Privacy Policy

We collect the minimum personal data we need to operate AdArena, run Challenges, pay Creators, bill Brands, and improve the Platform. We never sell personal data.

Playbox.io LTD (פלייבוקס.יו בע"מ)
Israeli company ID: 516825114
Tel Aviv, Israel
Privacy contact: contact@adarena.app

Account & profile

• Name, email, password hash, role (Brand, Creator, Agency, Guild Master), avatar, country, language.
• Public profile info (handle, bio, portfolio links) you choose to display.

Identity & tax (Creators)

• Government ID document (where required), tax status, foreign tax ID, Israeli ID number, company registration number.
• Bank or Payoneer details (encrypted at rest). International payouts use Payoneer exclusively at this stage; we share the Creator's name, email, and prize amount with Payoneer to enable payment.
• Self-billing invoice consent records (Israeli "Individual" Creators) and signed-release records the Creator provides under Terms §7.2 (third-party likeness).

Billing (Brands)

• Company name, billing address, VAT/tax ID, payment method metadata (full card numbers are handled by our PCI-DSS payment processor and never stored on our servers).

Content

• Submissions, briefs, brand assets, comments, ratings, and AI-generated outputs you create on the Platform.

Usage & device

• IP address, user agent, device/browser, pages visited, referrers, error logs, performance metrics.

• Provide and maintain the Platform, run Challenges, and deliver payouts.
• Verify identity, comply with tax/AML obligations, and prevent fraud.
• Send transactional emails (account, payments, winners, security).
• Send marketing emails where you've opted in (you can unsubscribe at any time).
• Improve features, train internal AI scoring models on Submission metadata, debug, and analyze trends.
• Enforce our Terms and respond to legal requests.

• Contract — to provide the Services you've signed up for.
• Legal obligation — tax, accounting, AML, sanctions screening.
• Legitimate interests — fraud prevention, product improvement, security.
• Consent — marketing emails, optional cookies.

We share personal data only with vetted sub-processors who help us run the Platform:

We may also share data when required by law, to enforce our Terms, or in connection with a corporate transaction (with notice).

Personal data may be transferred outside your country, including to Israel (where Playbox.io LTD is established and recognized as adequate by the EU Commission), the United States, and other regions where our sub-processors operate. For EU/UK data subjects, cross-border transfers are governed by the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum where required, together with supplementary technical and organizational measures (encryption in transit and at rest, access controls, audit logging).

By using the Platform you consent to these transfers as described in Terms §20.

• Account data: while your account is active, then up to 7 years to comply with tax/legal obligations.
• Submissions: retained for the life of the Platform's public showroom unless you request deletion (winning Submissions transferred to Brands cannot be recalled — see Terms §11).
• Payment records: 7 years (Israeli tax law).
• Marketing preferences: until you unsubscribe.
• Server logs: up to 90 days.

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data.
• Object to or restrict certain processing.
• Receive a portable copy of your data.
• Withdraw consent at any time (without affecting prior processing).
• Lodge a complaint with your local data protection authority.

To exercise these rights, email contact@adarena.app. We respond within 30 days. We do not sell personal data; we honor "Do Not Sell or Share My Personal Information" requests by default.

We use TLS in transit, encryption at rest for sensitive fields (tax IDs, bank details, Payoneer credentials), Row-Level Security on all database tables, audit logging, IP rate-limiting on auth endpoints, and least-privilege access for staff. No system is 100% secure — please use a strong unique password and enable 2FA where offered.

AdArena is not directed to anyone under 18. If we learn we've collected data from someone under 18, we will delete it.

We use the following cookie categories:

• Strictly necessary — auth session, CSRF, language preference. Cannot be disabled.
• Functional — UI preferences, dismissed banners, recent activity.
• Analytics — aggregated, anonymized usage to improve the Platform.
• Marketing — only set with your explicit consent (e.g. ad pixels for re-engagement campaigns).

You can clear cookies in your browser at any time. Some functionality (e.g. staying signed in) requires strictly necessary cookies.

We may update this Policy from time to time. Material changes will be announced via the Platform or email. The "Last Updated" date at the top reflects the most recent revision.

This DPA applies where Playbox.io LTD ("Processor") processes personal data on behalf of a Brand, Agency, or Guild Master ("Controller") in connection with the Services. By using the Services, Controller accepts this DPA.

14.1 Processing details

• Subject matter: provision of the AdArena platform and related services.
• Duration: for the term of the Controller's account, plus retention periods in §8.
• Nature & purpose: hosting, displaying, and analyzing Submissions; communicating with Creators; running and judging Challenges.
• Categories of data subjects: Creators, Brand staff, Agency staff, Platform visitors.
• Categories of data: identifiers, contact info, content, usage data, payment metadata.

14.2 Processor obligations

• Process personal data only on documented Controller instructions (use of the Platform constitutes such instruction).
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organizational measures (see §10).
• Use sub-processors per §6, with equivalent obligations passed down.
• Assist Controller with data subject requests, breach notifications (within 72 hours of awareness), and DPIAs as reasonably required.
• Delete or return personal data after termination, except where retention is required by law.

14.3 International transfers

Where data leaves the EEA/UK, the EU Standard Contractual Clauses (Module 2 or 3, as applicable) are incorporated by reference. For UK transfers, the UK Addendum applies.

14.4 Audits

Controller may request, no more than once per year, a written audit summary describing Processor's controls. On-site audits may be performed only by mutual agreement and at Controller's expense, subject to confidentiality.

Questions or requests? Email contact@adarena.app.