Privacy policy

Who is responsible

The controller for personal data processed through Saperta (app, web app and saperta.com) is Rafael Pauley, Franz-Fischer-Straße 44, 6020 Innsbruck, Austria. Contact: support@saperta.com.

What Saperta does

Saperta lets you manage advertising campaigns in your own OpenAI Ads account: view performance, pause and resume campaigns, change budgets and run schedules (dayparting). Saperta acts on your instructions using the OpenAI Ads API key you connect.

Data we process

• Your login: email address, a password hash (Argon2; we never store your password), your chosen language and, if you use Sign in with Apple, the anonymous identifier Apple provides.
• Connected ad accounts: the OpenAI Ads API key you enter (stored encrypted and used only to carry out your own instructions; it is never displayed, not even in our admin tools), the account name, currency and timezone.
• Campaign data: names, status, budgets and performance figures are loaded from OpenAI Ads when you open a screen. We do not keep copies of them, except the schedules and rules you save and a log of the changes you, your schedules and your rules make through Saperta.
• Technical data: when you use Saperta our servers record your IP address, the time and the requested address to keep the service secure and working. These logs are deleted after 30 days.
• Usage data: when you last used Saperta and how many requests your app made per day, so we can run and support the service.
• Emails: we send you confirmation, password-reset and security emails (for example when an ad account is connected), and, unless you switch them off in Settings → Email, notices when a rule pauses campaigns or an automation fails, and a weekly summary.

Why we process it (legal bases)

• To provide Saperta to you under our terms of service (Art. 6(1)(b) GDPR).
• To keep the service secure and to prevent misuse (legitimate interest, Art. 6(1)(f) GDPR).
• To comply with legal obligations, for example tax records (Art. 6(1)(c) GDPR).

We do not use your data for advertising, we do not sell it, and we do not use analytics or tracking tools.

Who receives data

• Amazon Web Services EMEA SARL (Luxembourg) hosts Saperta in Frankfurt, Germany. AWS acts as our processor under a data processing agreement.
• Resend, Inc. (USA) delivers our emails. It receives your email address and the content of the email, and acts as our processor under a data processing agreement.
• OpenAI: on your instruction we send requests to the OpenAI Ads API for your ad account. OpenAI processes this data as the provider of your advertising account, under its own terms and privacy policy.
• Apple: if you choose Sign in with Apple, Apple confirms your identity to us.
• Apple App Store and other app stores distribute the app under their own terms.

Transfers outside the EU

Saperta's servers and databases are in the EU (Frankfurt). Where OpenAI, Apple or Resend process data outside the EU, for example in the USA, they rely on the EU-U.S. Data Privacy Framework or standard contractual clauses.

How long we keep it

We keep your login and connected ad accounts until you delete your account. Deleting your account (in the app under Settings → Delete account) removes your login, stored keys, schedules and activity log immediately; encrypted backups are overwritten within 30 days. Server logs are kept for 30 days. Records we must keep by law are kept for the legally required period.

On your device

The app stores your sign-in token, language and appearance choice on your device (iOS Keychain, or your browser's local storage on the web). These are needed for the app to work. Saperta sets no tracking or advertising cookies.

Your rights

You have the right to access, rectify, erase and restrict processing of your data, to data portability and to object to processing based on legitimate interest. Write to support@saperta.com. You can also complain to a data protection supervisory authority, in particular the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Security

All connections use HTTPS. API keys are encrypted at rest, passwords are hashed with Argon2, and access to the servers is restricted.

Children

Saperta is a tool for businesses and is not intended for people under 16.

Changes

We will update this policy when Saperta changes. The current version always applies. Last updated: 2026-10-11.