What we collect, and what we do with it.

Plain language, no surprises. We collect the minimum needed to run a creative testing service, we never sell it, and you can ask us to delete it at any time.

Effective 24 September 2026.

Who we are

ConceptHooks runs the website concepthooks.com and the creative testing service described on it. For UK and EU data protection law, we are the controller of the personal data described here.

Email: hello@concepthooks.com

What we collect

We collect personal data in four situations.

When you request an audit. Your name, work email, website, monthly ad spend band, country, and, if you give it, a link to one of your ads. That is everything the form asks for.
When you book a call. Your first and last name, email, your brand's website, and, if you give it, which of your ads is working best right now. If you invite a colleague, we also receive their email. Booking runs on Cal.com. Its calendar loads only when you choose to open it, and it may set the cookies it needs to take the booking.
When we contact a brand first. For business-to-business outreach we collect business contact details of people who work at home and lifestyle brands: name, job title, company, work email, and public information about the company's advertising. We take these from public sources only: the company's own website, its public social profiles, professional networking sites, and Meta's public Ad Library. We do not buy lists.
When you visit the site. Our hosting provider keeps standard server logs, which include your IP address, browser type, and the pages requested. These are used to keep the site running and secure, and for nothing else. This site sets no cookies and runs no advertising or analytics trackers.

If you become a client, we also hold what is needed to do the work: your product photography, access you grant to your ad account, the creative we make for you, and invoices.

Why we use it, and the legal basis

To answer your audit request, hold the call you booked, and deliver the audit. Legal basis: taking steps at your request before entering a contract, and then performing that contract.
To contact brands we believe fit our service. Legal basis: our legitimate interest in offering a relevant business service to businesses. We only write to people in a business role, about their business, and every message tells you where we found your details and how to opt out. You can object at any time and we will stop.
To keep the site secure and to keep records we are required to keep, such as invoices. Legal basis: legitimate interests and legal obligation.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

Who sees it

We do not sell personal data, and we do not share it for advertising. The only third parties that handle it are the services we use to run the business, acting on our instructions:

Resend, which delivers the email sent when you submit the audit form.
Cal.com, which runs our booking calendar, and Google, whose Calendar and Meet hold the call.
Our website hosting provider, which serves the site and keeps the server logs described above.
Our email and invoicing providers, used to reply to you and to bill clients.

We may also disclose data where the law requires it.

Where it is stored

Some of the providers above process data in the United States. Where personal data of UK or EU residents leaves the UK or EU, we rely on providers certified under the EU-US Data Privacy Framework and its UK Extension, or on standard contractual clauses together with the UK Addendum, so that your data has the same protection wherever it is processed.

How long we keep it

Audit requests and booked calls: up to 24 months after our last contact with you, then deleted, unless you become a client.
Outreach contacts who do not reply: deleted within 12 months of our first message. If you ask us to stop, we keep only your email address on a suppression list so that we do not contact you again.
Client records: for the length of the engagement and then for as long as tax and accounting law requires, which is six years in the UK.
Server logs: as set by our hosting provider, normally no longer than 30 days.

Your rights

If you are in the UK or the EU, you have the right to:

ask for a copy of the personal data we hold about you
have inaccurate data corrected
have your data deleted
restrict how we use it
receive it in a portable format
object to our use of it, including an absolute right to object to direct marketing at any time
withdraw consent where we rely on it, without affecting anything done before

To use any of these rights, email hello@concepthooks.com. We reply within one month and do not charge for it. If you are not satisfied with our response, you can complain to the Information Commissioner's Office in the UK at ico.org.uk, or to the data protection authority in your country.

If you are in the United States, every email we send includes a working unsubscribe link and our postal address, and we honour opt-outs promptly. Residents of states with privacy laws, including California, can ask for access to or deletion of their personal information in the same way, and we do not sell or share personal information for targeted advertising.

Children

This site and our service are for businesses and are not directed at anyone under 18. We do not knowingly collect data about children.

Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top. Material changes to how we use data we already hold will be sent to the people affected.