This Privacy Policy describes how AdSentry (“AdSentry,” “we,” “us,” or “our”) collects, uses, and discloses information when you use the AdSentry website at https://www.adsentry.co and the AdSentryapplication (collectively, the “Service”). By using the Service, you agree to the practices described here.
Summary
AdSentry connects to your Google Ads account, reads your campaign data, and uses AI to surface fixes that reduce wasted spend. To do that we store the minimum we need: who you are (your Google identity), an authorization token so we can fetch your Ads data on your behalf, and the results of the audits we run for you. We do not sell your personal information, and we do not use your account data to train third-party AI models.
Information We Collect
Identity information from Google
When you sign in with Google, we receive your Google account identifier (a stable opaque ID Google calls “sub”), your email address, your name, and your profile picture URL. We use this to create and authenticate your AdSentry account.
Google Ads authorization
When you click “Connect Google Ads,” Google asks you to consent to thehttps://www.googleapis.com/auth/adwordsscope. If you approve, Google returns a refresh token to us. We store the refresh token, the granted scope list, and the Google identity that granted access. The refresh token lets us request short-lived access tokens later so we can call the Google Ads API on your behalf — for example, when you ask AdSentry to run an audit. You can revoke this access at any time from your Google Account permissions page.
Google Ads account data
When you run an audit, AdSentry fetches data from your connected Google Ads accounts via the Google Ads API. This includes account metadata (account name, currency, time zone), campaign settings, search-terms reports, conversion configuration, and spend history. We use this data to generate audit findings and recommendations. Where we cache this data, we associate it only with your account.
Billing information
If you subscribe to a paid plan, payment processing is handled by Square. AdSentry does not see, store, or transmit your full card number. Square provides us with a customer identifier, the plan you selected, your subscription status, and the last four digits and brand of your stored card so we can display it in your billing settings.
Cookies and similar technologies
We set two HTTP-only cookies on your browser to operate the Service:
- Session cookie (
adsentry_session): a cryptographically signed token that identifies you while you are logged in. Expires 7 days after issuance. - OAuth state cookie (
adsentry_oauth_state): a short-lived random value used to prevent cross-site request forgery during the Google OAuth handshake. Expires 10 minutes after issuance.
Both cookies are marked HttpOnly and SameSite=Lax. We do not use third-party advertising cookies, and we do not allow third parties to set cookies through the Service.
Usage and diagnostic information
Our hosting provider (Vercel) logs standard request metadata — IP address, user agent, request path, and timing — for the purpose of operating, securing, and debugging the Service. These logs are retained on Vercel’s infrastructure and access is restricted to authorized AdSentry personnel.
How We Use Information
- To provide, maintain, and improve the Service.
- To call the Google Ads API on your behalf, generate audits, and surface findings and recommendations.
- To authenticate you, secure your account, and prevent abuse.
- To process subscription payments and provide receipts.
- To send transactional emails (sign-in confirmations, billing receipts, audit alerts).
- To comply with legal obligations.
We do not sell your personal information. We do not use your Google Ads data to train models for sale or distribution to third parties.
How We Share Information
We share information only with the subprocessors listed below, in each case limited to what is needed for them to perform their function:
- Vercel — application hosting and request logging.
- Neon — Postgres database hosting for your account and audit records.
- Google — OAuth identity provider and Google Ads API endpoint.
- Anthropic (Claude) and OpenAI— AI models used during audits to classify search terms, summarize findings, and generate recommendations. We send campaign data necessary for these tasks; we do not send your Google authorization tokens. Anthropic and OpenAI’s API terms prohibit using customer inputs to train their public models.
- Square — subscription billing and payment processing.
- Amazon Web Services (SES) — transactional email delivery.
We may also disclose information when required by law, when necessary to enforce our Terms, or in connection with a corporate transaction such as a merger or acquisition (in which case we will notify you and ensure the receiving party honors this Policy).
Data Retention
- Account information is retained while your account is active. If you delete your account, we delete your profile and disconnect all Google Ads authorizations within 30 days.
- Google Ads refresh tokens are deleted as soon as you disconnect the corresponding Google account or delete your AdSentryaccount. You may also revoke access directly with Google at any time, which invalidates the token on Google’s side immediately.
- Audit results are retained for as long as your subscription includes history access (see your plan). Free-tier audits are retained for 90 days.
- Billing records are retained for the period required by applicable tax and accounting law (typically seven years).
- Server logs are retained by Vercel for up to 30 days.
Your Rights
Depending on where you live, you may have the following rights with respect to your personal information:
- Access — request a copy of the data we hold about you.
- Correction — ask us to fix inaccurate information.
- Deletion — ask us to delete your account and associated data.
- Portability — request your data in a machine-readable format.
- Withdrawal of consent — disconnect your Google Ads authorization at any time, either from within AdSentry or from your Google Account permissions page.
- Objection / restriction — ask us to stop or limit specific uses of your data.
To exercise any of these rights, email privacy@adsentry.co. We will respond within the time period required by applicable law (typically 30 days for GDPR requests, 45 days for CCPA requests).
Security
We use industry-standard safeguards to protect your information:
- All traffic to AdSentry is served over HTTPS.
- Session tokens are signed with HMAC-SHA-256 and stored in HttpOnly, Secure, SameSite=Lax cookies — they cannot be read by client-side JavaScript.
- Refresh tokens are stored in our Neon Postgres database, which encrypts data at rest. Database access requires authenticated, network-restricted credentials.
- OAuth state is validated on every callback to prevent CSRF and authorization-code interception.
- Access to production systems is limited to authorized AdSentry personnel and is logged.
No system is perfectly secure. If we ever detect a breach of personal information that affects you, we will notify you and the relevant authorities within the time periods required by applicable law.
International Data Transfers
AdSentry is operated from the United States, and the subprocessors listed above primarily store data in the United States. If you access the Service from outside the United States, you understand and consent to your information being transferred to and processed in the United States and other countries where our subprocessors operate.
Children
The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
Cookies
See “Cookies and similar technologies” above for the full list. AdSentryuses only the two strictly necessary cookies described there. We do not use analytics cookies, advertising cookies, or third-party tracking cookies.
Limited Use of Google User Data
AdSentry’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Changes to This Policy
We may update this Privacy Policy from time to time as the Service evolves. When we do, we will update the “Effective” date at the top of this page and, for material changes, notify you by email or via an in-app notice before the change takes effect.
Contact
Questions about this Privacy Policy? Email privacy@adsentry.co.