Last updated: 12 October 2026
Who is responsible for your data
The data controller is Jon Garcia Tarifa, trading as Stoa Creatives, NIF 77986675T, [ADDRESS], Spain. Contact: hello@stoacreatives.com.
What we collect
- From the free ads form: your name, work email, phone number (optional), brand website, Instagram handle (optional), the product you want ads for, a short description of who buys it, and your approximate monthly Meta ad spend.
- From the launch list: your email address, if you ask us to tell you when we launch.
- When you email us or book a call: what you choose to send us, such as messages, product photos and reviews.
- When you become a client: billing details, and read-only access to your Ads Manager if you choose a package with a guarantee.
We don't use analytics or advertising cookies on this website. See our cookie policy.
Why we use it, and on what legal basis
- To make your free ads and send them to you. Basis: your consent, given on the form, and steps you asked us to take before any contract (GDPR Article 6(1)(a) and (b)).
- To decide whether the free ads fit your brand, using your ad spend and website. Basis: the same.
- To tell you when we launch, if you joined the launch list. Basis: your consent. We send the launch email and our founding-client offer, and you can unsubscribe at any time.
- To follow up about the ads we made for you, including inviting you to a call. Basis: your consent. You can ask us to stop at any time.
- To deliver paid work and invoice it. Basis: our contract with you, and our legal obligations on tax and accounting (GDPR Article 6(1)(b) and (c)).
We don't sell your data and we don't use it for automated decisions with legal effects on you.
Who we share it with
Only service providers who help us run the business, under contracts that require them to protect your data:
- Form provider: Formspree
- Email: Google Workspace
- Call booking: Cal.com
- Website hosting: Netlify
- File delivery: Google Drive
- AI production tools that receive your product photos to make your ads: Higgsfield
Some of these providers are based outside the European Economic Area, for example in the United States. Where that happens, transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Launch list emails: until we have sent the launch email and up to [6] months after, or until you unsubscribe.
- Free ads requests that don't become clients: up to [12] months after our last contact, then deleted.
- Client records and invoices: for as long as Spanish tax and commercial law requires.
Your rights
You can ask to access, correct or delete your data, to restrict or object to how we use it, to receive it in a portable format, and to withdraw your consent at any time. Email hello@stoacreatives.com and we'll reply within one month.
If you think we've handled your data badly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es, or to the authority in your own country.
Changes
If we change this policy, we'll update the date at the top of this page.