Effective Date: April 17, 2026 · Version 2.1
This Privacy Policy explains how Obsidian Labs LLC-FZ ("AdHelper," "we," "us," or "our") collects, uses, discloses, and safeguards personal data when you visit adhelper.ai (the "Site") or use the AdHelper platform and related services (collectively, the "Services"). It is designed to comply with the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL") and its Executive Regulations, the EU General Data Protection Regulation 2016/679 ("EU GDPR"), the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Brazilian General Data Protection Law ("LGPD"), Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial laws, Australia's Privacy Act 1988 and the Australian Privacy Principles, Singapore's Personal Data Protection Act 2012 ("PDPA"), Japan's Act on the Protection of Personal Information ("APPI"), South Korea's Personal Information Protection Act ("PIPA"), India's Digital Personal Data Protection Act 2023 ("DPDP Act"), South Africa's Protection of Personal Information Act 2013 ("POPIA"), Switzerland's Federal Act on Data Protection ("FADP"), and other applicable data-protection laws.
By using the Services, you confirm that you have read and understood this Privacy Policy. In this document, "personal data" and "personal information" are used interchangeably and carry the meaning assigned under the applicable law that governs your relationship with us.
The controller responsible for your personal data under this Privacy Policy is:
Obsidian Labs LLC-FZ
Registered in Meydan Free Zone, Dubai, United Arab Emirates
Trade Licence No.: 2542887
Registered address: Meydan Grandstand, Dubai, United Arab Emirates
All privacy enquiries should be directed to privacy@adhelper.ai.
We collect the following categories of personal data. Categories are mapped to the CCPA/CPRA statutory categories in Section 15.
Sensitive personal data. We do not intentionally collect sensitive personal data. We ask that you do not upload such data into Customer Content. Voice samples used with consent for synthetic-media features are treated as biometric-adjacent data and processed only to deliver the feature; we do not use them to uniquely identify individuals.
We process personal data only where we have a lawful basis under the applicable law that governs you. The table below sets out each purpose and the corresponding legal basis under the EU/UK GDPR. Where the UAE PDPL applies, we rely on the equivalent lawful basis recognised in Article 4 of the PDPL (processing necessary for the performance of a contract, compliance with a legal obligation, protection of the data subject's or another person's vital interests, legitimate interests of the controller, or the data subject's consent, as applicable).
| Purpose | EU/UK GDPR basis |
|---|---|
| Create and administer your account; authenticate you | Art. 6(1)(b) - performance of a contract |
| Deliver the Services in accordance with your subscription (including generating ad creatives from your inputs) | Art. 6(1)(b) - performance of a contract |
| Process payments, invoicing, and tax compliance | Art. 6(1)(b) and Art. 6(1)(c) - contract and legal obligation |
| Send service and transactional communications (security alerts, billing notices, material changes) | Art. 6(1)(b) - performance of a contract |
| Send marketing emails and product announcements | Art. 6(1)(a) - consent; or Art. 6(1)(f) legitimate interest under narrow B2B "soft opt-in" conditions under PECR/ePrivacy where applicable |
| Maintain security, detect fraud, prevent abuse | Art. 6(1)(f) - legitimate interest (safeguarding the Services); Art. 6(1)(c) where legally required |
| Product analytics and aggregate usage measurement (de-identified where feasible) | Art. 6(1)(f) - legitimate interest, subject to your objection |
| Improve the Services using de-identified telemetry and feature-level metrics | Art. 6(1)(f) - legitimate interest (LIA documented; opt-out available) |
| Train or fine-tune AI models using Customer Content | Art. 6(1)(a) - explicit opt-in consent only |
| Comply with legal obligations, respond to lawful requests, enforce our terms | Art. 6(1)(c) - legal obligation; Art. 6(1)(f) for enforcement |
Legitimate interests assessments. For each processing activity we rely on as a legitimate interest, we maintain a documented legitimate interests assessment (LIA) and provide a mechanism to object at privacy@adhelper.ai.
This is a standalone commitment because of its importance:
The Services use AI to generate ad creatives and surface trend analysis. These are automated processes, but they do not produce legal or similarly significant effects on you as a data subject of AdHelper. You, as our customer, decide how to use the outputs; any subsequent advertising, targeting, or decisioning you perform is under your responsibility as a separate controller, and you are responsible for compliance with Article 22 GDPR, the EU AI Act, and equivalent laws in your jurisdiction. You have the right to request human review of any automated decision taken by AdHelper that you believe significantly affects you, by writing to privacy@adhelper.ai.
We retain personal data only for as long as necessary for the purposes for which it was collected, plus any period required by law or needed to defend legal claims. Specific periods are:
Requests to exercise rights (including deletion) are actioned without undue delay and in any event within 30 days, extendable once by a further 60 days where the request is complex, with notice to you.
We disclose personal data only to the categories of recipients below and only as strictly necessary:
We do not sell personal information (as defined under the CCPA/CPRA). We do not share personal information for cross-context behavioural advertising. We do not disclose Customer Content to advertisers or ad networks for their own marketing purposes.
A current list of our sub-processors is published separately and is versioned; we commit to giving enterprise customers at least 30 days' advance notice of material changes to the list, with a right to object on reasonable data-protection grounds. Request the current list at privacy@adhelper.ai.
We use reputable cloud infrastructure and sub-processors to operate the Services. Depending on the sub-processor, personal data may be stored or processed in jurisdictions other than your own, including outside the United Arab Emirates, the European Economic Area, and the United Kingdom.
Where we transfer personal data out of the United Arab Emirates, we rely on the safeguards permitted under the UAE PDPL and its Executive Regulations - namely, as applicable, an adequacy determination issued by the UAE Data Office, appropriate contractual safeguards, your explicit consent, or another statutory basis available under UAE law.
Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on one or more of the following: (a) an adequacy decision of the European Commission or the UK Secretary of State; (b) the European Commission Standard Contractual Clauses (2021/914), typically Module 2 (controller-to-processor) or Module 3 (processor-to-processor), supplemented by the UK International Data Transfer Addendum where UK data is involved; or (c) another derogation permitted under Article 49 GDPR. We conduct documented Transfer Impact Assessments for SCC-based transfers in line with Schrems II (C-311/18) and EDPB Recommendations 01/2020.
A copy of the safeguards in place for any specific transfer is available on request.
Depending on where you are located, you have some or all of the following rights in respect of your personal data:
To exercise any right, email privacy@adhelper.ai. We will verify your identity before responding. We respond within 30 days, extendable once by 60 days for complex requests. We will not discriminate against you for exercising your rights.
Supervisory authorities. You may lodge a complaint with:
We use the following categories of cookies and similar technologies:
You can manage preferences through our cookie banner or your browser settings. We honour Global Privacy Control (GPC) signals as a valid opt-out of "sale" and "sharing" under the CCPA/CPRA. We do not currently respond to legacy "Do Not Track" browser signals because there is no uniform standard, but GPC is honoured.
We maintain technical and organizational measures appropriate to the risk, including:
We do not claim any certification we do not hold. Where we obtain certifications (e.g., SOC 2, ISO/IEC 27001), we will update this Section.
Breach notification. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, consistent with Article 33 of the EU/UK GDPR and the breach-notification requirements of the UAE PDPL and its Executive Regulations. Where the breach is likely to result in a high risk, we will notify affected individuals without undue delay.
No method of transmission over the internet or electronic storage is entirely secure, and we cannot guarantee absolute security.
The Services are intended for businesses and their authorized representatives and are not directed to children. We do not knowingly collect personal data from anyone under 18 in jurisdictions that require majority for commercial contracts (including the United Arab Emirates).
For users in the United States, we do not knowingly collect personal data from children under 13 (COPPA). For users in the European Economic Area, we do not knowingly offer Services to children under the digital-consent age set by the relevant Member State (between 13 and 16). If you believe we hold data concerning a child below the applicable threshold, contact privacy@adhelper.ai and we will promptly delete it.
The Site may contain links to third-party websites or services that we do not operate. We are not responsible for the privacy practices of those third parties. We encourage you to review their policies.
If you are a resident of a United States state with a comprehensive privacy law, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or any other state granting equivalent rights, you have the rights summarized below, to the extent granted by your state's law. Residents of any of these states may exercise rights by emailing privacy@adhelper.ai. We will verify your identity, respond within 45 days (extendable by 45 days where permitted), and will not retaliate against you for exercising any right.
We do not knowingly collect or use sensitive personal information to infer characteristics. Where account credentials are collected, they are used only for authentication. You have the right to limit the use of sensitive personal information where applicable.
If you are located in Brazil, you have rights under the LGPD equivalent to the EU GDPR rights listed above, including confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and revocation of consent. You may contact our Brazil-facing point of contact at privacy@adhelper.ai and may lodge a complaint with the ANPD.
If you are a resident of Canada, your personal information is protected under the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where applicable, provincial laws including Quebec's Act Respecting the Protection of Personal Information in the Private Sector (as amended by "Law 25"), Alberta's Personal Information Protection Act, and British Columbia's Personal Information Protection Act. You have the right to:
Where we transfer your personal information to service providers outside Canada, your information may be subject to the laws of those jurisdictions, including lawful requests from their courts and authorities.
If you are located in Australia, we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). You have the right to:
We may disclose your personal information to overseas recipients (including sub-processors in the United States, the European Economic Area, and other jurisdictions). We take reasonable steps to ensure that overseas recipients handle your personal information in a manner consistent with the APPs, consistent with APP 8.
If you are located in Singapore, we comply with the Personal Data Protection Act 2012 ("PDPA"). You have the right to:
Our data protection point of contact for Singapore enquiries is reachable at privacy@adhelper.ai. Where we transfer your personal data out of Singapore, we take steps to ensure that the overseas recipient is bound by legally enforceable obligations providing a standard of protection comparable to the PDPA.
If you are located in Japan, we handle your personal information in accordance with the Act on the Protection of Personal Information ("APPI"), as amended. You have the right to:
Where we transfer your personal information outside Japan, we either obtain your prior consent after providing information about the transfer destination, adopt contractual safeguards meeting APPI standards, or rely on another basis permitted by Article 28 of the APPI.
If you are located in South Korea, we process your personal information in accordance with the Personal Information Protection Act ("PIPA") and its implementing regulations. You have the right to:
Where we transfer your personal information overseas, we provide the notices and obtain the consents required by Article 28-8 of the PIPA, or rely on another lawful basis permitted under PIPA.
If you are located in India, your personal data is protected under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). As a Data Principal, you have the right to:
Grievance officer contact: you may submit a grievance in respect of our processing of your personal data to privacy@adhelper.ai. We will respond within the period prescribed under the DPDP Act and its implementing rules. If your grievance is unresolved, you may lodge a complaint with the Data Protection Board of India once it is operational.
If you are located in South Africa, we process your personal information in accordance with the Protection of Personal Information Act, 2013 ("POPIA"). You have the right to:
Where we transfer your personal information out of South Africa, we do so in reliance on Section 72 of POPIA, including where the recipient is subject to a law, binding corporate rules, or binding agreement providing an adequate level of protection.
We may update this Privacy Policy to reflect changes in our practices or the law. Material changes will be notified by posting the updated policy with a new Effective Date and, for significant changes, by email to the registered account holder at least 10 days before the change takes effect.
For privacy questions, rights requests, or DPA requests:
Obsidian Labs LLC-FZ
Meydan Grandstand, Meydan Free Zone, Dubai, United Arab Emirates
Trade Licence No.: 2542887
Privacy and security / breach: privacy@adhelper.ai