AdglidePrivacy policy
1. Who we are
Adglide is operated by M53 Tech Labs FZC, Shams Free Zone, Sharjah, United Arab Emirates (“Adglide”, “we”, “us”). We are the controller of the personal data described here when you visit our website or use your own Adglide account. When a customer uses Adglide to manage advertising for its own clients or end customers, the customer decides what data goes into the service and we process that data on the customer's behalf as a processor.
Contact for privacy questions: support@adglide.io.
2. What we collect
- Account data: your name, email address, role, and sign-in events (time, outcome and IP address) recorded for security.
- Organization and workspace data: the names and settings of the organizations and workspaces (clients, brands or projects) you create, team members and their permissions, and commercial details such as invoicing contacts.
- Ad account data synced from connected platforms: ad account identifiers, campaigns, ad groups, ads, budgets, settings, product catalogs, conversion settings, and performance metrics (impressions, clicks, spend, conversions and conversion value). We read this from the platforms you connect and store it so that you can plan, review and report on it.
- Credentials and tokens: OAuth refresh tokens, API keys and similar credentials you provide to connect an ad platform. They are stored encrypted and are never shown back in full.
- Audience and event files: if you upload a customer list or send conversion events, the file is processed on our servers. Identifiers such as email addresses and phone numbers are normalized and hashed (SHA-256) according to the destination platform's rules, and the raw file is deleted when processing finishes. We do not write raw identifiers to our databases or logs. Uploading such data is your responsibility under the “Customer responsibilities” section of our terms.
- Changes and audit history: the edits staged, approved and published through Adglide, with who made them and when.
- Operational logs: technical logs (request paths, status codes, errors, IP addresses) used to run, secure and debug the service. Query strings are not kept in access logs.
- Correspondence: messages you send us, such as support or access requests.
We do not collect special categories of personal data on purpose, and the service is not directed at children.
3. Google user data
This section applies to information we receive from Google APIs when you connect a Google account to Adglide.
Which Google data and scopes
| API | OAuth scope | Data accessed |
|---|---|---|
| Google Ads API | https://www.googleapis.com/auth/adwords | The Google Ads accounts you can access, including accounts under a manager (MCC) account: campaigns, ad groups, ads, budgets, keywords, conversion actions, audiences and performance reports. |
| Merchant API | https://www.googleapis.com/auth/content | Your Merchant Center account, product data sources and product status, to manage product catalogs used by Shopping and Performance Max campaigns. |
| Data Manager API | https://www.googleapis.com/auth/datamanager | Customer Match audience lists and conversion events in your Google Ads account, which you ask us to create or send. |
We do not request your Gmail, Drive, Calendar, contacts or other Google account content.
How we use Google user data
We use Google user data only to provide and improve the user-facing features you request in Adglide: discovering your ad accounts, showing and editing your campaigns through changes you approve, reporting on performance, managing product catalogs, and managing audiences and conversions. We do not use it for any other purpose.
- We do not sell Google user data.
- We do not use it for serving advertising, including retargeting, personalized or interest-based advertising.
- We do not use it to determine credit-worthiness or for lending.
- We do not use it to develop, improve or train generalized artificial intelligence or machine-learning models. Any automated optimization we offer works within your own account and goals only, and its proposals are shown to you or your reviewers.
- We do not transfer or share it with third parties except as needed to provide the features you request (our hosting and email processors, listed below), to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
- Humans do not read your Google user data unless you give your consent for specific data (for example when you ask our support staff for help), it is necessary for security purposes (for example investigating abuse), or it is required to comply with law. Our staff access is role-restricted and logged.
Storage and protection
OAuth tokens are stored encrypted. Synced data is stored in our database in Google Cloud's Frankfurt (Germany) region, and transmitted over TLS. You can disconnect a Google connection at any time in Adglide, which wipes the stored credentials, and you can also revoke Adglide's access from your Google Account permissions page. You can request deletion of synced Google data as described in “Retention” and “Your rights”.
Limited Use disclosure
Adglide's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. OpenAI and other ad platforms
ChatGPT Ads (OpenAI). To connect OpenAI's advertising platform you provide an Ads API key issued by OpenAI for your ad account. We store it encrypted. We send data to OpenAI's Ads API only to manage your campaigns as you request (reading and syncing your ad account, campaigns, ads and reports, and publishing changes you approved, and, if you use them, sending audiences or conversion events). We do not use OpenAI data to train models or for any purpose other than providing the service to you. OpenAI's own handling of data is governed by its terms and privacy policy.
Other platforms. The same applies to any further ad platform we add: we connect only on your instruction, use the credentials only for the features you request, and update this policy to name the platform.
5. How and why we use data
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service: accounts, workspaces, connections, syncing, staging, approving and publishing changes, reporting | Performance of a contract (Art. 6(1)(b)); for data we handle for a customer, the customer's instructions |
| Security, fraud and abuse prevention, audit logging, debugging and reliability | Legitimate interests (Art. 6(1)(f)) |
| Invoicing, accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Service emails (sign-in, approvals, notifications, invoices) | Performance of a contract; legitimate interests |
| Answering your questions and requests | Legitimate interests; steps prior to a contract |
| Anything else we ask you about first | Consent (Art. 6(1)(a)), which you can withdraw at any time |
We do not sell personal data and we do not use it for advertising.
6. Who we share data with
We use these service providers (processors) under data processing terms:
- Google Cloud (Google Cloud EMEA Limited / Google LLC): hosting, database and backups, in the Frankfurt, Germany region.
- Brevo (Sendinblue SAS, France): sending service emails.
- The ad platforms you connect (currently Google Ads and OpenAI's ChatGPT Ads): data flows to and from them at your instruction. They are independent controllers of the data they hold under their own policies.
We may also disclose data to professional advisers, to authorities where the law requires it, or to a successor in a business transfer. Our staff access personal data only as needed for their role.
7. Retention
- Account, organization, workspace and synced ad account data: kept while the account is active.
- When a connection is disconnected, its credentials are wiped; history is kept for the audit trail unless you ask us to delete it.
- When an account is closed, we delete or anonymize its data within 30 days, except records we must keep by law (for example invoices).
- Database backups are kept for 30 days and then deleted. Deleted data may remain in backups until they expire.
- Raw customer-list files are deleted as soon as processing finishes.
- Operational logs are kept for up to 30 days.
8. Security
We use encryption in transit (TLS) and encrypted storage of credentials, role-based access control with per-workspace permissions, an audit trail of changes, staged approval of edits, least-privilege access for our staff and systems, and isolated production infrastructure. No system is perfectly secure; we will notify affected customers and authorities of a personal data breach as required by law.
9. International transfers
We host data in the European Union (Frankfurt, Germany). Some processors or the ad platforms you connect may process data outside the EEA, for example in the United States. Where that happens we rely on an adequacy decision (such as the EU-US Data Privacy Framework where the recipient is certified) or the European Commission's Standard Contractual Clauses.
10. Your rights
Subject to applicable law you have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent. You may also lodge a complaint with your local data protection authority. To exercise a right, email support@adglide.io. If your data is in a customer's workspace, we may refer your request to that customer.
11. Cookies and tracking
This website (adglide.io) sets no cookies and uses no analytics, advertising pixels or third-party scripts. The Adglide application at app.adglide.io uses a strictly necessary session cookie to keep you signed in, and nothing for advertising.
12. Changes
We will post changes to this policy on this page and update the date above. For material changes we will notify account holders by email.
13. Contact
M53 Tech Labs FZC, Shams Free Zone, Sharjah, United Arab Emirates
Email: support@adglide.io