Privacy Policy

1. Controller

The controller is Adstrateo, a sole trader under the French micro-enterprise scheme, identified in the Legal Notice. To exercise your rights: contact@adstrateo.com or +33 6 37 12 77 06.

2. Data we process

• Account: email, profile name, identifier, sign-in method, language and preferences.
• Projects: URL, brief, objective, budget, market, analysed public pages, generated campaigns and history.
• Google Ads: authorised account identifiers and names, encrypted OAuth authorisation, campaigns, ad groups, ads, assets, keywords, search terms, products, recommendations, performance, conversion actions and settings required for requested features.
• Management: selected accounts, strategy profile, previews and action history, monitoring snapshots, reports and Keyword Planner ideas.
• Billing: Stripe customer and subscription identifiers, plan, status and credits. Adstrateo does not store full card numbers.
• Operations and legal requests: support requests, withdrawal requests, supplied contact details, acknowledgements, product events, generation durations, error logs, request identifiers and anti-abuse fingerprints.

3. Purposes and legal bases

Data is used to create and secure accounts, provide campaign generation and Google Ads management, save projects, manage quotas and payments, answer requests and diagnose incidents. Core processing relies on performance of the contract or pre-contractual steps; security and technical improvement on legitimate interests; billing on legal obligations. Google Ads access also relies on the user’s OAuth authorisation, which can be revoked at any time.

4. Google Ads and user control

Adstrateo uses Google data only for the visible features requested by users: reading performance, diagnostics, generation and controlled application of actions. It is not sold or used for targeted advertising, credit, or profiling unrelated to the service.

No Google Ads mutation is made without a preview and explicit confirmation. A campaign created by Adstrateo remains paused. Users can disconnect Google Ads in their account and revoke access from their Google Account permissions.

Adstrateo’s use of data received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

5. Sharing, transfer and disclosure of Google user data

With the user’s OAuth authorisation, Adstrateo shares or transfers only the Google user data strictly necessary to the technical providers listed below, acting to provide the visible features requested in Adstrateo:

• Supabase: secure storage of the encrypted OAuth authorisation, linked Google Ads account identifiers, settings, caches, reports, alerts and action histories required to operate the account.
• Vercel: hosting and execution of the application and its server; transient processing of Google Ads requests and limited technical logs required for security and error diagnosis.
• Google LLC: exchange of data with the Google Ads API to read the account and send only changes confirmed by the user. When the user requests assisted generation or analysis, the relevant and minimal Google Ads data and supplied context are sent to Google Gemini to produce that feature.
• Resend: delivery of functional emails requested or enabled by the user. Only the recipient address and necessary content are transferred; that content may include an account or campaign name and a Google Ads alert summary.

These providers receive the data only to deliver or secure Adstrateo. Adstrateo does not sell Google user data, transfer it to data brokers or advertising platforms, or use it for advertising targeting, independent profiling, credit assessment or training generalised artificial-intelligence models. Outside these providers, Google user data is disclosed only when the user requests or consents to it, when necessary to handle a security incident, or when required by law.

6. Website analysis and artificial intelligence

Adstrateo explores public pages on the domain supplied by the user and observes detected technical restrictions. Relevant content, the brief and, where required by the requested feature, the minimum necessary Google Ads data are sent to Google Gemini to produce the requested campaign or analysis. Adstrateo does not use this data to train a generalised artificial-intelligence model. Do not include sensitive or confidential data in a brief.

7. Other providers and international transfers

The service also relies on Stripe for payments. Stripe does not receive Google Ads data as part of payment processing. Some data may be processed outside the EEA depending on service location, under the contractual mechanisms and safeguards provided by the relevant providers.

8. Recipients and human access

Data is accessible to required providers and, on a limited basis, to authorised people when the user requests support, a security incident must be handled, or the law requires it. No person reviews Google Ads data for any other purpose. Users managing a client account must have the required authority.

9. Retention

• account, projects and management data: for the relationship, then deleted on request subject to legal obligations and technical backups;
• Google Ads authorisation: until disconnection, revocation or account deletion;
• long-term inactive accounts: reviewed after two years of inactivity;
• anti-abuse fingerprints: no more than thirty days after last use;
• support and withdrawal requests: for the time required to process them, then for the period necessary for evidence and applicable legal obligations;
• accounting records: for the statutory period; technical logs: for the limited time required for security and incident handling.

10. Cookies and audience measurement

Adstrateo uses cookies strictly necessary for login, OAuth security, account recovery and language. Adstrateo sets no advertising cookies. Vercel provides audience and performance measurement without advertising cookies. Google and Stripe pages apply their own policies.

11. Your rights

You may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You can delete your account in Settings after cancelling an active subscription. You may also complain to the French CNIL or your local supervisory authority.

12. Automated decisions and security

Adstrateo makes no solely automated decision producing legal or similarly significant effects on users. Recommendations remain decision aids and mutations require human confirmation. Security measures include encryption in transit, encryption of Google Ads tokens at rest, secure sessions, per-user access controls, RLS policies and logs that exclude passwords and secrets.