AdCast Privacy policy

Effective Date: September 19, 2026

This Privacy Policy describes how TIMONIX DOO ("AdCast", "we", "our" or "us"), located at Carkovacka 30v, 34206 Donja Sabanta, Serbia, collects, uses, and shares information in connection with the AdCast Digital Signage services. AdCast is the product and service name.

Controller and Processor Roles

For our website, user accounts, billing, customer support, marketing, security, product analytics/telemetry, and similar first-party processing, TIMONIX DOO acts as the data controller.

When personal data is processed through AdCast Digital Signage on behalf of a business customer, TIMONIX DOO acts as the data processor and the applicable business customer acts as the data controller. That processing is governed by the applicable customer agreement and Data Processing Addendum.

1. Information We Collect

Personal Information: We may collect personal information such as your name, email address, and contact details when you register or interact with the Application.

Personal Data:

• Email address (required to create and manage your account)
• Password (securely hashed and stored)
• User-generated content:
  • Uploaded images and media
  • Created ads and playlists

Device Information: We may collect information about devices used to access the Application, such as hardware model, operating-system version, app version, device identifiers, IP address, and network or diagnostic information.

Usage Information: We may collect information about how you use the Application, such as access times, features used, pages viewed, and service events needed to operate, secure, support, and improve the Service.

Automatically Collected Data:

• Device information (e.g., model, OS version)
• Usage analytics via Firebase Analytics
• Crash and error data via Sentry
• Push notification token (FCM device token) - collected when you grant notification permission, used solely to deliver push notifications to your device via Firebase Cloud Messaging

2. How and Why We Use Your Information

To Provide Services: We use your information to operate, maintain, and improve the Application.

Communication: We may use your contact information to send you updates, security alerts, and support messages.

Analytics and Improvement: To analyze usage trends and improve our services and user experience. Website analytics and optional embedded media are used only as described in the cookie section below.

3. How We Store and Protect Your Data

• We use technical and organizational measures designed to protect data, including access controls and encryption in transit where appropriate.
• Access to account data and media is restricted through authentication and authorization controls.
• Service data may be processed in the European Economic Area, the United States, and other locations where our service providers operate, as described below and in our GDPR information.

4. Sharing of Information

We do not share your personal information with third parties except in the following instances:

Service Providers: We may share information with service providers who perform services on our behalf.

Legal Compliance: We may disclose information if required by law or if we believe that such action is necessary to comply with legal obligations.

We do not sell your personal data.

Depending on the features and purchase channel you use, recipients may include:

• Amazon Web Services: Hosting, storage, content delivery, and media processing.
• Google: Firebase Cloud Messaging for push notifications and, where you consent on our website, Google Analytics 4 – Firebase Privacy Policy.
• Sentry: Error and crash reporting – Sentry Privacy Policy.
• Stripe and RevenueCat: Subscription and payment records, where used by the applicable purchase channel.
• Apple and Google Play: App-store purchases and subscription administration when you purchase through those stores.
• Email providers: Transactional service and support communications.
• Canva: Only when you choose to connect the Canva integration, as described below.

We share only the data reasonably necessary for the relevant purpose. Where required, we enter into appropriate data-processing terms and use transfer safeguards. A current sub-processor summary is available in our GDPR information and may be updated as our services change.

5. Canva Integration and Imported Content

AdCast integrates with Canva, a third-party platform, to let you export Canva content that you select into your AdCast account. When you connect the services and request an export, we may process the identity of your connected AdCast account; Canva design and page identifiers or page numbers; design title or other content metadata supplied by Canva; signed metadata that helps us verify the source and identity of exported content; selected image or video files; dimensions, aspect ratio, and export format; temporary Canva export URLs; the AdCast Media folder, Ad folder, or playlist you select; and technical authorization information needed to operate and secure the connection.

We use this information only as necessary to connect and authorize the services, retrieve and import the content you select, prevent duplicate imports, organize imported Media, create Ads or assign them to compatible playlists when you request those options, operate and secure the integration, and troubleshoot failures. Canva may provide temporary URLs for retrieving selected exports. We use those URLs to retrieve the content and do not use them as permanent Media identifiers. After import, the resulting Media may be processed for digital signage, stored in your AdCast Media library using our normal storage infrastructure, used to create thumbnails or other technical derivatives, used to create an Ad when you enable that option, added to a selected playlist when you request it, and displayed through AdCast digital signage services.

Authorization tokens allow Canva and AdCast to communicate without sharing your passwords. AdCast does not receive your Canva password. Canva does not receive your AdCast or Cognito password through this integration, and the Canva app does not receive your underlying AdCast Cognito access credentials. Connecting AdCast does not give AdCast unrestricted access to all content in your Canva account; we process content and data required for the export you request.

Temporary authorization and export information is retained only as necessary to complete, secure, troubleshoot, or enforce the integration. Imported Media, any Ads created from it, and playlist assignments are normal AdCast account data and follow the retention rules below. You may disconnect or remove the AdCast integration through available Canva app/account controls or AdCast integration controls. Disconnecting prevents future authorized interaction but does not automatically delete Media, Ads, or playlist assignments previously imported into AdCast; you may manage or delete them using normal AdCast functionality.

Your use of Canva remains subject to Canva's own Privacy Policy and Terms of Use. AdCast does not control Canva's independent processing; information handled by AdCast after export is subject to this Privacy Policy.

6. Security of Your Information

We take reasonable measures to protect your information from unauthorized access, use, or disclosure. However, no internet or email transmission is ever fully secure or error-free.

7. Your Rights Under GDPR

If you are located in the EU or EEA, you have the following rights:

• Right to access – You can request a copy of your data.
• Right to rectification – You can request corrections to inaccurate data.
• Right to erasure – You can request deletion of your data.
• Right to restrict processing – You can request limited use of your data.
• Right to data portability – You can request your data in a machine-readable format.
• Right to object – You can object to data processing in certain cases.

To exercise these rights, use our GDPR request form or contact us at privacy@adcast.app. You may also lodge a complaint with the competent supervisory authority in your place of residence, work, or alleged infringement. For EU/EEA residents, information on authorities is available from the European Data Protection Board.

8. Data Retention

TIMONIX DOO retains personal data only for as long as necessary for the purposes for which it was collected or processed, including providing and securing the AdCast Digital Signage services, fulfilling contractual obligations, resolving disputes, and complying with applicable legal obligations.

Retention depends on the data category: account and service data are retained while the account or Service is active; media and related content are retained while you or the applicable business customer keep them in the Service; billing and transaction records may be retained for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes; and security logs and backups are retained under our operational retention procedures. Following a valid deletion request or end of service, we delete or anonymize data when it is no longer required, subject to residual backup cycles, customer instructions where we act as processor, and legal retention obligations. We will explain any material retention limitation that applies to your request.

9. Children’s Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from anyone under 18 without verified parental consent.

If you become aware that someone under the age of 18 is using our services or has provided us with personal information, please contact us at support@adcast.app. We will promptly investigate and delete any such data as required.

10. International Transfers

Your data may be transferred to and processed outside the EEA or United Kingdom, including in the United States. Where required, we use an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK Addendum, or another valid transfer mechanism, together with supplementary measures where appropriate.

11. Your Choices

Account Information: You can update or correct your account information at any time by accessing your account settings.

Push Notifications: You can enable or disable push notifications at any time in your device's notification settings (iOS: Settings → Notifications → AdCast; Android: Settings → Apps → AdCast → Notifications). Disabling notifications will not affect your ability to use the Application.

12. Push Notifications

With your permission, we use Firebase Cloud Messaging (FCM) to send push notifications to your mobile device. These notifications may include:

• Screen online/offline status alerts
• Content sync and playback status updates
• Important account or security notices

What data is collected: When you grant notification permission, Firebase generates a unique FCM device token for your device. This token is stored on our servers and shared with Firebase (Google) solely for the purpose of delivering notifications to your device. The token does not identify you personally, but it is linked to your account.

Opting out: You can withdraw consent at any time by disabling notifications in your device settings. Your FCM token will be removed from our servers when you delete your account or uninstall the Application.

Third-party processor: Push notifications are delivered via Firebase Cloud Messaging, operated by Google LLC. Google may process the token on servers outside the EU under standard contractual clauses. See the Firebase Privacy Policy for details.

13. How We Use Cookies

We use cookies and similar technologies, including browser local storage, to make our website work, remember your privacy choices, and, only where you consent, measure website use. Cookies are small data files stored on your device when you visit a website. Similar technologies may store information locally in your browser or use online identifiers supplied by service providers.

Types of Cookies We Use

We use the following categories. Strictly necessary technologies are used to operate the site. All other categories are off by default and are enabled only after your affirmative choice in the consent notice.

• Necessary Cookies
  • These technologies are essential for the website to function properly. They enable basic features such as page navigation, secure areas, security controls, and recording your consent choice. They cannot be switched off through our consent tool.
• Performance and Analytics Cookies
  • When you opt in, we load Google Analytics 4 to help us understand how visitors interact with the website and improve performance and usability. Google may process information outside your country; see the Google Privacy Policy for its processing information.
• Functional Embedded Media
  • When you enable this category, the homepage may load its privacy-enhanced YouTube player. The player is not required to browse or use the core public website.

Managing Your Cookie Preferences

You can accept, reject, or customize non-essential categories through our cookie notice. Select Cookie preferences in the site footer, or use the cookie icon on this page, to reopen the choices at any time. You can also clear cookies and local storage through your browser settings. Withdrawing consent does not affect processing already carried out before withdrawal, but it stops future optional tracking from this site.

We do not use the consent tool to collect payment-card data or deliberately collect special-category personal data. For questions about cookies or to exercise your privacy rights, contact privacy@adcast.app or use our GDPR request form.

14. Changes to This Privacy Policy

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the effective date at the top of the policy.

15. Contact Us

If you have any questions or concerns about this Privacy Policy or your data, please contact us at privacy@adcast.app or +381 63 302 531.

TIMONIX DOO
Carkovacka 30v, 34206 Donja Sabanta, Serbia
Email: office@adcast.app
Subject: Privacy Policy Inquiry

By using AdCast App or AdCast Player, you agree to this Privacy Policy.