AdRunna — Privacy Policy
Last Updated: February 2026 · Effective Date: February 2026
1. Introduction
This Privacy Policy explains how Simpliflex Systems Limited (RC-9336897) ("we", "us", "our") collects, uses, stores, and protects your personal data when you use AdRunna (the "Platform").
We are committed to protecting your privacy in accordance with:
- The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023
- The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
2. Data Controller
Simpliflex Systems Limited is the data controller responsible for your personal data.
Contact: hello@adrunna.com
3. Data We Collect
3.1 Information You Provide
| Data | Purpose | Legal Basis |
|---|---|---|
| Full name | Account identification | Contract performance |
| Email address | Account login, communications | Contract performance |
| Password (hashed) | Account security | Contract performance |
| Company name | User profile, personalisation | Contract performance |
| User type (advertiser/agency) | Service customisation | Contract performance |
| Phone number (optional) | Account recovery, WhatsApp communication | Consent |
3.2 Information Generated Through Use
| Data | Purpose | Legal Basis |
|---|---|---|
| Campaign briefs (budget, audience, regions) | AI media plan generation | Contract performance |
| Generated media plans | Service delivery, plan history | Contract performance |
| Station favourites/shortlists | Personalised experience | Contract performance |
| Subscription and payment records | Billing, financial records | Contract performance / Legal obligation |
3.3 Automatically Collected Data
| Data | Purpose | Legal Basis |
|---|---|---|
| IP address | Security, fraud prevention | Legitimate interest |
| Browser type and version | Technical support, compatibility | Legitimate interest |
| Pages visited and actions taken | Service improvement, analytics | Legitimate interest |
| Login timestamps | Security, account management | Legitimate interest |
4. How We Use Your Data
We use your personal data to:
(a) Provide the Service — create and manage your account, generate media plans, process subscriptions, and deliver platform features.
(b) Process Payments — manage subscription billing through Paystack. We do not store your payment card details; Paystack handles this securely.
(c) Communicate with You — send account-related notifications, subscription confirmations, and important service updates.
(d) Improve the Platform — analyse usage patterns to improve features, fix issues, and optimise performance.
(e) Ensure Security — detect and prevent fraud, abuse, and unauthorised access.
(f) Comply with Legal Obligations — meet regulatory, tax, and legal reporting requirements in both Nigeria and the United Kingdom.
We will not use your personal data for purposes incompatible with those listed above without your consent.
5. Data Sharing
We do not sell your personal data. We share data only in the following circumstances:
5.1 Service Providers
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database hosting | Account data, plans, favourites | EU (Ireland) |
| Paystack | Payment processing | Email, payment details | Nigeria |
| Anthropic (Claude) | AI plan generation | Campaign briefs (anonymised) | United States |
| Vercel | Frontend hosting | IP address, browser data | Global CDN |
| Render | Backend hosting | Server logs | EU (Frankfurt) |
5.2 Legal Requirements
We may disclose your data if required by law, regulation, court order, or governmental request in Nigeria or the United Kingdom.
5.3 Business Transfers
If Simpliflex Systems Limited is acquired or merged, your data may be transferred to the successor entity. We will notify you of any such transfer.
6. International Data Transfers
Your data may be processed in the following locations:
- Nigeria — Paystack payment processing
- European Union (Ireland/Frankfurt) — Database and backend hosting
- United States — AI processing via Anthropic
Where data is transferred outside Nigeria or the UK, we ensure appropriate safeguards are in place, including standard contractual clauses and adequacy assessments, in compliance with the NDPA and UK GDPR.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 12 months after deletion |
| Media plans | Duration of account + 6 months after deletion |
| Payment records | 7 years (Nigerian tax/accounting requirements) |
| Server logs | 90 days |
| Deleted account data | Permanently removed within 30 days of deletion request |
8. Your Rights
Under the NDPR/NDPA and UK GDPR, you have the right to:
8.1 Access
Request a copy of the personal data we hold about you.
8.2 Rectification
Request correction of inaccurate or incomplete personal data.
8.3 Erasure ("Right to be Forgotten")
Request deletion of your personal data, subject to legal retention requirements.
8.4 Data Portability
Request your data in a structured, commonly used, machine-readable format.
8.5 Restriction of Processing
Request that we limit the processing of your data in certain circumstances.
8.6 Objection
Object to the processing of your data based on legitimate interests.
8.7 Withdraw Consent
Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at hello@adrunna.com. We will respond within 30 days (or sooner as required by law).
9. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption of data in transit (HTTPS/TLS)
- Hashed and salted password storage (bcrypt)
- JWT-based authentication with token expiry
- Row-level security in the database
- Regular security reviews
- Access controls limiting data access to authorised personnel only
No system is completely secure. While we take reasonable precautions, we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities as required by the NDPA and UK GDPR.
10. Cookies
The Platform uses essential cookies for authentication and session management. We do not currently use third-party advertising or tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| Session token | Authentication | 7 days |
| User preferences | Language, display settings | 30 days |
If we introduce non-essential cookies in the future, we will update this policy and obtain your consent where required.
11. Children's Privacy
The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.
12. Third-Party Links
The Platform may contain links to third-party websites (e.g., radio station websites, payment processors). We are not responsible for the privacy practices of third-party sites. We encourage you to review their privacy policies.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The "Last Updated" date at the top indicates when this policy was last revised.
14. Complaints
If you believe your data protection rights have been violated, you may lodge a complaint with:
In Nigeria:
Nigeria Data Protection Commission (NDPC)
Website: ndpc.gov.ng
In the United Kingdom:
Information Commissioner's Office (ICO)
Website: ico.org.uk
15. Contact Us
For questions, requests, or concerns about this Privacy Policy or your personal data, contact:
Simpliflex Systems Limited
Data Protection Contact
Email: hello@adrunna.com
Website: adrunna.com
This Privacy Policy was last updated in February 2026.