. Server logs are deleted automatically after a short period.

6. Cookies and analytics

The public landing page does not use cookies (see 3.2). The application at app.adbooks.co uses only cookies that are strictly necessary to run it, such as the session cookie that keeps you logged in, security tokens and your language and display settings. Cookies are small files that your browser stores on your device when you visit a site. They do not damage your device and do not contain viruses or other malicious software. Session cookies are deleted by your browser when they expire. You can set your browser to block cookies or to warn you before a cookie is created, but blocking the necessary cookies stops you from logging in. Legal basis: our legitimate interest and the performance of the contract, because these cookies are needed to provide the service you request.

Analytics cookie (only with your consent). To understand in aggregate how the Website is used (for example page views, the pages that led you here, your approximate country and the type of device you use), we use Google Analytics, a service provided by Google Ireland Limited and Google LLC ("Google"). When you first visit, a banner asks you to accept this cookie or continue with only the necessary cookies described above; Google Analytics is not activated, and no such cookie is set, until you actively accept it. You can change your choice at any time using "Cookie settings" in the footer of the Website, and withdrawing consent stops further data collection and removes the cookie from your device.

If you accept, Google Analytics sets cookies (typically named `_ga` and `_ga_*`) that let it recognise repeat visits from the same browser. We have IP anonymisation enabled, so Google truncates your IP address before it is stored and does not retain the full address. Google processes this data on our behalf, in line with its own data processing terms and privacy policy, and may process it on servers outside the EU/EEA, including in the United States; where it does, Google relies on the European Commission's Standard Contractual Clauses as a transfer safeguard. Legal basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of processing before the withdrawal. Apart from this, AdBooks does not use advertising or retargeting tools (such as advertising pixels) on the Website or in the application.

7. Your rights

You have the right to:

• access the personal data we hold about you;
• rectification of incorrect data;
• erasure of your data;
• restriction of processing;
• data portability, which the export function in the Software supports;
• object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with the competent data protection authority. AdBooks will cooperate fully with any such investigation and will try to meet all requests within its ability. The competent authority of each EU country can be found on the European Commission's website; if you are outside the EU, you can contact the equivalent authority in your country.

As the controller of the data they upload, the User is responsible for the content they publish and can correct, block or delete their data at any time using the options in their account. AdBooks may delete content published by the User at the User's request, but may decline to delete content that has already been published or that must be kept to comply with legal obligations. If a User deletes their data, they may be unable to use the Services fully or at all.

To exercise your rights, or for any question about the processing of your data, write to our DPO at info@adbooks.co or by post to Admonet LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. We aim to answer within one month.

8. Children

The Services are intended for adults and businesses. We do not knowingly collect personal data from anyone under 18.

9. Changes to this Privacy Policy

Because the Website, the Software and the Services develop, and because legal or regulatory requirements change, we may need to update this Privacy Policy from time to time. The current version is always published on this page, with the date of the last update.

III. Data Processing Agreement (DPA)

1. Introduction

This DPA forms the basis of the relationship between the User, as data controller, and AdBooks (Admonet LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA, EIN 30-1290301), as data processor, under data protection law, including Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR"). It sets out the contractual basis on which AdBooks processes personal data on behalf of the User, how the data may be processed and for what purpose.

Because of the number of Users, it would be impractical to sign a separate DPA with each User. This DPA is therefore included here and applies between every User and AdBooks. The User's company data is filled in automatically in their account when they accept the Terms of Service and this Privacy Policy (which includes this DPA), and always reflects the most recent data the User has given AdBooks. By using the Software and accepting the General Terms of Service, the Privacy Policy and this DPA, the parties agree that this DPA governs the processing of the User's personal data by AdBooks. It prevails unless replaced by another signed DPA that states it takes precedence. Each party confirms that it is authorised to enter into this DPA, and each party makes sure that its terms apply to its affiliates involved in the processing.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person (and, where applicable, legal entity), directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. "Controller" and "processor" have the meaning given in data protection law, including the GDPR. Special categories of personal data are not processed as part of the Services and are excluded from this DPA.

3. Subject matter, nature, purpose and duration

AdBooks processes Personal Data on behalf of the User to provide the Services described in the Terms of Service: storing, displaying, calculating, exporting, sending and signing quotes, invoices and related Documents, managing projects, costs and profitability, and supporting the User. Processing lasts for the term of the Subscription and until data is deleted or returned under section 9. The types of Personal Data and the categories of data subjects are listed in Annex A. If the User uses the Advo AI assistant, the content the User submits to Advo is also processed by Google as a subprocessor, as described in the Privacy Policy and Annex C.

4. Obligations of the processor

AdBooks (and every subprocessor with which AdBooks has a legal agreement for services) processes the User's Personal Data:

• in line with applicable national and European law;
• only on the documented instructions of the controller, which are given by the User's use of the Software and by this DPA, and to fulfil AdBooks' obligations under the service requirements;
• keeping it confidential, and making sure that everyone authorised to process it, including the employees and affiliates of AdBooks and its subprocessors, is bound by confidentiality, which continues after the agreement ends;
• with technical and organisational measures that are appropriate to protect the Personal Data, taking into account the state of the art, implementation costs and the purposes of the processing (see Annex B);
• notifying the controller without undue delay after becoming aware of a Personal Data breach;
• notifying the controller if a third party requests access to Personal Data, and responding only on the controller's instructions;
• assisting the controller, taking into account the nature of the processing, in answering requests from data subjects and in meeting the controller's obligations on security, breach notification and data protection impact assessments;
• making available to the controller the information reasonably needed to show compliance with this DPA, and allowing and contributing to reasonable audits, on reasonable notice and at the controller's cost.

5. Obligations of the controller

The controller confirms that it is responsible for the lawful use of Personal Data, including obtaining the necessary permissions and making notifications to the relevant authorities. The User must have a legal basis for processing and, where required, the consent of data subjects, which can be withdrawn at any time. The controller is responsible for the accuracy, integrity and reliability of the data it sends to the processor and for meeting all legal obligations related to the processing, and must keep an accurate list of the categories of data processed.

6. Subprocessors and international transfers

To provide the Services, AdBooks uses subprocessors. These may be third-party providers inside or outside the EU/EEA. AdBooks makes sure that all subprocessors meet the obligations of this DPA, in particular that their level of data protection meets the standards required by data protection law. This DPA is the controller's specific and general prior written authorisation for AdBooks to use subprocessors.

If a subprocessor is established in, or stores Personal Data in, a jurisdiction outside the EU/EEA that the European Commission has not approved as offering adequate protection, AdBooks concludes an agreement with it, for example the European Commission's standard contractual clauses or other measures approved by the Commission, to protect the Personal Data.

Standard Contractual Clauses. AdBooks is established in a country outside the EU/EEA. Where the User is established in the EU/EEA (or the GDPR otherwise applies to the User's processing) and AdBooks processes Personal Data from a country without an adequacy decision, the parties agree that the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference and are entered into by the User as data exporter and AdBooks as data importer. For those clauses: clause 7 (docking clause) is omitted; under clause 9(a) option 2 (general authorisation) applies, with the notice period described in this section; the optional wording in clause 11 is omitted; under clause 13 the competent supervisory authority is the one of the Member State in which the User is established; under clause 17 (option 1) the clauses are governed by the law of Germany; under clause 18(b) the courts of Germany have jurisdiction; Annex A and Annex B of this DPA serve as Annexes I and II of the clauses, and Annex C lists the subprocessors. If the clauses conflict with this DPA or the Terms of Service, the clauses prevail. For Users established outside the EU/EEA whose data protection law requires equivalent safeguards, the parties agree to apply the same clauses, with the changes needed to refer to that law and its supervisory authority.

AdBooks informs the controller before it changes its subprocessors. The controller may object to a new subprocessor, but only if AdBooks does not process the data in line with data protection law. AdBooks can show compliance by giving the controller access to the data protection assessment it carried out. If the controller continues to object, it may terminate its Subscription immediately so that its Personal Data is not processed by the unwanted subprocessor. The controller may withdraw its authorisation at any time, but this ends the agreement and AdBooks can then no longer provide the Services.

7. Termination, return and deletion

When the Subscription ends, AdBooks deletes all Personal Data, except data that must be kept under applicable legal provisions; such data is kept with the technical and organisational guarantees provided by AdBooks. The controller has full access to download all its Personal Data from the Software. If the controller asks AdBooks for help with downloading its data, the costs are agreed by both parties and depend on the complexity of the request and the time needed to deliver the data in the chosen format.

8. Liability and governing law

Liability under this DPA is subject to the limits in the General Terms of Service. This DPA is governed by the same law and jurisdiction as the General Terms of Service.

Annex A - Categories of Personal Data and data subjects

A. Categories of Personal Data (non-exhaustive)

• last name and first name
• address and mailing addresses
• phone numbers
• email addresses
• account numbers and banking information

B. Categories of data subjects (non-exhaustive)

• employees of the controller
• contact persons of the controller (phone, email, address and so on)
• customers of the controller
• banking details of the controller
• employees of the controller's clients
• contacts of the controller's clients (phone, email, address and so on)
• customers of the controller's customers
• banking information of the controller's clients

Annex B - Technical and organisational measures

• encryption of data in transit with TLS and certificates
• passwords stored using a secure encrypted process
• access to systems restricted to selected employees and suppliers, with authentication by URL, username and password
• physical security of data centres, firewalls and monitoring systems
• mirrored database configuration, with data always stored in two separate locations
• backup to an off-site location every 24 hours
• regular software updates
• logging of creation, modification and deletion of data with the name of the User, the name of the customer and the date

Annex C - Subprocessors

AdBooks updates this list when it changes and informs the controller as described in section 6.

Owner of AdBooks

• Admonet LLC
• Address: 30 N Gould St Ste R, Sheridan, WY 82801, United States
• EIN: 30-1290301
• Email: info@adbooks.co

Because AdBooks is owned by Admonet LLC, all references to the AdBooks application and its policies apply equally to Admonet LLC.