Here For Ads

Privacy Policy

Last updated: 5 October 2026

This Privacy Policy explains how HereForAds collects, uses, shares and protects personal data, and the rights you have. It applies to everyone who uses hereforads.com, including Sellers, Buyers (including guest buyers) and visitors. It should be read together with our Terms of Service.

1. Who we are

HereForAds is operated by 7Smile group,a treading name of a sole trader based in the United Kingdom. We are the “controller” of your personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU GDPR. You can contact us about privacy using the contact form or at hello@hereforads.com.

2. The data we collect

Information you give us

  • Account details: email address and password (stored only as a secure hash by our authentication provider). If you turn on two-factor authentication, we store the related security settings.

  • Profile and listings: display name, username, bio, avatar and banner images, website, content categories, social media handles, profile links and follower/audience figures, listing titles, descriptions, prices, booking calendars, photos and other media.

  • Orders: what you bought or sold, dates, amounts, currency, order status, delivery links you submit, cancellation reasons, and the time you accepted our Terms and asked for the service to start immediately.

  • Guest checkout: if you buy without signing up first, your email address. Stripe also collects your name, billing address and phone number on its payment page and shares them with us so we can contact you about the order. If you don’t already have an account, we create a basic one linked to your email so you can track the order.

  • Sponsor display (optional): if you choose to show your brand on a listing, the brand name and link you enter. These are public.

  • Messages: messages and images you send to other users through HereForAds.

  • Support: your name, email and message when you use the contact form or email us, and any reports you make.

Information collected automatically

  • Technical and security data: IP address, browser and device information and request logs, which our hosting provider processes when you visit. To stop abuse, we keep counts of recent login, sign-up and order attempts. These counts are stored only as one-way salted hashes of your IP address or email and are deleted when the counting window ends.

  • Bot protection: Cloudflare Turnstile checks some browser and device signals on our forms to tell people from automated bots.

  • Usage analytics: Vercel Web Analytics counts page views and a few anonymous checkout steps (such as how many people click “Buy now”). It does not use cookies or identify you personally (see section 8).

Information from third parties

  • Stripe: for Sellers, whether your payout account and identity verification are complete, and payout status. We do not receive or store your full card number, bank account details or identity documents. Stripe handles these directly.

  • Google sign-in (if you use it): your name, email address and profile picture from your Google account.

3. How we use your data and our legal bases

  • To provide HereForAds and perform our contract with you (contract): creating and running your account, showing your profile and listings, processing Orders, holding and releasing payments, refunds, payouts, sending messages between users, and sending you service emails about your account and Orders (such as order confirmations, delivery notices and sign-in links).

  • To keep HereForAds safe (legitimate interests in preventing fraud and abuse, and protecting users): verifying users through Stripe, payout reviews, investigating reports and disputes, rate limiting, bot protection, enforcing our Terms, and responding to chargebacks.

  • To improve HereForAds (legitimate interests): understanding anonymous usage trends, fixing bugs and developing features.

  • To meet legal obligations (legal obligation): keeping accounting and tax records, reporting Seller information to tax authorities where required, and responding to lawful requests from authorities.

  • To handle legal claims (legitimate interests): establishing, exercising or defending legal claims.

  • With your consent: for anything optional where we ask for permission first (for example, if we start sending marketing emails). You can withdraw consent at any time.

We do not sell your personal data, and we do not use it for third-party advertising.

4. What other people can see

Your public profile, sponsorship page, listings, social media stats, booking calendar availability and any sponsor brand you choose to display are visible to anyone on the internet and may be indexed by search engines. Please don’t include personal information you don’t want to be public.

When you place or receive an Order, the other party sees the information needed to complete it, such as your display name, the Order details and your messages. We don’t show a guest buyer’s billing address or phone number to Sellers.

5. Who we share data with

We share personal data only as needed with:

  • Stripe: payment processing, Seller onboarding and identity verification, payouts and fraud prevention. For some of this processing (such as identity checks and fraud prevention), Stripe acts as an independent controller under its own privacy policy.

  • Supabase: database, authentication and file storage.

  • Vercel: website hosting and privacy-friendly analytics.

  • Cloudflare: bot protection (Turnstile).

  • Resend: sending service emails.

  • Google: only if you choose to sign in with Google.

  • Professional advisers such as accountants and lawyers, under a duty of confidentiality.

  • Authorities such as HM Revenue & Customs, the police or regulators, where the law requires it or where it is needed to prevent fraud or protect someone’s safety.

  • A buyer or successor if the HereForAds business is transferred (for example to a company). Your data will remain protected by this policy.

Our service providers process personal data only on our instructions and under contracts that require them to protect it.

6. International transfers

Some of our providers (including Stripe, Vercel, Cloudflare, Resend and Google) process data in the United States or other countries outside the UK and EEA. Where this happens, we rely on UK “adequacy” regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified), or on safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

7. How long we keep data

  • Account, profile and listings: for as long as your account is open. We delete or anonymise them within 90 days after the account is closed, except as described below.

  • Orders, payments and related messages: for 6 years after the end of the tax year in which the Order was completed, to meet UK accounting, tax and anti-fraud requirements and to handle any legal claims.

  • Contact-form and support messages: up to 2 years after the issue is resolved.

  • Rate-limit counters: only for the short window they count (minutes to hours).

  • Server logs: held by our hosting providers for their standard short periods.

  • Backups: deleted data may remain in encrypted backups for a limited time until they are overwritten.

We may keep data longer if we have to because of a legal claim, investigation or legal requirement.

8. Cookies and similar technologies

We only use cookies and similar storage that are strictly necessary to run the site, or that you ask for. We don’t use advertising or cross-site tracking cookies, so we don’t show a cookie consent banner. If we ever add non-essential cookies, we will ask for your consent first.

  • Sign-in cookies (names starting with sb-, set by Supabase Auth): keep you logged in and secure your session. Strictly necessary. They last until you log out or the session expires.

  • Password reminder cookie (hfa_pw_nudge_dismissed): remembers that you dismissed the “set a password” reminder. It lasts 7 days.

  • Cloudflare Turnstile: bot protection on forms such as sign-up, login, checkout and contact. It may use storage or cookies that are strictly necessary for security. It is not used for advertising.

  • Stripe: when you pay, Stripe’s checkout pages (on Stripe’s own domain) use cookies for fraud prevention and security, under Stripe’s cookie policy.

  • Vercel Web Analytics: uses no cookies and stores nothing on your device. Visits are counted in aggregate and aren’t linked to you or followed across other sites.

You can block or delete cookies in your browser settings. If you block sign-in cookies, you won’t be able to log in.

9. Messages

Messages are private between the users in the conversation. We do not read them routinely. Authorised staff may access messages when needed to investigate a report, a dispute or chargeback, suspected fraud, illegal content or a breach of our Terms, or when the law requires it. We don’t currently scan messages automatically. If we introduce automated checks (for example, warnings when someone asks to be paid off-platform), we will update this policy first and use them only for safety and fraud prevention.

10. Automated checks

We use simple automatic rules to decide when an Order needs a manual payout review (for example, a Seller’s first Orders or higher-value Orders) and to limit repeated login attempts. These rules only flag activity for review or briefly slow down requests. Decisions with a significant effect on you, such as refusing a payout or suspending an account, are made by a person, and you can ask us to explain or reconsider them.

11. Your rights

Depending on where you live, you have the right to:

  • access the personal data we hold about you and get a copy;

  • have inaccurate data corrected (you can edit most profile and listing details yourself in your dashboard);

  • have your data deleted;

  • restrict or object to our use of your data, including use based on legitimate interests;

  • receive data you gave us in a portable format; and

  • withdraw consent at any time, where we rely on consent.

To make a request, use the contact form or email hello@hereforads.com from the address linked to your account. We may need to verify your identity. We will respond within one month (this can be extended in complex cases, and we will tell you if so). Some data must be kept even after a deletion request, such as order and payment records we are legally required to keep (see section 7).

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or, if you live in the EU/EEA, to your local data protection authority.

12. Security

We protect data using encryption in transit (HTTPS), access controls that limit who can read each record, hashed passwords and security identifiers, optional two-factor authentication, and bot and rate-limit protection. Payment details are handled by Stripe, which is certified to PCI DSS Level 1. No system is completely secure. If a breach affects your data and is likely to put you at risk, we will tell you and the regulator as required by law.

13. Children

HereForAds is only for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above, and for significant changes we will notify you by email or on the site before they take effect.

15. Contact us

Questions or requests about your privacy: use the contact form or email hello@hereforads.com.