Privacy policy
We collect as little as we can. No advertising cookies, no analytics, no tracking pixels, no selling of data. This page explains the little we do process and why.
Last updated 11 November 2026
1. Who we are
Architect AS ("Architect", "we", "us") is the controller for the personal data described here. This policy covers our website architect.media and our web application Architect Terminal at terminal.architect.media (the "Terminal").
- Architect AS, organisation number 937 528 876, Morenen 48, 1519 Moss, Norway
- Email: hello@architect.media
Where we process data on behalf of a customer under a separate agreement (for example channel lists a customer uploads to the Terminal), that agreement and any data processing agreement take precedence for that data.
2. What we collect and why
| When | What | Why (legal basis) |
|---|---|---|
| You visit the website | Technical request data our hosting provider processes to deliver pages and protect against abuse: IP address, browser user agent, requested URL, time. | Delivering and securing the site (legitimate interest, GDPR art. 6(1)(f)). |
| You send the pilot request form | Name, company, work email, role, annual media budget range and your message. | Replying to your request and scoping a pilot (steps before a contract, art. 6(1)(b), and legitimate interest, art. 6(1)(f)). |
| You email us | Your email address and whatever you include in the message. | Answering you (legitimate interest, art. 6(1)(f)). |
| You have a Terminal account | Name, email address, password (stored only as a one-way hash), the organisation you belong to, your permissions, and the work you do in the Terminal (lists, imports, settings and a history of changes). | Providing the service you or your organisation signed up for (contract, art. 6(1)(b)). |
| You sign in with Google | From Google: your name, email address, Google account ID and profile picture URL. We do not receive your Google password. | Letting you sign in (contract, art. 6(1)(b)). |
| You connect Google Ads or Display & Video 360 | An OAuth refresh token (stored encrypted), the permissions you granted, and the account, customer and advertiser IDs and names needed to deliver lists. See section 4. | Delivering channel lists to the ad accounts you choose (contract, art. 6(1)(b)). |
| Something breaks in the Terminal | Error and performance reports: the error, the page or request involved, browser and device type, and your user ID. | Finding and fixing bugs, keeping the service reliable (legitimate interest, art. 6(1)(f)). |
| We email you from the Terminal | Your email address and the message (for example email verification and password reset). | Running your account (contract, art. 6(1)(b)). |
We do not use your data for advertising, we do not build profiles of you, we do not sell or rent it, and we make no automated decisions about you that have legal or similarly significant effects.
The channel data in the Terminal is about YouTube channels and their public content, not about Terminal users.
3. Cookies
The website sets no cookies and uses no analytics, advertising or tracking tools. It does not load fonts, scripts or other content from third parties.
The Terminal sets only cookies that are strictly necessary for it to work, so no consent banner is needed:
| Cookie | Purpose | Lifetime |
|---|---|---|
adonis-session | Keeps you signed in. | 2 hours of inactivity |
XSRF-TOKEN | Protects forms against cross-site request forgery. | Session |
4. Google user data
If you sign in with Google or connect a Google Ads or Display & Video 360 account, we access Google user data only as described here.
- Sign in with Google uses the basic
openid,emailandprofilescopes. We use them only to create and identify your Terminal account. - Google Ads (
https://www.googleapis.com/auth/adwords) and Display & Video 360 (https://www.googleapis.com/auth/display-video) access is requested only when you choose to connect an account. We use it only to list the accounts and advertisers you can deliver to, and to create, update and remove the channel exclusion and inclusion lists you ask the Terminal to deliver. We do not read campaign performance, billing or other data beyond what that requires. - We store the refresh token encrypted, and we never share Google user data with anyone except the service providers in section 5 that host and run the Terminal.
- We do not use Google user data for advertising, we do not sell it, we do not use it to train AI or machine learning models, and our staff do not read it except with your consent, for security reasons, or where the law requires it.
- You can disconnect at any time in the Terminal under Integrations, or revoke access at myaccount.google.com/permissions. We then delete the stored token.
Architect's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Who we share data with
We use a small number of service providers that process data for us under data processing agreements. They may only use it to provide their service to us.
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting and delivering the website, receiving the pilot form. | Global network, USA |
| DigitalOcean, LLC | Servers and database for the Terminal. | EU (Frankfurt, Germany) |
| Functional Software, Inc. (Sentry) | Error and performance monitoring for the Terminal. | EU (Germany) |
| Mailgun Technologies, Inc. | Sending Terminal emails. | USA |
| Google LLC | Sign in with Google, and delivering lists to Google Ads and Display & Video 360 at your request. | USA |
Where data is transferred outside the EU/EEA, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
We may also disclose data where the law requires it, or to a buyer or successor if Architect is reorganised, merged or sold, in which case this policy continues to apply.
6. How long we keep it
- Pilot requests and emails: up to 24 months after our last contact, unless they lead to a customer relationship.
- Terminal account data: while the account is active, and deleted or anonymised within 90 days after it is closed, unless we must keep it longer by law (for example accounting records).
- Google tokens: until you disconnect, revoke access or your account is closed.
- Error reports: up to 90 days.
- Hosting request logs: as set by our hosting providers, normally a few days to weeks.
7. Your rights
Under the GDPR you can ask for access to your data, a copy in a portable format, correction, deletion, or restriction of processing, and you can object to processing based on our legitimate interests. Email hello@architect.media and we will answer within one month.
If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or the data protection authority where you live. We would appreciate the chance to fix it first.
8. Security
Data is encrypted in transit, Google tokens are encrypted at rest, passwords are hashed, and access to production systems is limited to the people who need it.
9. Children
Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect data from children.
10. Changes
We will update this page when what we do changes and change the date at the top. If a change materially affects Terminal users, we will tell them by email or in the Terminal before it takes effect.