Privacy Policy

Effective 15 November 2026

1. Who is responsible

The controller of your personal data is Fördős Adrián László e.v., 1143 Budapest, Hungária körút 108. 1/1, Hungary, VAT ID HU41915420 ("we"). You can reach us about anything in this policy at support@commerlin.com.

This policy covers the commerlin.com website and the Commerlin app. Commerlin is a business tool, so the personal data we handle is mostly that of the people who work for our business customers.

2. What we collect

• Account data: your name, work email, password (stored only as a secure hash by our authentication provider), your role, and your organisation and the teammates you invite.
• Business and brand data: your store's address and the public pages we read from it, brand details, markets and languages, product information, and the brand kit and Product DNA we draft with you.
• Material you upload or connect: reference ads, product photos, documents, notes, and ads read from boards you connect (for example in Foreplay).
• Generated content and decisions: the ads, copy and images we generate, and your approvals, rejections and reasons.
• Connection data: for services you connect, such as Foreplay or Meta, the account and asset IDs you share with us and any API keys. Keys are stored encrypted and never shown back in full.
• Billing data: your plan, credit balance and purchase history, plus the Stripe customer and payment references for your purchases. Stripe processes your card details; we never receive or store them.
• Usage and technical data: sign-in events, actions in the app, error logs, IP address, browser type, and the bot-check result from Cloudflare Turnstile.
• Messages: what you write to us at support@commerlin.com.

3. Why we use it, and our legal basis

We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not sell personal data, and we do not use your material or your ads to train AI models.

4. People in your material

Your uploads, reference ads and documents may show or name other people, such as models, customers or reviewers. You decide what you upload. You are responsible for having a legal basis for it and for informing those people where the law requires it. For that content we process data on your behalf. If you need a data processing agreement (Art. 28 GDPR), write to support@commerlin.com.

5. Who we share it with

We use these service providers (processors) to run Commerlin. Each one receives only what it needs for its task and is bound by a data processing agreement.

We configure AI providers for paid business use, where they state that inputs and outputs are not used to train their models. We may change which providers we use and will keep this list current.

Services you connect. When you connect Foreplay, Meta or another tool, or bring your own AI provider keys, data passes between Commerlin and that service on your instruction. That service handles it under its own privacy policy, as a separate controller.

We may also disclose data where the law requires it, to protect our rights or users' safety, or to a successor if the business is transferred, in which case this policy continues to apply.

6. International transfers

Some providers above process data outside the European Economic Area, mainly in the USA. Where they do, the transfer is covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

• Account, brand material and ads: while your account is open. After you close it, we delete them within 30 days.
• Backups: encrypted backups are kept for up to 90 days and then deleted automatically. Deleted data disappears from them as they roll off.
• Billing and accounting records: 8 years, as Hungarian accounting law requires.
• Technical and security logs: usually up to 90 days, longer only while we investigate an incident.
• Support emails: up to 2 years after the conversation ends, unless they are needed for a claim.

8. Cookies and similar technology

• This website (commerlin.com) sets no cookies, uses no analytics or advertising trackers, and serves its fonts from its own domain.
• The app uses only strictly necessary cookies and storage: those that keep you signed in, and Cloudflare Turnstile, which checks that a sign-in is not a bot. These need no consent, because the service cannot work without them.
• The app measures page speed with Vercel Speed Insights. It sets no cookies and does not identify you.

9. Security

We protect data with encryption in transit (HTTPS) and at rest. Connected-service keys are encrypted with a separate key, and backups are encrypted and locked against deletion. Each organisation's data is kept separate, and access is limited by role. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authority as the law requires.

10. Your rights

Under the GDPR you have the right to:

• access your data and get a copy;
• have it corrected or deleted;
• restrict how we use it;
• receive it in a portable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting processing that took place before.

Write to support@commerlin.com. We will reply within one month. If you are a teammate in someone else's organisation, we may pass your request to that organisation's admin.

You can also complain to the Hungarian data protection authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11, naih.hu. You may also complain to the authority in the EU country where you live or work.

11. Children

Commerlin is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.

12. Changes to this policy

We will update this policy when our practices or providers change, and we will show the new effective date at the top. We will email account owners about material changes before they apply.

Controller details