Privacy Policy
Last updated: 5 October 2026
Who we are
Ad Restore Ltd, trading as AdRestore, is responsible for the personal data described here (the "controller"). We are registered in Scotland, company number SC825525, with our registered office at 18 Bellevue Street, Dumfries DG1 3EJ. You can contact us about anything in this policy at support@adrestore.uk or on 07777 148453.
What we collect
- Enquiry and consultation forms: your name, email address, role, Google Ads customer ID (optional), phone number (optional), the issue you're facing, your account status, your website, how urgent it is, how you'd like us to contact you and anything else you tell us. We also record the page you were on and, if you arrived from an advert, the advert click identifiers (gclid, gbraid, wbraid) and campaign tags (utm).
- Callback requests: your name, phone number, the best time to call, your role, the service, your message, the page you were on, and a record that you agreed to be contacted.
- Consultation bookings: the time you choose; your name, email address and phone number; your time zone, so our emails show your local time; your answers (what the call is about, Google's notice if you paste it, anything you want to cover and, if you give them, your business name, website and Google Ads customer ID); and, if you arrived from an advert, the advert click identifiers (gclid, gbraid, wbraid, and the click identifier in Google's _gcl_aw cookie where your cookie choices allow it), the campaign tags and the page you landed on. If you are signed in, the booking is linked to your account. Calls take place by phone or on Google Meet, as you choose. We email you a confirmation and a calendar invitation (from Google Calendar, or as an .ics file), a reminder the day before, and a notice if the call moves or is cancelled, and we record what happens to the booking.
- From a contact form to a booking: if you send one of our contact forms and then book a call, we use what you sent in the form to fill in the booking form for you, including the advert identifiers kept with your enquiry. Only your enquiry number passes between the two pages, never your details in a web address. Nothing is booked until you choose a time and press Book.
- Purchases: your company name, Google Ads or Merchant Center ID, website, role, the time you accepted our terms, and campaign tags. Payment is taken by Stripe on its own secure page, where Stripe collects your name, email address, phone number, billing details and card details. We never see or store your card number.
- Starting a service online: when you press Start on a service, we use your name, email address and, if you give them, your company name, Google Ads or Merchant Center ID and website to prepare our standard agreement and email you its link. The agreement is issued by our website on Ad Restore Ltd's behalf, with our director's typed signature, at the published price, and its link stays open for 7 days. If you arrived from an advert, the advert click identifiers, campaign tags and the page you landed on are kept with the agreement. We also record the IP address and browser that asked for the agreement, as part of its record.
- Agreements you sign online: the name and role you type, the signature you adopt (a typed name in a chosen style, or the shape of a signature you draw on screen, kept as line geometry only, without timing or pressure), your email address and company details, the exact wording you signed, the date and time, your IP address and browser details when you open, sign and pay for the agreement, any message we sent with it, and the Stripe payment that completes it. Payment for an agreement is taken by Stripe in a payment form embedded on the agreement page at contracts.adrestore.uk; Stripe collects your name, email address, billing details and card details there and sets its own cookies (listed below). We never see or store your card number.
- Checking a copy of an agreement: the check page at contracts.adrestore.uk/check fingerprints your file in your browser and sends only the fingerprint; we do not keep it.
- My account: your email address, your name, your website if you give us one, which Google policy your notice names if you tell us, when you last signed in and how you signed in. If you sign in with Google we also store the identifier Google uses for your account, so that signing in with Google and signing in by email link reach the same account rather than two. Sign-in links and codes work once and expire after 15 minutes (the invitation link we email when we open your account for you works once and expires after 7 days), and we only store them in scrambled (hashed) form. Anything you type on the sign-up form is held on that one-time link, not on an account, until you open the link: if you never do, it is deleted with the link and no account is created. If you answer "What do you need help with?", we keep the answer with your account. When you pay for an agreement, your account also keeps the Stripe customer reference and the advert click identifiers of your first paid agreement.
- Your case: when you pay for a service, or we invite you, we open your account for you and record your company name and phone number if we have them, who opened it and when, and whether you have opened our invitation. Your account then holds your case: its steps, our notes to you, the list of what we need from you, and when you mark something as done.
- Documents you upload to your account: the files themselves, their names and sizes, when they were uploaded and from which account, and anything you type in answer to our checklist. Please do not upload passwords or full card numbers; if a file contains them we delete it and ask again.
- Website chat: most of our guide pages have a chat button in the corner. On suspension guides a short message matched to the page may also appear, at most once per visit. The chat's answers come from an AI assistant, and one of our account managers reads every chat. When you use it, we keep the messages you write and the replies you receive, the page you were on and its title, and the site that brought you there (for example Google, Bing or ChatGPT). If you arrived from one of our adverts, we also keep the advert click identifiers, campaign tags and the page you first landed on. We keep the date and time, your device type (phone or computer), your browser family and your country, and whether you rated the chat helpful, with anything you type to say what was missing. If you type an email address, phone number or card number into a message, we remove it before the message is saved or sent to the AI service. Before you open the chat, your browser asks our server which chat settings apply to the page; we keep no record of that request.
- Leaving your details in the chat: if you use the free suspension check in the chat, the wording of your notice and your email address are handled exactly as on our free suspension check page: stored with our notice checks and emailed to us, so that a person can reply. The chat itself only records that a check was sent. If you ask to talk to an account manager, we email support@adrestore.uk with the page you were on and a link to the conversation. If you then leave the wording of your notice, your email address and, if you like, your first name, we keep them with the conversation and email them to support@adrestore.uk. None of this is sent to the AI service: it only sees that a form was sent.
- Cookie choices: an anonymous ID, the choices you made and the policy version, so we can show we asked.
- Security: a salted, one-way code made from your IP address, used to stop repeated or automated submissions. It can't be turned back into your IP address.
- Visit counting: Clicky records the pages you view, the website or advert that brought you here, and your browser, device and rough location. It uses an anonymised IP address and no cookies. You can opt out; see Cookies below.
- Analytics and advertising measurement: Google Analytics and Google Ads measurement, only if you agree in the cookie banner.
How and why we use it
- To reply to your enquiry and call you back and, if you go on to book a call, to fill in the booking form for you from your enquiry. Our lawful basis is legitimate interests (answering a request you made) and, once you buy, the contract between us.
- To arrange and hold a call you book, and to send you the confirmation, a reminder the day before, and notices if the call moves or is cancelled. The advert identifiers kept with a booking let us see which adverts lead to bookings. Our lawful basis is steps you ask us to take before a contract, and our legitimate interests. The identifier from Google's cookie is used only where your cookie choices allow it.
- To answer your questions in the website chat. Our lawful basis is legitimate interests, and steps you ask us to take before a contract.
- To reply when you leave your details in the chat. Our lawful basis is your consent, which you can withdraw at any time by emailing support@adrestore.uk.
- To deliver a service you've paid for, take payment and give refunds. Our lawful basis is the contract between us.
- To prepare and send an agreement when you press Start on a service. Our lawful basis is steps you ask us to take before entering a contract.
- To form and prove the contract between us when you sign an agreement at contracts.adrestore.uk. Our lawful basis is the contract itself, and our legitimate interest in being able to show what was agreed.
- To keep accounting and tax records. Our lawful basis is legal obligation.
- To protect the site, including the chat, against spam and abuse, and to keep the chat's running costs in check. Our lawful basis is legitimate interests.
- To count visits and see which pages and campaigns work (Clicky). Our lawful basis is legitimate interests, and you can object at any time with the opt-out link under Cookies.
- To measure which adverts lead to enquiries (Google Analytics and Google Ads). Our lawful basis is your consent, which you can withdraw at any time.
We don't sell your data, and we don't make automated decisions about you.
Who we share it with
We use trusted providers who handle data for us under contract:
- Cloudflare: hosts this website, stores form, callback and order records, and sends our website emails. Its Turnstile service also checks that our forms are sent by a person and not by an automated program: when you start using one of our forms, or scroll to one, your browser loads a small check from Cloudflare (challenges.cloudflare.com), which looks at technical signals from your browser and device, including your IP address, and gives the form a one-time pass that our server confirms with Cloudflare when you send it. Turnstile does not see what you type into the form. Most people never see the check; now and then it asks you to tick a box.
- Google: runs our email (Google Workspace), shows fonts, review photos and the map on our pages, and, only if you consent, Google Analytics and Google Ads measurement. If you choose "Sign in with Google", Google checks who you are and tells us your email address, whether Google has confirmed that address, and the identifier it uses for your account. We ask Google for nothing else, and we never ask Google for access to your advertising accounts. When you book a call with us, Google Calendar and Google Meet hold it: the call goes into our Google Calendar with your name and email address (and, for a phone call, your phone number), Google Meet creates the video call's link, and Google emails you the calendar invitation. To stop calls clashing, our booking page also checks the times we are busy in our own Google Calendar.
- Stripe: takes payments.
- Cloudflare R2: stores uploaded documents, in the European Union, encrypted at rest.
- Anthropic: writes the website chat's answers, and a short summary of each chat for us, acting as our processor. It receives the conversation, with email addresses, phone numbers and card numbers removed, and the page you are on. It does not receive your IP address, your country or device, or anything you send through the chat's forms. Anthropic does not train its models on these messages, and deletes them within 30 days unless it must keep them longer to enforce its usage policy or to meet the law.
- Clicky: counts visits to the site, without cookies and with an anonymised IP address.
- Public code libraries (cdnjs, unpkg and jsDelivr): deliver some of the code our pages use for animation and display. Like any website, they receive your IP address when your browser fetches files from them.
When we work on your appeal, we deal with Google on your behalf using the details you give us. We will also share data where the law requires it.
Transfers outside the UK
Some of these providers process data in the United States. Where they do, the transfer is protected by the UK–US Data Bridge or the UK International Data Transfer Agreement or Addendum. Anthropic may process chat messages in the United States or in another country where it runs its service; that transfer is protected by the UK Addendum to the EU standard contractual clauses in Anthropic's data processing terms.
How long we keep it
- Enquiries and callback requests: up to 24 months, then deleted.
- Consultation bookings: 24 months after the call, then deleted. If you become a client, a booking is kept with your case for as long as the case is kept.
- The links in booking emails that let you move or cancel a call: they stop working when the call starts, or once used, and are deleted within a day.
- Orders and payment records: 6 years, as required for accounting and tax.
- Agreements and their signing records: 6 years after the agreement is paid, the same as orders.
- An agreement that was sent but never signed and paid: 12 months after its link expires.
- Agreements started online, with the IP address, browser and advert identifiers kept with them: the same as other agreements.
- Your My account record: deleted 24 months after you last sign in, unless you have orders or a case we must keep. Your answer to "What do you need help with?", your Stripe customer reference and the advert identifiers kept with your account go with it.
- Documents you upload: deleted 90 days after your case closes, or as soon as you delete them in your account. Our record that a document was sent (its name, size and date, not the file) is kept with the agreement for 6 years.
- Your case record (steps, notes and the checklist): 6 years with the agreement, or 12 months if no agreement or order was paid. A case with no activity for 12 months is closed, which starts the 90 days for its documents.
- Invitations we send (to whom, when, and whether they were opened): deleted 30 days after the link expires.
- Sign-in links and codes, and anything typed on the sign-up form that is waiting on one: deleted within a day of the link expiring.
- Website chats: deleted automatically 12 months after the last message. That includes chats where you left your details.
- Free suspension checks sent from the chat: 24 months, the same as checks sent from our free suspension check page.
- Cookie choices: kept in your browser for 6 months; our record that you made a choice is kept for up to 24 months.
Strictly necessary cookies (always on):
- ar_consent remembers your cookie choices (6 months).
- __Host-ar_session keeps you signed in to My account (up to 30 days; signing out removes it).
- __Host-ar_login is used only while you finish signing in (15 minutes).
- __Host-ar_oauth is used only while you finish signing in with Google (10 minutes).
- __Host-ar_need is set when you create an account from a service page, so your first question opens with that service chosen (1 day).
- __Host-ar_order shows your order confirmation after you pay (1 hour).
- __Host-ar_bk_from carries your enquiry number from a contact form to the booking page, so the booking form can be filled in for you (2 hours; it is removed once you book).
- __Host-ar_booking shows your booking confirmation after you book (1 hour).
- __Host-ar_agree is set on contracts.adrestore.uk while you view and sign an agreement (up to 30 days).
- __Host-ar_agree_cs shows your confirmation on contracts.adrestore.uk after you pay for an agreement (1 hour).
- __stripe_mid and __stripe_sid are set by Stripe on contracts.adrestore.uk while the payment form is shown, for fraud prevention (1 year and 30 minutes). They are needed to take the payment.
- __cf_bm is set by Cloudflare to protect the site from automated traffic (30 minutes).
Website chat (browser storage, not cookies). None of these identifies you, and none is sent to any other company:
- ar_chat_visit (local storage) records when your current visit started and whether the chat's opening message has been shown, so it appears at most once per visit. A visit ends after 30 minutes without activity. If your browser blocks storage, the message is never shown.
- ar_chat_nudge_seen (local storage, signed-in clients only) records the last case update you have seen, so the short case-status note is shown only when something has changed.
- ar_chat_ref (session storage) remembers which site brought you to us, for the chat's records.
- ar_chat_preview (session storage) is used only when we preview the chat.
Session storage is deleted when you close the tab.
Visit counting (always on, no cookies): Clicky, with an anonymised IP address. While you browse, it keeps a random visit ID and the campaign tags you arrived with in your browser's session storage, which is cleared when you close the tab. To opt out, open adrestore.uk/?ar_analytics=optout in each browser you use. That sets an ar_analytics_optout cookie for 12 months (and Clicky's own _no_tracky_101511315 cookie until you close the browser) so we remember. To opt back in, open adrestore.uk/?ar_analytics=optin.
Analytics and advertising (only with your consent): Google Analytics (_ga cookies) and Google Ads measurement (_gcl cookies). You can change your choice at any time using "Cookie settings" at the bottom of every page.
Your rights
Under UK data protection law you can:
- ask for a copy of your data;
- ask us to correct it or delete it;
- object to, or ask us to restrict, how we use it;
- ask for it in a portable format;
- withdraw your consent at any time.
Email support@adrestore.uk and we'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
The site is served over an encrypted connection (HTTPS). My account has no password: you sign in with a single-use email link, or with your Google account if you prefer. We only accept a Google sign-in when Google confirms the email address on it, and an account can be linked to one Google account at a time. Signing out signs you out everywhere. Card details are handled only by Stripe, and only the people who need to see your data can. Documents you upload are stored encrypted, can only be opened through your signed-in account and by us, and are never sent by email. For agreements you sign online we keep your actual IP address, and the IP address from which the payment was started, as part of the signing record, because they are part of the evidence that you signed. We also obtain an independent timestamp of the signing record from a timestamping authority; it contains a fingerprint of the record and the time, and no personal data. No system is completely secure, but we work to protect your data from unauthorised access, loss or misuse.
Changes to this policy
We will post any changes on this page and update the date at the top.