Privacy Notice

01

Who is responsible for your data

Controller: Felföldi Roland, Hungary. Email: hello@impossiblesolutions.ai. That is who decides why and how personal data submitted through this site is handled, and who answers for it.

The site is operated under the trading name Impossible Solutions. No business has been registered for it yet, so the controller is a named individual rather than a company. It is an informational site: it stores no application data, sets no cookies and, only if you allow it, uses Vercel Web Analytics for aggregate traffic measurement, as described below.

When a business is registered to operate the site, its registered name, registration number and address will be stated here.

02

What we collect

Application data. The Ads Fit Assessment application asks for your name, business email, company, website, the country of the advertising legal entity, target markets, industry, an approximate monthly advertising spend band, a primary objective, your current measurement readiness, an optional message, the site language you used, and a record that you confirmed you had read this notice and asked us to contact you.

The form also sends technical context used to process the request, including the site language and, where present, campaign parameters, the landing page and the referring host. On the current email-only flow these values are validated transiently by the server and are not included in the prepared application email or stored as an application record.

The form also requires you to confirm that you have read this notice and asked us to contact you. On the current email-only flow that confirmation is checked before the handoff but is not stored as a separate application record.

Readiness Call booking. If you choose to book a Readiness Call, the booking button opens a Google Calendar appointment page. The information you enter there, such as your name and email address, is processed through Google Workspace and used to arrange the call. This booking flow is separate from the Ads Fit Assessment application form.

Technical data. Like any website, ours is served through infrastructure that records standard request information such as IP address, browser type, the page requested and the time of the request, for security and operation. We do not use advertising pixels, session replay or any analytics service other than the Vercel Web Analytics described below.

Website analytics. Vercel Web Analytics is optional: it stays off until you allow it through the analytics choice on the site, and nothing is measured before then. Once you allow it, the public pages use it to understand, in aggregate, how visitors use the site and how many take selected steps towards an application or a Readiness Call. It records page views — the time, the page address without any query string or fragment, the address of the referring page where the browser provides one, an approximate location that Vercel may record down to country, region and city, and the device type, operating system and browser with their versions — and a small set of custom events: clicks on the main calls to action and on links to the explainer page, starting, submitting and progressing through the application form, and opening the Readiness Call booking page or its Google Calendar booking link. Each custom event carries only the site language and a fixed label for where on the site, or at which step, it happened. Custom events do not intentionally contain form-field values, names, email addresses, company names or free-text application content. This measurement does not set a cookie; Vercel states that it counts visitors using a hash of the incoming request that is discarded after 24 hours. No session replay is used, and this measurement adds no advertising pixel. Vercel, which already hosts the site, provides this analytics service and processes the data involved on our behalf.

Analytics preference. The site stores only your analytics choice ("granted" or "denied") in first-party browser storage so that it can remember your decision. This preference is not an analytics identifier and is not sent to Vercel as analytics data.

Cookies on the public pages. The public pages set no cookies. There are no analytics, advertising or tracking cookies on the public pages.

Client Portal cookies. If you are a client and sign in to the portal, it sets strictly necessary session cookies that keep you signed in. They are not used for analytics or advertising, and they are not set on the public pages.

03

What you have to give us, and what is optional

Required: your first and last name, a business email address, your company, your website, the country of the advertising legal entity, your industry, an approximate monthly advertising spend band, your primary goal, and your current measurement readiness. These are what let us judge eligibility and fit and give you a useful answer rather than a request for more information.

Optional: the markets you would advertise in first, and a message. You can submit the form without either. Campaign parameters come from the link you arrived through, not from you.

You are under no legal obligation to provide any of it. If the required answers are missing we may be unable to assess the application or reply to it usefully — that is the only consequence.

04

Why we use it, and on what legal basis

Application data is used to review whether ChatGPT Ads could be a sensible channel for your business, to respond to your application and, where appropriate, to arrange a Readiness Call and discuss an Ads Fit Assessment, a Pilot or a possible engagement.

Where you apply in your own name as the prospective contracting party, the legal basis is Article 6(1)(b) of the GDPR: processing necessary to take steps at your request before entering into a contract. Where you write on behalf of a company, the prospective contract is with the company, so the legal basis is Article 6(1)(f): our legitimate interest in answering a business enquiry addressed to us, which you can object to under Article 21. Neither is based on consent, so there is no consent here to withdraw — you can ask us to stop and to erase what we hold, and the rights section below says how.

Technical data is used to keep the site secure and available: serving pages, rejecting malformed submissions, and limiting how often the application form can be sent from one connection.

The legal basis is Article 6(1)(f): our legitimate interest in keeping this website secure, available and free of automated abuse. It covers that and nothing else.

Website analytics data is used to understand, in aggregate, how the public pages are used and how many visitors take steps towards an application or a Readiness Call, so that we can evaluate and improve the site's acquisition journey.

Website analytics runs only if you choose to allow it. The legal basis is Article 6(1)(a) of the GDPR: your consent. You can withdraw that consent at any time through Analytics settings in the footer. Withdrawing consent stops future analytics measurement and does not affect processing that took place before withdrawal.

Your details are not used for advertising targeting, are not sold, and are not added to a mailing list. There is no newsletter and no marketing programme to be added to.

05

What happens to an application

Submitting the form stores nothing on this site. Your details are checked, then prepared as an email addressed to hello@impossiblesolutions.ai, which you send from your own mailbox. We receive it in Google Workspace and reply from the same address.

If we later record applications automatically in a customer relationship management system, we will update this policy first, naming the provider and where the data is held.

06

Client Portal

Clients are invited to a private portal. For each person invited we hold their email address, the account they belong to, whether their access is active, and records of invitations, sign-ins and access changes, so that access can be granted, withdrawn and accounted for.

The portal shows a client only what we have deliberately published to that client's own workspace: pilot updates, figures, findings and decisions about their engagement. One client can never see another client's workspace.

The portal's accounts, authentication and published updates are held by Supabase in its eu-west-1 region. Sign-in and invitation emails are sent through the email delivery service configured for that authentication.

The legal basis is Article 6(1)(b) where the client is the person who contracted with us, and Article 6(1)(f) where they act for a company that did — our legitimate interest in delivering the engagement to the people the client nominated. Access records rest on Article 6(1)(f): keeping the portal secure and accountable.

07

When we run a pilot for an advertiser

When an advertiser engages us, we work inside the advertiser's own accounts with the access they grant. For the personal data of the advertiser's customers that we touch in doing so, the advertiser decides what is processed and why; we act on their instructions under a written agreement.

That work can include the OpenAI Pixel and Conversions API on the advertiser's site, Google Analytics 4, and the advertiser's CRM or order system, where the advertiser uses them. Conversion events are deduplicated between the browser and the server using a shared event identifier, and they follow the consent the advertiser's own consent tools collect.

Where automatic advanced matching is enabled, the OpenAI Pixel detects supported customer information and hashes it in the browser with SHA-256 before including it with conversion events. Where eligible matching data is sent through a server-side integration, we follow OpenAI's current formatting and hashing requirements. In both cases we send it only where the advertiser's consent settings and applicable law allow it; hashing is never a consent bypass.

For Revenue Truth we compare what the platform reports with the advertiser's own records. We work with totals and aggregates wherever they answer the question, and keep what we receive only as long as the engagement and its agreed retention require.

Demonstrations on this site and inside our tools use synthetic, clearly labelled data. They are never presented as a real client's results.

08

Who else sees it

The site is hosted by Vercel, a cloud hosting provider that processes technical data on our behalf to serve pages.

Email is handled by Google Workspace, which processes the messages you send us on our behalf.

Google Workspace also supports the Readiness Call booking flow described above.

OpenAI does not receive anything you send through this site. We work with its advertising products; that is a commercial relationship, not a data one, and nothing from this form reaches it.

Supabase (database and authentication, eu-west-1 region) hosts the Client Portal and, where it is switched on, the acquisition measurement described above, as our processor.

No customer relationship management system receives applications today. HubSpot is set up in our own planning but is switched off for this site, and writes nothing.

We do not share application data with any other party except as described here, or where the law requires.

09

International transfers

Our hosting and email providers are international services, so technical data and the messages you send us may be processed outside the European Economic Area. Neither provider commits to handling any particular request in any particular country, and we do not claim otherwise.

Hosting. Vercel processes what it handles on our behalf under its Data Processing Addendum, which applies to its Pro and Enterprise customers and under which Vercel acts as our processor. That addendum incorporates the European Commission's 2021 standard contractual clauses for transfers out of the EEA, and the UK International Data Transfer Addendum for transfers out of the United Kingdom.

Email. Google processes the correspondence in Google Workspace under Google's Cloud Data Processing Addendum. That addendum is part of the Workspace agreement itself — it applies through the terms we are already on, not through a separate acceptance — and it is where Google's data-transfer commitments are set out.

Both addenda are published by the providers. Write to us and we will point you to the text that currently applies.

10

How long we keep it

Applications and enquiries that do not become a client relationship are kept for up to 12 months from the last substantive exchange, and are then deleted in the ordinary course. An enquiry nobody took forward is not an asset worth holding.

If you ask us to erase it sooner, we do, unless a legal obligation or another lawful basis we can point to requires us to keep it — and if that ever applies we will tell you which.

If an enquiry does become a client relationship, the data moves into the contract and accounting records, which have their own periods and statutory minimums. Those are set when paid business begins; the rule above does not govern them.

Technical request and security data is kept only for the period the hosting platform applies automatically for security and operation. We do not export it into a store of our own.

Client Portal accounts and their access records are kept for the duration of the engagement and then under the same periods as other client records.

Website analytics data is kept by Vercel for the period its Web Analytics service applies under the Vercel plan this site runs on. We do not copy these analytics events into an analytics database of our own.

11

Your rights

Under the GDPR you can ask for access to the personal data we hold about you, have it corrected or erased, restrict its processing and, where applicable, receive it in a portable format. These rights are subject to the conditions and exceptions set out in the GDPR.

Because none of this rests on consent, there is no consent to withdraw. What you have instead is more direct: you can tell us to stop at any time and ask us to erase your application, and we will. You can also object under Article 21 to any processing we do on legitimate-interest grounds.

Requests can be sent to hello@impossiblesolutions.ai. We answer within the one-month period the GDPR sets, and tell you if it has to be extended.

You can complain to a supervisory authority. For Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH); you may also complain to the authority in the EU country where you live or work.

12

Automated decisions

No decision about you is made solely by automated means. The form checks that the required answers are present and well formed and limits how often it can be submitted from one connection; beyond that, a person reads every application and decides what happens next. There is no profiling, no scoring of you, and nothing here produces a legal or similarly significant effect by automation.

13

Security

The site is served over HTTPS only. The application form is validated on the server, protected against automated submission, and rate limited. Access to any mailbox or system that holds applications is restricted to the people who review them.

14

Changes and contact

We will update this policy when the way the site handles data changes — in particular before application storage, a CRM, analytics or any new processor is introduced — and show the date of the current version here.

Questions about this policy can be sent to hello@impossiblesolutions.ai.