Privacy Policy

Last updated: August 6, 2026

1. Controller

Marius Blau, Rigaer Str. 15, 10247 Berlin, Germany · Email: info@mariusblau.de

2. Data We Process

• Account and access data: the email address of your Google account (allowlist, access management), an OAuth refresh token for accessing the Google Ads API (stored encrypted), and an API key (stored as a hash only).
• Google Ads data: account, campaign, and performance data you retrieve through the Tool. This data is processed for display and analysis and is not stored permanently.
• Log data: executed changes are logged with email address, affected account, action, and timestamp (audit log, for evidence and security purposes). Technical server logs are also generated.
• Usage data: which functions you use and how often, aggregated per day and per account holder. Used for cost control, capacity planning, product development and pricing. No campaign content, search terms or customer data is stored with it. Also included here is any feedback you submit.
• Session cookie: a technically necessary, signed and encrypted session cookie is set for login. No tracking or marketing cookies are used.

3. How This App Accesses, Uses, Stores and Shares Google User Data

This application requests a single Google OAuth scope: https://www.googleapis.com/auth/adwords. It is used exclusively to let you view and manage your own Google Ads accounts, meaning the accounts your Google account is already authorized for. The app cannot reach any account Google does not already grant you.

• What we access. Through the Google Ads API: your list of accessible Google Ads accounts and their names, campaigns, ad groups, ads and ad text, keywords, search terms, negative keyword lists, budgets, bids and bidding strategies, conversion actions, audience and location settings, change history, and the performance metrics belonging to these (impressions, clicks, cost, conversions, conversion value). Through Google Sign-In: your email address and basic profile identifier, used only to identify you and to check your access.
• How we use it. Solely to provide the features you invoke: displaying and analyzing your advertising data, and preparing changes you request. Changes are always presented as a proposal first and are executed against the Google Ads API only after you explicitly confirm them.
• How we store it. Google Ads performance and campaign data is processed in memory to answer your request and is not stored permanently. What is stored is limited to: your email address, your OAuth refresh token (encrypted), a hash of your API key, a log entry for each change you execute (email, account ID, action, timestamp, result), and counts of how often you used which function. No search terms, keywords, ad text or customer data of your own clients is written to our database.
• How we share it. We do not sell Google user data, we do not use it for advertising, and we do not disclose it to third parties for their own purposes. The only onward transfer is to Anthropic (USA) and only for the AI-assisted features you actively trigger, such as writing ad copy: the campaign data needed for that specific request is transmitted, the result is returned to you, and nothing is retained there for other purposes. Server hosting is provided by Hetzner Online GmbH in Germany under a data processing agreement.
• What we never do. Google user data is not used to develop, improve or train generalized artificial intelligence or machine learning models. It is not read by humans, except where you explicitly ask for support, where it is necessary for security purposes such as investigating abuse, or where required by law.
• How you end it. You can revoke this app's access to your Google account at any time at myaccount.google.com/permissions. On revocation the stored refresh token stops working; on request or when your access ends, your stored data is deleted.

4. How We Protect Your Data

Your Google sign-in and your Google Ads data are the sensitive part of this application, and they are protected as follows:

• Everything is encrypted on the way. The application is only reachable over an encrypted connection, and browsers are instructed to refuse an unencrypted one. The connection to Google is encrypted as well.
• Your Google authorisation is encrypted where it is stored. The permission you grant at sign-in is kept in encrypted form, and the key needed to read it is not stored alongside it. Access keys are stored in a form that cannot be turned back into the original, so the database on its own is of no use to anyone.
• Not everyone can get in. There is no self-registration. Every email address is approved by hand, and that approval is checked again on every request, so withdrawing access takes effect immediately.
• Users cannot reach each other's accounts. Each request is served strictly with the permission of the person who made it. There is no shared or fallback login that could bridge between two users.
• Nothing changes by accident. New access can only read. Permission to make changes is granted separately, and even then every change is shown for approval before it runs.
• Everything is traceable. Every change that is carried out is recorded with who, what and when. If your stored authorisation is ever used outside of serving your own request, that is recorded too.
• The best protection is not keeping the data. Your Google Ads data is used to answer your request and then discarded. It is never written to our database.

The application runs on a dedicated server in Germany. Only the encrypted web entry point is reachable from the internet; the application and its database are not.

5. Purposes and Legal Bases

Processing for the provision of the Tool and its features (Art. 6(1)(b) GDPR), for access and abuse control as well as IT security including the audit log (Art. 6(1)(f) GDPR), and to comply with Google's requirements for use of the Google Ads API.

6. Recipients and Third-Country Transfers

• Hetzner Online GmbH (Germany) — server hosting (data processing agreement).
• Google — sign-in via Google OAuth and data retrieval through the Google Ads API. Google's privacy policy applies.
• Anthropic (USA) — for AI analyses, the campaign data required for the analysis is transmitted to the Anthropic API. Transfers are based on the EU-US Data Privacy Framework or standard contractual clauses.

No data is shared with any other third parties.

7. Retention

Access data (email, encrypted token, key hash) is stored until your access ends; it is then deleted or revoked. Audit logs are retained for evidence purposes as long as required. Usage data is deleted automatically after 24 months. Google Ads data retrieved through the Tool is not stored permanently.

8. Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests (Art. 15–21 GDPR). You may also lodge a complaint with a data protection supervisory authority. You can revoke the access granted via Google at any time at myaccount.google.com/permissions.

9. Changes to This Policy

If we change how this application accesses, uses, stores or shares Google user data, this policy is updated and the date above changes. Where the change is material, users on the allowlist are notified by email at the address they signed in with, before the change takes effect.

10. Google API Services

The use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained through Google APIs is used only to provide or improve the user-facing features that are prominently visible in this application; it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; it is not used for advertising purposes; it is not sold; and it is not used to develop, improve or train generalized AI or ML models. No humans read this data except with your explicit consent for support, for security purposes, or where required by law.