1. Governance
Leadership owns information security, privacy and compliance, and reviews them at least once a year. Our practices include:
- Written policies for acceptable use, data handling, access control, incident response and AI use.
- Security and privacy training for everyone with access to client systems or data, at hire and yearly.
- Confidentiality obligations in employee and contractor agreements.
- Written agreements with every client that define what data we handle and how.
2. Risk management
- Risk review. We identify and rank risks to client data, systems and campaigns, and review them yearly or when something material changes.
- Vendor risk. Before adopting a tool that touches client data, we review its security, privacy terms and data location. We prefer vendors with independent security attestations such as SOC 2 or ISO 27001.
- Incident response. A documented plan covers detection, containment, investigation, notification and lessons learned. Clients are told without undue delay if an incident affects their data.
- Continuity. Critical files and accounts are backed up, and access is never held by a single person.
3. Information security
Our infrastructure and devices are managed with our sister company, Ad Spin Tech, a managed IT and security provider. Core safeguards include:
- Multi-factor authentication on email, ad platforms, cloud storage and admin systems.
- Least-privilege access, reviewed regularly, and removed promptly when someone leaves a project.
- Encryption in transit (HTTPS/TLS) and at rest for stored client data.
- Managed, updated devices with endpoint protection.
- Client ad accounts stay in the client's name; we work in them through permissioned access.
- Secure file transfer for customer lists and data files, which are deleted when the project ends.
4. Data privacy
- Minimization. We ask for only the data a campaign needs.
- Purpose limits. Client data is used only for that client's work, never combined across clients or used for our own marketing.
- Data processing agreements. Available on request for clients subject to state privacy laws or other requirements.
- Consent-aware tracking. We build analytics and ad tracking around consent tools and honor opt-outs, including Global Privacy Control.
- Sensitive categories. For healthcare, financial and similar clients, we design tracking so sensitive information isn't sent to ad or analytics platforms.
Our full Privacy Policy covers this website.
5. Responsible AI
AI agents in our Spin Engine help monitor campaigns, test ideas and draft content. Our AI rules:
- People decide. A person approves anything that spends money, goes public or speaks for a client's brand.
- No training on your data. We use business-grade AI services configured so client data isn't used to train public models.
- Confidential stays confidential. We don't paste confidential client information into consumer AI tools.
- Honesty. We don't use AI to fake reviews, testimonials, endorsements or real people's likenesses, and we follow platform rules on disclosing AI-generated content.
- Quality and bias checks. AI output is fact-checked and reviewed for accuracy, brand safety and fairness before use.
6. Marketing compliance
We build campaigns to follow the rules that apply to each channel and industry, including:
- Email: the CAN-SPAM Act, with clear sender identity and working unsubscribe links.
- Calls and texts: the Telephone Consumer Protection Act (TCPA), including consent for automated texts and calls.
- Reviews and endorsements: the FTC Endorsement Guides and the FTC rule on fake reviews and testimonials.
- Direct mail: USPS mailing standards and suppression of do-not-mail requests.
- Ad platforms: Google Ads, Google Ad Grants, Meta and other platform policies.
- Regulated industries: fair housing rules for real estate, health privacy considerations for healthcare, financial advertising rules, attorney advertising rules and political ad disclaimers. Final legal review of regulated claims stays with the client.
- Accessibility: websites and content built toward WCAG 2.2 AA.
7. Documents for clients and vendors
On request, and under NDA where appropriate, we can provide:
- A completed security questionnaire.
- Our data processing agreement.
- A summary of our information security and AI policies.
- A certificate of insurance.
Email support@adspinmedia.com with "Security review" in the subject line.
8. Report a concern
If you believe you've found a security vulnerability in our website, or have a privacy or compliance concern, email privacy@adspinmedia.com. Please include enough detail for us to reproduce or investigate the issue. We'll acknowledge reports promptly and won't take action against good-faith security research that avoids harm to data or services.