Privacy Policy

Last updated: July 6, 2026

1. Data controller

The controller of your personal data is Piotr Gorczyca, conducting business as PiotrGorczyca.com, NIP (tax ID): 7171814753, Wroczyńskiego 6/63, 21-500 Biała Podlaska, Poland (“Sustento”, “we”), the operator of the Sustento service.

Contact for all matters concerning personal data: [email protected]

2. What data we process

Account data

  • e-mail address, name (if provided), preferred language,
  • password — stored only as a cryptographic hash (never in plain text),
  • if you sign in with Google: basic profile data (e-mail, name) received from Google.

Data from the Meta advertising system

After you connect a Meta ad account (via a System User token that you provide yourself), we retrieve through the Meta Marketing API:

  • ad account metadata (name, identifier, currency, time zone),
  • campaign structure: campaigns, ad sets, ads (names, statuses, budgets, settings),
  • performance statistics (insights): spend, impressions, clicks, conversions and derived metrics.

This data concerns your ad accounts, not the people your ads are shown to. We do not collect personal data of ad audiences.

Technical and audit data

  • a log of operations in the service (who approved a change, connected or disconnected an account, and when),
  • AI feature usage statistics (request counts, token usage).

3. Meta data — how we store and use it

  • The access token is encrypted with AES-256-GCM immediately upon saving and stored exclusively in encrypted form in our database (Convex). The token is never displayed again or shared with third parties.
  • Campaign data and statistics are cached to power the dashboard, AI reports and the assistant chat.
  • Purposes of processing: displaying the campaign performance dashboard, generating AI reports and recommendations, and handling campaign changes (pause, budget change, creation), each of which requires your explicit approval.
  • What we do not do: we do not sell data, we do not use it for our own advertising purposes, and we do not share it with third parties other than the processors listed in section 5.

4. Purposes and legal bases

  • Providing the service (account, dashboard, reports, campaign changes) — Art. 6(1)(b) GDPR (performance of a contract).
  • Security and accountability (audit log, encryption) — Art. 6(1)(f) GDPR (legitimate interest).
  • Communicating with you (responding to requests) — Art. 6(1)(b) and (f) GDPR.

5. Data recipients and processors

We use the following service providers (data processors):

  • Convex, Inc. (USA) — database and application backend hosting,
  • Anthropic, PBC (USA) — processing campaign data to generate reports and AI assistant responses,
  • Meta Platforms Ireland Ltd. — the source of advertising data (Marketing API); your advertising data also remains with Meta under their own policies,
  • Google LLC (USA) — only if you sign in with Google.

Transfers of data outside the European Economic Area take place on the basis of an adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

6. Retention periods

  • Account data — for as long as you hold an account in the service.
  • The Meta token and campaign data — until you disconnect the Meta account or delete your account in the service.
  • The audit log — up to 12 months from the event or until account deletion.

7. Data deletion — instructions

You can delete your data at any time:

  1. Disconnecting a Meta account: in the app, go to Settings → Meta Accounts and click Disconnect. This immediately and permanently deletes the encrypted access token and all cached campaign, ad set and ad data from that connection.
  2. Deleting your entire account and all data: send a message to [email protected] from the e-mail address associated with your account. We will delete the account together with all data within 30 days and confirm this to you.

8. Your rights

You have the right to: access your data, rectify it, erase it, restrict processing, data portability, and object to processing based on legitimate interest. Send requests to [email protected].

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

9. Cookies

The service uses only essential cookies: the login session and remembering your chosen language. We do not use advertising or tracking cookies.

10. Changes to this policy

We will inform you of material changes to this policy in the app or by e-mail. The current version is always available at /en/privacy.