Privacy Policy

adz.so is operated by Iberstar SRL, a company registered in Romania (EU), located at N. Balcescu, Bl. Camelia, Buzau, RO ("we," "us," or "our"). We operate the website adz.so (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, particularly in connection with our integration with the Google Ads API and other third-party platforms.

1. Information We Collect

1.1 Information You Provide Directly

We collect information that you provide directly to us, including:

• Account Information: Your name and email address, taken from your Google account when you sign in. Signing in with Google creates your adz.so account - there is no separate sign-up step, and it is that account the audits, Shopping tools and other features run against. We never receive or store a password. Authentication is handled entirely by Google, and we hold only the access credentials Google issues us, encrypted at rest. You may also give us a company name.
• How we use your name and email: To run your account and send you service messages you cannot opt out of while you hold an account (security notices, billing, changes to these terms), and to send occasional product updates or a newsletter. Every one of those carries an unsubscribe link, and unsubscribing never affects your access to the service.
• Payment Information: Billing address and payment method details (processed securely through third-party payment processors)
• Profile Information: Any additional information you choose to provide in your user profile
• Communications: Information you provide when contacting our support team or communicating with us

1.2 Google Ads Data

When you connect your Google Ads account to adz.so, we access and process the following data through the Google Ads API:

• Account Information: Account IDs, account names, and account hierarchy
• Campaign Data: Campaign settings, ad groups, keywords, ads, and extensions
• Performance Metrics: Clicks, impressions, conversions, costs, and other campaign performance data
• Conversion Data: Information about conversion actions and offline conversion uploads
• Audience Data: Customer lists and audience segment information (if applicable)
• Budget and Billing: Budget information and spending data

1.3 Automatically Collected Information

We automatically collect certain information when you use our Service:

• Usage Data: Information about how you interact with our Service, including features used and actions taken
• Device Information: IP address, browser type, operating system, and device identifiers
• Log Data: Server logs, including access times, pages viewed, and system activity
• Cookies and Tracking: Information collected through cookies and similar tracking technologies

1.4 Third-Party Platform Data

If you connect other marketing platforms (such as Facebook Ads, LinkedIn Ads, or analytics tools), we may collect similar data from those platforms as authorized by you.

2. How We Use Your Information and Legal Basis (GDPR)

We process your personal data only when we have a valid legal basis under the GDPR (Article 6). Below we explain each purpose and its corresponding legal basis:

2.1 Service Delivery and Improvement

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)

• Provide, maintain, and improve our Service
• Process and manage your Google Ads campaigns and automation workflows
• Generate reports, analytics, and insights about your advertising performance
• Troubleshoot technical issues and provide customer support

2.2 Google Ads API Specific Uses

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)

• Access and manage your Google Ads campaigns on your behalf
• Upload offline conversions to your Google Ads account
• Synchronize campaign data with our automation workflows
• Optimize campaign performance based on your settings and preferences
• Create and update ads, keywords, and campaign structures as directed by you

2.3 Product Development

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — Our legitimate interest is improving the Service for all users. We balance this against your rights by using aggregated and anonymized data wherever possible.

• Develop new features and enhance existing functionality
• Analyze usage patterns to improve user experience

2.4 Communications

• Service notifications (Legal basis: Performance of a contract, Art. 6(1)(b)) — Send you service-related notifications, updates, and security alerts
• Support (Legal basis: Performance of a contract, Art. 6(1)(b)) — Respond to your inquiries and support requests
• Marketing communications (Legal basis: Consent, Art. 6(1)(a)) — Send promotional emails and newsletters. You may withdraw consent at any time via the unsubscribe link in any email or by contacting us

2.5 Analytics and Cookies

Legal basis: Consent (Art. 6(1)(a) GDPR) — Non-essential cookies and analytics tracking are only activated after you provide consent through our cookie consent mechanism. Essential cookies required for the Service to function are based on legitimate interest.

2.6 Legal and Security

Legal basis: Legal obligation (Art. 6(1)(c)) and Legitimate interest (Art. 6(1)(f) GDPR)

• Comply with legal obligations and respond to legal requests
• Protect against fraud, security threats, and abuse
• Enforce our Terms of Service and other agreements

3. Google API Services User Data Policy Compliance

3.1 Limited Use of Google User Data

We commit to the following regarding Google user data:

• Limited Use: We only use Google Ads data to provide or improve user-facing features of adz.so that are prominent in the requesting application's user interface
• No Human Reading: Humans will not read your Google Ads data unless:
  • We have your explicit consent
  • It's necessary for security purposes (e.g., investigating abuse)
  • Required to comply with applicable law
  • Our use is limited to internal operations and the data is aggregated and anonymized
• No Transfer: We do not transfer your Google user data to others unless:
  • It's necessary to provide or improve user-facing features
  • Required to comply with applicable law
  • Part of a merger, acquisition, or sale of assets (with notice to users)
  • Aggregated and anonymized (not associated with individual users)
  • You provide explicit consent
• No Use for Ads: We will never use your Google Ads data to serve advertisements
• No Creditworthiness or Lending: We do not use your data for determining creditworthiness or lending purposes

3.2 Data Access and Permissions

When you connect your Google Ads account, we request only the minimum permissions necessary to provide our Service. You can revoke our access to your Google Ads account at any time through your Google Account settings or by disconnecting the integration within adz.so.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share data with trusted third-party service providers who perform services on our behalf, including:

• Cloud hosting and infrastructure providers
• Payment processors
• Analytics services
• Customer support tools
• Email delivery services

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

4.2 API Integrations

When you authorize integrations with third-party platforms (e.g., Google Ads, CRM systems), we share data with those platforms only as necessary to fulfill the integration functionality you've requested.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and choices you may have. In accordance with the Google Ads API Terms and Conditions, we will also notify Google within 21 days of any change of control and reapply for Developer Token access as required.

4.5 Aggregated and Anonymized Data

We may share aggregated or anonymized data that does not directly identify you for industry analysis, demographic profiling, marketing, and other business purposes.

4.6 AI Providers

Some features answer questions about your advertising account using a large language model. Where they do, we send the question that was asked and the account data our own read-only queries returned in order to answer it. We never send your Google credentials, and the model has no ability to change anything in your account.

These features are provided using one or both of the following sub-processors, both established in the United States:

• OpenAI, L.L.C.
• Anthropic, PBC

Which of the two is used, and which of their models, may change as models improve. Both state that data submitted through their APIs is not used to train their models by default. If we ever add an AI sub-processor outside this list, we will name it here before any of your data is sent to it.

AI features are optional. An account with them switched off sends nothing to either provider.

5. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption: Data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption
• Access Controls: Strict access controls limit who can access your data internally
• Authentication: Secure authentication mechanisms, including OAuth 2.0 for API integrations
• Monitoring: Continuous monitoring for security threats and vulnerabilities
• Regular Audits: Periodic security assessments and penetration testing
• Employee Training: Security awareness training for all team members

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained while your account is active and for a reasonable period thereafter
• Google Ads Data: Performance data may be retained for historical reporting purposes, but can be deleted upon request
• Transaction Records: Retained as required for accounting and legal purposes
• Backup Data: May persist in backup systems for up to 90 days after deletion

7. Your Rights and Choices

7.1 Access and Correction

You have the right to access and update your personal information through your account settings or by contacting us.

7.2 Data Portability

You can export your campaign data and reports from adz.so at any time.

7.3 Deletion

You can request deletion of your account and associated data by contacting us at info@adz.so. Some information may be retained as required by law or for legitimate business purposes.

7.4 Google Ads Access

You can revoke adz.so's access to your Google Ads account at any time by:

• Visiting your Google Account permissions page
• Disconnecting the integration within your adz.so account settings

7.5 Marketing Communications

You can opt out of marketing emails by clicking the "unsubscribe" link in any marketing email or updating your communication preferences in your account settings.

7.6 Cookies

When you first visit our Service, we present a cookie consent banner that allows you to accept or decline non-essential cookies. Essential cookies required for the Service to function are always active. You can change your cookie preferences at any time through the cookie settings link in our footer or through your browser settings. Disabling essential cookies may affect the functionality of our Service.

7.7 GDPR Rights (European Users)

If you are in the European Economic Area, you have the following rights under the GDPR. To exercise any of these rights, contact us at info@adz.so. We will respond to your request within 30 days. In exceptional cases involving complex or numerous requests, we may extend this period by an additional 60 days, in which case we will inform you of the extension and the reasons for it within the initial 30-day period.

• Right to access (Art. 15) — Obtain a copy of your personal data and information about how it is processed
• Right to rectification (Art. 16) — Correct inaccurate or incomplete personal data
• Right to erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten")
• Right to restriction of processing (Art. 18) — Limit how we process your data in certain circumstances
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interest or for direct marketing purposes
• Right to withdraw consent (Art. 7(3)) — Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making (Art. 22) — We do not make decisions based solely on automated processing that produce legal effects concerning you

7.8 CCPA Rights (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:

• Right to know what personal information is collected
• Right to know whether personal information is sold or disclosed
• Right to opt-out of the sale of personal information (Note: we do not sell personal information)
• Right to deletion of personal information
• Right to non-discrimination for exercising CCPA rights

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your country. We ensure appropriate safeguards are in place for such transfers, including:

• Standard Contractual Clauses approved by the European Commission
• Compliance with applicable data protection frameworks
• Ensuring service providers maintain adequate data protection standards

This includes the AI sub-processors named in section 4.6, which are established in the United States.

9. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will take steps to delete that information.

10. Third-Party Links and Services

Our Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on this page
• Updating the "Last Updated" date
• Sending you an email notification (for significant changes)
• Displaying a prominent notice within the Service

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

13. Data Protection Officer

For GDPR-related inquiries or to exercise your data subject rights, you may contact our Data Protection Officer at info@adz.so.

14. Supervisory Authority

If you are in the European Economic Area and believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection supervisory authority. For users in Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

15. Data Processing Agreement (DPA)

When adz.so processes personal data on your behalf (for example, your customers' data accessed through Google Ads or other integrations), adz.so acts as a data processor under GDPR Article 28. In such cases, we offer a Data Processing Agreement (DPA) that covers:

• The subject matter and duration of processing
• The nature and purpose of processing
• The types of personal data and categories of data subjects
• Your obligations and rights as the data controller
• Our obligations as the data processor, including confidentiality, security measures, sub-processor management, and data deletion

To request a copy of our DPA, please contact us at info@adz.so. If you are a business customer, we recommend executing a DPA before connecting accounts containing personal data of your end users.

16. Google Ads API Additional Disclosures

In addition to the disclosures above, this section provides specific information about our use of the Google Ads API:

15.1 Scope of Access

When you authorize adz.so to access your Google Ads account, we request access to:

• View and manage your Google Ads campaigns, ad groups, ads, and keywords
• Access performance metrics and reporting data
• Upload offline conversions to your account
• Manage audience lists and targeting settings
• View and modify bid strategies and budget settings

15.2 How We Use Google Ads Data

We use data from the Google Ads API exclusively to:

• Display your campaign performance within the adz.so dashboard
• Execute automated optimizations you have configured
• Generate reports and analytics for your review
• Send you alerts about significant campaign changes
• Provide AI-powered recommendations to improve performance

15.3 Data Storage and Retention

Google Ads data accessed through the API is:

• Stored securely using encryption at rest and in transit
• Retained only as long as necessary to provide the Service
• Deleted upon your request or account termination
• Never sold, rented, or shared with third parties for their marketing purposes

15.4 Revoking Access

You can revoke adz.so's access to your Google Ads data at any time by:

• Visiting https://myaccount.google.com/permissions and removing adz.so
• Disconnecting the Google Ads integration from your adz.so account settings
• Contacting us at info@adz.so to request disconnection

After revocation, we will delete your Google Ads data within 30 days, except where retention is required by law.