Privacy Policy
Last updated: 27 October 2026
LAI Agency Ltd is responsible for the personal data described in this policy. We are a performance marketing consultancy: we plan, run and report on paid advertising for our clients, and we build reporting tools they use to see their own results.
- Company: LAI Agency Ltd, registered in England and Wales, company number 13628593
- Registered office: 124 City Road, London EC1V 2NX
- Contact: cristina.lai@laiagency.co.uk
This policy covers laiagency.co.uk and the services we provide to clients. It explains what we collect, why, how long we keep it, and what you can ask us to do about it.
We are the data controller for information about visitors to this site and for our own client records. When we work inside a client's advertising accounts, the client is the controller and we act as their processor.
What we collect directly
We collect very little from this website, and nothing you aren't asked for.
If you use the contact form, we collect the name, email address and message you type. We use them to reply to you and to follow up about working together. Nothing else happens to them: we don't add you to a mailing list, and we don't sell or share them for anyone else's marketing.
If you become a client, we hold ordinary business records — the names, work email addresses and phone numbers of the people we deal with, along with contracts, invoices and the notes and reports produced while working on the account.
When you browse the site, our hosting provider records standard server information such as IP address, browser type and the pages requested. This is used to keep the site running and secure.
We do not knowingly collect information from children, and we do not collect special category data — things like health, religion or political opinions. Please don't send any to us through the contact form.
Working with your advertising accounts
When a client engages us, they grant us access to advertising and analytics accounts they already own. We never create accounts in a client's name, and we never access an account we haven't been given access to.
Access is granted by the client, through the platform's own permission system, and can be withdrawn by the client at any time without asking us first. Removing our access in Meta Business Manager, Google Ads or Google Analytics takes effect immediately.
What we access. With the client's permission, we read data from Meta, Google Ads and Google Analytics about the client's own advertising: campaigns, ad sets and ads; the creative assets used; spend, impressions, clicks, conversions and the cost of each; the aggregate and anonymous audience breakdowns the platforms report, such as age bands, placements and countries; and, where the client asks for it, the public comments left on the client's own advertisements and Page posts.
Why we access it. To run and improve the client's campaigns, and to report on them. Comment data is used to understand how audiences respond to particular advertising — which messages land, which cause confusion or complaint — and is summarised for the client, including as an overall sentiment breakdown.
What we do not do with it. We do not build profiles of individuals. We do not combine platform data with data from other sources to identify anyone. We do not use one client's data to benefit another client. We do not sell platform data, share it for advertising, or pass it to data brokers. We do not use it to train machine learning models of our own.
Comments and the people who write them. A comment on an advertisement is written by a member of the public and carries their name. We hold comments only for as long as the client needs the analysis, and we use them only in aggregate. We do not contact commenters, and we do not use their details for any purpose beyond the analysis the client asked for. Where a comment is deleted or hidden on the platform, it is removed from our records on the next synchronisation.
Our reporting platform, Truth in Ads, presents this data back to the client. Access is restricted to people the client authorises, and each client sees only their own accounts.
Why we are allowed to hold it
UK data protection law requires a lawful basis for each use of personal data. Ours are:
| What we do | Lawful basis |
|---|---|
| Reply to a contact form enquiry | Legitimate interests — responding to someone who contacted us |
| Hold client contact and account records | Performance of our contract with the client |
| Keep invoices and tax records | Legal obligation |
| Access and analyse a client's advertising data | Performance of our contract with the client, who instructs us as their processor |
| Keep the website secure | Legitimate interests — protecting the site and its visitors |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and concluded it is not. You can object, and we will stop unless we have compelling grounds not to.
We do not rely on consent for any of the above, which means there is no consent for you to withdraw — but your right to object still applies.
Who else sees it, and for how long
We keep the list of suppliers short, and none of them is permitted to use your data for their own purposes.
| Supplier | What they do | Where |
|---|---|---|
| [HOSTING PROVIDER] | Hosts this website | [REGION] |
| [DATABASE PROVIDER] | Stores contact form submissions and reporting data | [REGION] |
| [EMAIL PROVIDER] | Business email | [REGION] |
| [AI PROVIDER] | Summarises advertising comments into themes and sentiment, where a client has asked for that analysis | [REGION] |
Some suppliers are outside the UK. Where personal data is transferred, we rely on the UK International Data Transfer Addendum or an adequacy decision, and we check that appropriate safeguards are in place.
How long we keep things:
- Contact form enquiries: 24 months from your last contact with us, then deleted
- Client records and reports: for the length of the engagement and 12 months after it ends
- Invoices and tax records: 6 years, as UK law requires
- Advertising comment data: for the length of the engagement, and deleted when the client asks or when our access to the account ends
- Server logs: typically 30 days
Security. Access to client accounts and reporting data is restricted to people who need it. Platform access tokens are encrypted where they are stored. Reporting tools require each user to sign in, and client data is separated so that no client can see another's.
Your rights
Under UK data protection law you can ask us to: tell you what we hold about you; correct it; delete it; restrict what we do with it; send you a copy in a portable format; or stop processing it where we rely on legitimate interests.
Write to cristina.lai@laiagency.co.uk and we will respond within one month. There is no charge.
If your data reached us through a client's advertising account — for example, you commented on one of their advertisements — the client decides what happens to it. Tell us and we will pass your request to them, and act on their instruction.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.
Cookies
This site uses only the cookies needed to make it work — no analytics, advertising or tracking cookies, and so no cookie banner. If that changes, this section and a consent banner will be added before any non-essential cookie is set.
Changes
We update this policy when what we do changes. The date at the top shows the current version. If a change materially affects how we handle your data, we will tell affected clients directly.