Privacy Policy

1. Controller

The controller is Adstrateo, a sole trader under the French micro-enterprise scheme, identified in the Legal Notice. To exercise your rights: contact@adstrateo.com or +33 6 37 12 77 06.

2. Data we process

• Account: email, profile name, identifier, sign-in method, language and preferences.
• Projects: URL, brief, objective, budget, market, analysed public pages, generated campaigns and history.
• Google Ads: authorised account identifiers and names, encrypted OAuth authorisation, campaigns, ad groups, ads, assets, keywords, search terms, products, recommendations, performance, conversion actions and settings required for requested features.
• Management: selected accounts, strategy profile, previews and action history, monitoring snapshots, reports and Keyword Planner ideas.
• Billing: Stripe customer and subscription identifiers, plan, status and credits. Adstrateo does not store full card numbers.
• Operations: support requests, product events, generation durations, error logs, request identifiers and anti-abuse fingerprints.

3. Purposes and legal bases

Data is used to create and secure accounts, provide campaign generation and Google Ads management, save projects, manage quotas and payments, answer requests and diagnose incidents. Core processing relies on performance of the contract or pre-contractual steps; security and technical improvement on legitimate interests; billing on legal obligations. Google Ads access also relies on the user’s OAuth authorisation, which can be revoked at any time.

4. Google Ads and user control

Adstrateo uses Google data only for the visible features requested by users: reading performance, diagnostics, generation and controlled application of actions. It is not sold or used for targeted advertising, credit, or profiling unrelated to the service.

No Google Ads mutation is made without a preview and explicit confirmation. A campaign created by Adstrateo remains paused. Users can disconnect Google Ads in their account and revoke access from their Google Account permissions.

Adstrateo’s use of data received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

5. Website analysis and artificial intelligence

Adstrateo explores public pages on the domain supplied by the user and observes detected technical restrictions. Relevant content, the brief and required settings are sent to Google’s model provider to produce the requested campaign or analysis. Do not include sensitive or confidential data in a brief.

6. Providers and transfers

The service relies in particular on Supabase (database and authentication, main project in the Paris region), Vercel (hosting, execution and technical measurement), Stripe (payments) and Google (Google Ads, OAuth and assisted generation). Some data may be processed outside the EEA depending on service location, under the providers’ contractual mechanisms and safeguards.

7. Recipients and human access

Data is accessible to required providers and, on a limited basis, to authorised people when the user requests support, a security incident must be handled, or the law requires it. Users managing a client account must have the required authority.

8. Retention

• account, projects and management data: for the relationship, then deleted on request subject to legal obligations and technical backups;
• Google Ads authorisation: until disconnection, revocation or account deletion;
• long-term inactive accounts: reviewed after two years of inactivity;
• anti-abuse fingerprints: no more than thirty days after last use;
• accounting records: for the statutory period; technical logs: for the limited time required for security and incident handling.

9. Cookies and audience measurement

Adstrateo uses cookies strictly necessary for login, OAuth security, account recovery and language. Adstrateo sets no advertising cookies. Vercel provides audience and performance measurement without advertising cookies. Google and Stripe pages apply their own policies.

10. Your rights

You may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You can delete your account in Settings after cancelling an active subscription. You may also complain to the French CNIL or your local supervisory authority.

11. Automated decisions and security

Adstrateo makes no solely automated decision producing legal or similarly significant effects on users. Recommendations remain decision aids and mutations require human confirmation. Security measures include encryption in transit, encryption of Google Ads tokens at rest, secure sessions, per-user access controls, RLS policies and logs that exclude passwords and secrets.