Spendly is an internal tool used by Milhas e Meridianos Lda. (“we”, “us”, “the agency”) to monitor and control paid advertising budgets on behalf of our clients. This policy explains what data the application handles, why, and for how long.
Spendly is not a public product. It has no sign-up, and accounts are created only for members of our team. Clients and members of the public do not have logins. If you received a link to a performance report, section 11 is the part that concerns you.
Data protection law treats these differently, and Spendly holds both kinds of data:
| Data | Our role | What that means |
|---|---|---|
| Our team members’ own data — name, work email, role, activity in the app | Controller | We decide why and how it is processed, and we answer directly to the people concerned. |
| Advertising data belonging to our clients — their campaigns, spend and conversion counts | Processor | We handle it on our clients’ instructions, under our services agreement with them. The client remains the controller. |
Spendly does not manage passwords. Sign-in is delegated to Milhas ID, our shared internal identity service, which is also used by our other internal tools. From it, Spendly receives and stores a user identifier, name and work email address.
Spendly stores no password, password hash or reset token. It additionally holds, for each team member: their role (admin, member or viewer), which clients they are allowed to see, notification preferences, language and timezone, and the time of their last sign-in.
When an administrator connects an advertising platform (currently Google Ads and Meta), Spendly reads, on a schedule:
This data is aggregated at campaign level. Spendly does not request, and the platforms do not return to it, any information identifying the individual people who saw or clicked an advertisement.
To read the above, Spendly stores authorisation tokens issued by each advertising platform. These are encrypted at rest, are never written to logs, and are never returned by the application’s own interfaces. Spendly requests read-only access; it does not hold permission to modify or create campaigns.
Users create budgets, clients, alert settings and reports. They may also enter figures by hand that no connector provides — for example sales, orders and sessions from an online store — and write comments on reports. Comments are free text and may contain whatever the author types, so we ask the team to keep them to commentary about performance.
Stated plainly, because the absence is a design decision rather than an oversight:
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Give our team access to the tool and the right level of permission | Account and identity (3.1) | Legitimate interests — running our business securely; and performance of the employment or contractor relationship |
| Monitor budget pacing and produce client reporting | Advertising data (3.2), manual entries (3.4) | Performance of our contract with the client, whose instructions we act on as processor |
| Keep the connection to each advertising platform working | Credentials (3.3) | Performance of our contract with the client |
| Notify the responsible person when spend drifts off target or delivery breaks | Account data, advertising data | Legitimate interests — preventing overspend and under-delivery of client budgets |
| Keep an audit trail and secure the system | Operational records (3.5) | Legitimate interests — accountability and security; and legal obligation where records must be kept |
Where we rely on legitimate interests, we have considered the effect on the people concerned. The processing is limited to work activity in a workplace tool, and is what a member of the team would reasonably expect.
Spendly sets one cookie: a session cookie that keeps you signed in. It is marked HttpOnly, Secure and SameSite=Lax, and lasts up to seven days, renewing while you are active. Signing out clears it.
This cookie is strictly necessary for the application to function, so no consent banner is shown. There are no analytics, advertising or third-party cookies to consent to. The one exception to third-party requests is that the application loads its typefaces from Google Fonts, which means your browser contacts Google’s servers when a page loads.
We use a small number of providers. Each is bound by a data processing agreement.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| OVH Groupe SA | Application and database hosting | All stored data | Germany (EU) |
| Google LLC — Google Ads API | Source of advertising performance data | Campaign and spend data from the client’s own account | United States |
| Meta Platforms Ireland Ltd. — Marketing API | Source of advertising performance data | Campaign and spend data from the client’s own account | Ireland (EU), with onward transfer to the United States |
| Google LLC — Google Workspace | Alert and invitation email | Name, email address, alert contents | United States |
| Slack (optional) | Alert delivery, where a workspace is connected | Alert contents and the recipient’s Slack identity | United States |
| Milhas ID (internal) | Authentication for our own team | Name, email address, credentials | Hosted with our own infrastructure |
We will also disclose data where we are legally required to, or to establish or defend legal claims. We do not otherwise share it with anyone.
Spendly’s own data stays in the European Union. The application and its database are hosted by OVH in Germany, so no transfer safeguard is needed for the data we store ourselves.
Transfers arise only where we read from, or send through, providers established in the United States — Google (Google Ads and Google Workspace), Meta, and Slack where it is connected. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and on the European Commission’s Standard Contractual Clauses otherwise.
In the case of advertising data, the data already sits in the client’s own Google or Meta account before Spendly reads it; connecting Spendly does not move it anywhere new.
| Data | Kept for | Why that period |
|---|---|---|
| Daily advertising spend and performance | 48 months | Three full years of year-on-year report comparison, plus a margin |
| Audit log | 24 months | Accountability for changes made in the system |
| Alerts | 12 months | Reviewing whether alerting is accurate |
| Report runs and their share history | 24 months | Knowing what was actually sent to a client |
| Team member account | Deleted or anonymised within 90 days of the person leaving | Their name stays on historical audit entries where accountability requires it |
| Platform credentials | Deleted immediately when a connection is removed, and revoked at the platform | They are no longer needed and are the most sensitive item held |
| Backups | 30 days | Recovery. Deleted data disappears from backups as they roll over |
When a client relationship ends, we delete or return their advertising data in accordance with our services agreement with them.
No system is perfectly secure. If a breach affects personal data, we will notify the competent supervisory authority within 72 hours where the law requires it, and inform affected people and clients without undue delay.
Spendly can produce a link to a read-only performance report. If you have received one, the following applies:
Under the GDPR you may ask us to:
Write to david@milhasemeridianos.pt. We will respond within one month, and will tell you if we need longer because the request is complex. We may ask you to confirm your identity first.
If your request concerns advertising data we hold for a client, we will pass it to that client, who is the controller for it, and support them in responding.
For campaign, spend and conversion data belonging to a client, we act on that client’s instructions as their processor. In that capacity we:
The full terms are set out in the data processing agreement within our services agreement.
Spendly is a workplace tool for our staff. It is not directed at children and we do not knowingly process children’s data through it.
We will update this policy when the application changes in a way that affects it. The version number and date at the top always reflect the current text. Where a change materially affects our team or our clients, we will tell them directly rather than relying on this page alone.
Controller: Milhas e Meridianos Lda.
Rua Alfredo Keil 1, 3.º Direito, 2675-210 Odivelas, Portugal
VAT / NIPC 517294168
Privacy contact: david@milhasemeridianos.pt
If you are unhappy with how we have handled your data, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority where you live or work. We would appreciate the chance to resolve the matter with you first.