Privacy policy

FrostyQ is a service from ThinkTech ApS.

ThinkTech ApS
Aarhus, Denmark
CVR 44998459
hello@thnktech.dk

FrostyQ handles two kinds of data, and our role is different for each:

• Your FrostyQ account, and visits to our sites. For these, ThinkTech ApS is the data controller.
• Data a business brings into FrostyQ. When a business connects its ad accounts, its store or its files, that business decides what FrostyQ does with the data and is its controller. We process it on the business's behalf, under our agreement with it, and for nothing else.

This policy covers frostyq.com and the FrostyQ app at app.frostyq.com.

If you sign in to FrostyQ, we store:

• Your account: your name, username, email address, a hashed password (we cannot read your password) and your settings, such as language and theme.
• Your access: the workspaces you belong to, your role in each, and invitations sent to you.
• Your activity: a change history of what you change in FrostyQ, such as pausing an ad, with the old and the new value, so your team can see who did what. Notes and tasks you write are stored too.
• Sign-in codes: if you sign in with a code sent by email, a hashed copy of the code, replaced when you ask for a new one.

Whenever anyone visits frostyq.com or the app, signed in or not, we also keep:

• A session record with your IP address and browser type. It expires two hours after your last visit and is then deleted.
• A page-view record: the page, your browser type, your country, the site you came from, and a pseudonymous key derived from your IP address (not the address itself).
• A security record of suspicious requests, with the same kind of pseudonymous key, used to block abusive bots.

If you send us a message through a form on frostyq.com, we store what you write, with your IP address and browser type.

A business that uses FrostyQ connects its own accounts. Depending on what it connects, FrostyQ stores:

• Advertising: campaigns, ad sets, ads, creatives, ad text and performance figures from the business's ad accounts on Meta (Facebook and Instagram), Pinterest and AppLovin, and Google Ads figures through Triple Whale. This includes Meta's own change history for the ad account, which names the people who made each change.
• Sales: orders, refunds and returns from the business's Shopify store, and orders with their attribution from Triple Whale, used to tie sales to the ads that drove them. Through Triple Whale this includes the business's customers: first and last name, email address, city, region, postcode and country, with their order history.
• Creative files: images and videos from the business's Google Drive. Speech in videos is transcribed on our own computers, so the team can search it and write ad text from it.
• People in the creative work: names, email addresses, phone numbers, social media handles, rates, payment terms and agreement notes for the creators and editors the business works with, including how long it may use their content. From Superfiliate: creators' names, contact details, social media handles, referral codes and the commission their sales earn.

The change history keeps earlier values too, so a creator's previous rate or email address can remain in it after it has been changed.

We use this data only to provide FrostyQ to that business.

When a business connects its Meta ad account, FrostyQ uses Meta's Marketing API with the access that business has granted. FrostyQ:

• reads the ad account's campaigns, ad sets, ads, creatives, performance insights and change history, to show the business how its advertising performs;
• creates, edits, pauses and resumes ads, ad sets and campaigns only when someone in that business asks it to;
• stores the access token Meta issues in encrypted form, and uses it for nothing else.

We do not sell data received from Meta, we do not share it with anyone except the processors listed below, and we do not use it for any purpose other than providing FrostyQ to the business that connected it. A business can withdraw FrostyQ's access at any time in its Meta Business settings.

• To provide FrostyQ: your account, and the work a business asks FrostyQ to do with its data. This is necessary for our agreement with you or your employer.
• To keep it secure and working: sessions, page views, security records, logs and error reports keep accounts safe, block abuse, and let us find and fix faults. This is our legitimate interest in a secure, working service.
• To email you about your account and your work in FrostyQ, such as invitations, sign-in codes and password resets. FrostyQ sends no marketing email.

We do not sell personal data, and we do not use it for advertising.

We use a small number of processors, each for one job:

• Hosting: our servers and database run at Hetzner in Nuremberg, Germany, managed through Ploi.
• Backups: encrypted copies are kept with Hetzner in Helsinki, Finland, and with Scaleway in Amsterdam, the Netherlands.
• Creative files: Bunny (bunny.net) stores images and videos and delivers them through its network of servers around the world.
• Email: Brevo sends FrostyQ's email and tells us whether a message was opened or a link in it clicked.
• Error reports: Flare receives a report when something breaks, on our servers or in your browser. A report can include your IP address, your name and email address if you are signed in, and details of the request.
• AI assistance: to describe creatives and draft ad text, we use Anthropic's Claude. This work runs on our own computers, which keep working copies of the creative files and transcripts. Claude sees the creative (images, video frames and transcript), its ad text, the brand's guidelines and, for a creator's content, the creator's name and short description. It never sees order or customer records. Anthropic is based in the United States, so this part is processed outside the EU.

FrostyQ is one of several products from ThinkTech ApS. Tasks in FrostyQ can be synced with Alpinsk, our task tool, and your account can be linked across our products using a pseudonymous (hashed) form of your email address.

The services a business connects (Meta, Triple Whale, Shopify, Superfiliate, Google Drive, Google Ads, Pinterest and AppLovin) exchange data with FrostyQ on that business's instruction, under the business's own agreements with them.

FrostyQ sets only its own cookies:

• a session cookie, which keeps you signed in and holds a visit together;
• a security cookie, which protects forms against forged requests;
• if you tick "Remember me", a cookie that keeps you signed in for up to 400 days.

The app also keeps your name, email address, picture and display settings in your browser's local storage, and the public site remembers the language you chose there.

There are no advertising cookies and no third-party analytics: we count page views ourselves, as described above. The only third-party script on frostyq.com is Flare's error reporter, which sends something only when a page breaks.

• Your account, change history, notes and tasks: until you ask us to delete them.
• Sessions: deleted once inactive for two hours.
• Page views: 30 days. Security records: 90 days.
• Email log: 180 days. After 90 days the recipient's address is replaced by a pseudonymous key.
• Messages sent through a form: until the form is removed, or until you ask us to delete yours.
• Business data: for as long as the business uses FrostyQ. When it stops, or asks us to, we delete it.
• Application logs: 14 days.
• Backups: taken every night and thinned out over time, with daily copies for about two weeks, then weekly, monthly and yearly copies. The oldest is kept for two years, so deleted data can remain in an encrypted backup until that backup is removed.

You can ask us to delete data at any time. FrostyQ has no delete button for this, so we do it by hand: we confirm by email and complete the deletion within 30 days.

• Your FrostyQ account: email hello@thnktech.dk from the address on your account, with the subject "Delete my FrostyQ account".
• A business's data, including data received from Meta: remove FrostyQ's access in your Meta Business settings, and in any other service you connected. Then email hello@thnktech.dk from an address at the business, with the subject "Delete our FrostyQ data". We delete everything FrostyQ stored for the business.
• If you are a customer of a business that uses FrostyQ, or a creator who works with one: contact that business, or write to us and we will pass your request on.

Backups are not edited. Deleted data leaves them on the schedule under "How long we keep it".

You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, or object to how we use it. Write to hello@thnktech.dk and we will answer within one month.

If your data came into FrostyQ through a business you deal with, such as an order you placed in its shop, you can also ask that business directly. We will help it answer.

If you think we have handled your data badly, you can complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk.

FrostyQ is only served over encrypted connections. Passwords and sign-in codes are hashed, the access tokens and keys for connected accounts are stored encrypted, and backups are encrypted. Access to the servers is limited to the people who run FrostyQ.

If this policy changes in a way that matters, we will say so in FrostyQ before the change takes effect. The date at the top shows when it last changed.