Privacy Policy
Effective date: November 27, 2023
Last updated: November 9, 2026
Hi — I'm Kendra, The Ad Lawyer. I talk a lot about reading the fine print, so here's mine, written so you can actually read it. This Privacy Policy explains what personal information we collect when you visit www.theadlawyer.com (the "Site"), download a freebie, subscribe to our newsletter, or buy a membership or product, plus what we do with it and the choices you have.
1. Who we are
The Site is operated by Kendra Hudson, LLC ("The Ad Lawyer," "we," "us"), located at 1652 W Belmont Ave, Ste 1, c/o Cole Sadkin LLC, Chicago, IL 60657, USA. For purposes of the EU and UK General Data Protection Regulations ("GDPR"), we are the data controller of the personal information described in this policy.
Contact for anything privacy-related: contact@theadlawyer.com
2. What this policy covers
This policy covers personal information we collect through:
- the Site, which is hosted on Squarespace;
- our free downloads, guides, checklists and other lead magnets ("Freebies");
- our email newsletter, published on Substack;
- purchases of memberships, subscriptions and standalone digital products ("Products"); and
- the analytics and advertising tools installed on the Site (Google AdSense, Meta Pixel, and Metricool).
Squarespace, Substack, Google, Meta, and our payment processors also process some information for their own purposes as independent controllers. Their own privacy policies govern that processing, and we link to them in Section 5. Where this policy doesn't address a platform-level practice, the relevant platform's policy applies — for example, Squarespace's Privacy Policy covers Squarespace's own operation of the hosting infrastructure.
3. What we collect, why, and our legal basis
| What you do | What we collect | Why | Legal basis (GDPR) |
|---|---|---|---|
| Download a Freebie | Name (if requested), email address, the Freebie you requested, date/time, and consent record | To deliver the Freebie and any short follow-up directly related to it | Performance of a contract (delivering what you asked for) |
| Tick the box to join the newsletter (on a Freebie form or anywhere else) | Email address, consent record (what you agreed to, when, and where) | To send you The Ad Lawyer newsletter | Consent — you can withdraw anytime by unsubscribing |
| Subscribe on Substack | Email address, name/profile info you give Substack, free vs. paid status, open/click data Substack provides to publishers, comments you post | To send the newsletter, manage paid subscriptions, and understand which topics are useful | Consent (newsletter); contract (paid subscription); legitimate interests (basic engagement stats) |
| Buy a membership or Product | Name, email, billing address, order details, membership status, purchase history. Card/bank details are handled by our payment processor; we never see or store full card numbers | To process payment, deliver access, manage renewals and cancellations, provide support, and keep tax and accounting records | Contract; legal obligation (tax and accounting) |
| Create a member account | Login email, password (stored by Squarespace in hashed form), account activity | To give you access to member-only content | Contract |
| Contact us | Name, email, and whatever you choose to tell us | To reply to you | Legitimate interests (responding to inquiries) |
| Browse the Site | Device and browser info, IP address, pages viewed, referring site, approximate location (country/city), and cookie or similar identifiers — see Section 4 | Site security, basic analytics, measuring social media performance, and showing ads | Legitimate interests (security, cookieless analytics); consent (advertising and marketing cookies) |
We don't collect special-category data (like health or biometric data) and ask that you don't send it to us.
Where we get information: mostly directly from you. We also receive information from Squarespace, Substack, our payment processors, and — only if you've consented — from Google and Meta in aggregated reporting.
4. Cookies, pixels and tracking scripts
When you first visit the Site, a cookie banner lets you accept, reject, or customize non-essential cookies. Advertising and marketing tools stay off unless you say yes. You can change your choices anytime with the "Cookie Settings" link in the Site footer. We also honor the Global Privacy Control (GPC) browser signal as an opt-out of advertising cookies and "sharing" (see Section 9).
| Tool | Category | What it does | Default |
|---|---|---|---|
| Squarespace essential cookies | Strictly necessary | Keeps the Site working: security, shopping cart, checkout, member login, remembering your cookie choices | Always on (no consent needed) |
| Squarespace analytics cookies | Analytics | Squarespace's own traffic and sales reporting | Off until you consent |
| Metricool tracker | Analytics | Counts page views and visitor country so we can see which social posts drive traffic. It doesn't set cookies, doesn't assign you an identifier, and doesn't store your IP address | On (legitimate interests); you can still object — see Section 8 |
| Meta Pixel (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) | Advertising / marketing | Measures the results of our Facebook and Instagram content and ads, and may be used to build audiences for ads on Meta platforms. Meta may combine this with your Meta account activity | Off until you consent |
| Google AdSense (Google Ireland Ltd. / Google LLC) | Advertising | Displays ads on the Site. With your consent, ads may be personalized based on your browsing; without consent, Google may show limited or non-personalized ads | Off (personalization) until you consent |
Learn more about how Google uses information from sites that use its services, and manage Meta ad preferences in your Meta Accounts Center.
5. Who we share your information with
We do not sell your personal information for money. We share it only with service providers that help us run the business, and only as much as they need:
- Squarespace — website hosting, forms, commerce, member areas, and Squarespace email. (Privacy Policy)
- Substack — newsletter publishing and paid subscription management. Substack acts as our processor for our subscriber list and as an independent controller for its own platform purposes. (Privacy Policy)
- Stripe and PayPal — payment processing and fraud prevention; independent controllers for their own compliance obligations. (Stripe; PayPal)
- Google (AdSense) and Meta (Pixel) — advertising and measurement, only with your consent.
- Metricool — cookieless website and social media analytics.
- Google Workspace — business email and document storage.
- QuickBooks (Intuit) — accounting and tax records (order and payment information only).
- Professional advisers (accountants, insurers, lawyers) under confidentiality obligations.
- Authorities, when required by law, or to protect our rights, our users, or the public.
- A successor business, if The Ad Lawyer is sold or reorganized — this policy would continue to apply to your information.
6. International transfers
We're based in the United States, and most of our providers process data in the US. When we transfer personal information from the EEA, UK, or Switzerland to the US, we rely on the provider's certification under the EU-U.S. Data Privacy Framework (and its UK Extension and Swiss-U.S. framework) where available, or on the European Commission's Standard Contractual Clauses (and the UK Addendum) included in the provider's data processing terms.
7. How long we keep it
| Information | How long |
|---|---|
| Newsletter subscriber data | Until you unsubscribe, then moved to a suppression list (Section 10) |
| Freebie download records (no newsletter opt-in) | Up to 12 months, then deleted |
| Order, payment and tax records | 7 years after the transaction (US tax recordkeeping) |
| Member account data | For the life of your account, plus up to 90 days after closure for support and refunds |
| Contact messages | Up to 2 years after our last exchange |
| Cookie consent records | Up to 12 months, or as long as the cookie lasts |
| Analytics data | Per each tool's retention settings, generally no longer than 26 months |
8. Your rights (EEA, UK and Swiss residents)
Under the GDPR you have the right to:
- Access the personal information we hold about you;
- Correct inaccurate information;
- Delete your information ("right to be forgotten");
- Restrict our processing;
- Port your information to another service in a machine-readable format;
- Object to processing based on legitimate interests — including analytics — and to direct marketing at any time;
- Withdraw consent at any time (this doesn't affect processing that already happened); and
- Complain to your local data protection authority. (In the EU, find yours at edpb.europa.eu; in the UK, it's the ICO at ico.org.uk.) We'd appreciate the chance to fix things first, though.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
To exercise a right, email contact@theadlawyer.com with the subject line "Privacy Request." We'll respond within one month (extendable by two months for complex requests, and we'll tell you if so). We may ask you to verify your identity. Requests are free unless they're manifestly unfounded or excessive.
9. Your rights (US residents)
Depending on your state — including California, Maryland, and other states with comprehensive privacy laws — you may have the right to know, access, correct, delete, and obtain a copy of your personal information, and to opt out of targeted advertising and the "sale" or "sharing" of personal information.
We don't sell personal information for money. However, allowing the Meta Pixel and personalized AdSense ads may be considered "sharing" or "targeted advertising" under some state laws. To opt out, reject advertising cookies in Cookie Settings or turn on Global Privacy Control in your browser. We won't discriminate against you for exercising any of these rights. You can use an authorized agent; we'll ask for proof of authorization. If we deny a request, you can appeal by replying to our decision with "Appeal" in the subject line.
10. Emails, unsubscribes and our "do not email" list
Every marketing email includes an unsubscribe link, and we process unsubscribes promptly — and in any case within 10 business days. Unsubscribing from the newsletter doesn't cancel a paid membership (manage that from your account), and we may still send you transactional emails about purchases or your account.
When you unsubscribe or ask us to delete your data, we keep only your email address on a suppression list so that you aren't accidentally re-added from another sign-up source (for example, a Freebie form). This is necessary to respect your choice and is based on our legal obligations and legitimate interests.
11. Children
The Site isn't directed to children. We don't knowingly collect personal information from anyone under 16 (or under 13 in the US). If you believe a child has given us information, email us and we'll delete it.
12. Security
We use reputable platforms with encryption in transit (HTTPS), hashed passwords, access controls, and two-factor authentication on our business accounts. No system is perfectly secure, but if a breach affecting your information occurs, we'll notify you and regulators as the law requires.
13. Third-party links and platforms
The Site and newsletter link to other websites and social platforms (Instagram, TikTok, YouTube and others). We're not responsible for their privacy practices, so read their policies — you know I'll be proud of you.
14. Changes to this policy
We'll update this policy when our tools or the law change. We'll post the new date at the top and, for material changes, notify subscribers and members by email before the change takes effect.
15. Contact
Kendra Hudson, LLC1652 W Belmont Ave, Ste 1
c/o Cole Sadkin LLC
Chicago, IL 60657 USA
Email: contact@theadlawyer.com