Privacy Policy

1. Data Controller

Adsby B.V. ("the Company," "we," "us," or "our") (Herengracht 420, 1017 CE Amsterdam, the Netherlands) is the data controller for personal data processed through goadsby.org. You can reach us for any data-protection matter, including to exercise the rights described below, at [email protected].

Adsby provides AI-managed Google Ads services to small and medium-sized businesses. To operate this service we connect to customers' Google Ads accounts via the Google Ads API (OAuth 2.0) and process campaign, keyword, conversion, and billing data on their behalf. This privacy policy explains how we handle personal data in the course of providing that service, operating our website, and communicating with prospective customers.

2. Personal Data We Process

We process the following categories of personal data depending on how you interact with Adsby:

• Account and contact data: name, email address, phone number, and business name provided when you register or contact us;
• Google Ads account data: campaign configuration, keyword lists, ad group structure, conversion event data, quality scores, and historical spend figures accessed via the Google Ads API after you grant OAuth authorisation;
• Billing data: subscription payment records and invoicing details (processed via our payment processor; we do not store full card numbers);
• Communications content: messages and enquiries you send to us by email or through the contact form;
• Technical and usage data: IP address, browser type, operating system, pages visited, and session identifiers collected automatically when you visit goadsby.org;
• Analytics data: aggregated usage patterns and feature-interaction data, collected only with your prior consent.

We do not collect special-category (sensitive) personal data as defined in Article 9 GDPR.

3. Purposes and Legal Bases (Article 6 GDPR)

Where we rely on legitimate interest, we have balanced that interest against your rights and freedoms. You may object to any processing based on legitimate interest at any time (see Section 7).

4. Google Ads API Data Handling

When you connect your Google Ads account to Adsby using OAuth 2.0, we receive read access to your campaign data and write access limited to campaign configuration changes you authorise. Specifically:

• We read campaign performance metrics, keyword data, conversion data, and account structure to drive our AI optimisation engine;
• We write keyword changes, bid adjustments, and ad group modifications as part of the automated campaign management service;
• We do not access your Google billing instruments or make changes to your payment methods;
• Campaign data retrieved via the Google Ads API is used solely to operate the Adsby service for your account. We do not use this data to train shared AI models without your explicit written consent;
• You may revoke OAuth access at any time through your Google Account settings. Revocation terminates active campaign management; we will delete your campaign data from our systems within 30 days of revocation.

Our use of the Google Ads API is subject to Google's API Services User Data Policy.

5. Recipients and International Transfers

Personal data is shared only with processors acting on our behalf under Article 28 GDPR data-processing agreements. Current categories of processors include:

• Cloud infrastructure and hosting providers (servers located in the EU/EEA);
• Payment processor (for subscription billing);
• Transactional email delivery service;
• Analytics platform (only activated after your consent).

Where data is transferred to a processor outside the EU/EEA, we rely on Standard Contractual Clauses (Article 46 GDPR) and carry out transfer impact assessments as required following the Schrems II ruling. We do not sell personal data to third parties.

6. Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Account data is retained for the duration of your subscription and for 12 months after termination (to allow account reactivation and resolve disputes);
• Google Ads campaign data is deleted within 30 days of OAuth revocation or account closure;
• Billing records are retained for 7 years to comply with Dutch accounting requirements (Burgerlijk Wetboek Boek 2, Article 10);
• Contact form submissions are retained for 24 months after last contact;
• Server access logs are retained for 90 days.

7. Your GDPR Rights

Under the General Data Protection Regulation you have the following rights with respect to your personal data:

• Right of access (Art. 15) - obtain confirmation that we process your data and receive a copy;
• Right to rectification (Art. 16) - have inaccurate data corrected without undue delay;
• Right to erasure (Art. 17) - request deletion of your personal data, subject to retention obligations under applicable law;
• Right to restriction of processing (Art. 18) - limit how we use your data in certain circumstances;
• Right to data portability (Art. 20) - receive your data in a structured, machine-readable format and transfer it to another controller;
• Right to object (Art. 21) - object to processing based on legitimate interest, including direct marketing, without further conditions;
• Right not to be subject to solely automated decisions (Art. 22) - we do not engage in automated individual decision-making that produces legal or similarly significant effects.

To exercise any of these rights, email us at [email protected]. We will respond within one calendar month; for complex or numerous requests, we may extend by a further two months with notice.

8. Right to Lodge a Complaint

If you believe we are processing your personal data in violation of the GDPR, you have the right to lodge a complaint with the Dutch supervisory authority:

You may also lodge a complaint with the supervisory authority of any EU member state where you reside or work. A full list of EU/EEA authorities is available at edpb.europa.eu.

9. Cookies

Our website uses strictly necessary cookies to operate and, with your prior consent, analytics cookies to measure usage. Non-essential cookies are not set until you accept via our cookie banner. See our Cookie Policy for full details. You can change your cookie preferences at any time via the "Cookie preferences" link in the footer.

10. Security

We implement technical and organisational measures appropriate to the risk of processing, including TLS encryption for data in transit, encrypted storage for sensitive data at rest, role-based access controls, and regular security reviews. OAuth tokens for Google Ads API access are stored encrypted and scoped to the minimum permissions required to operate the service.

11. Changes to This Policy

We may update this privacy policy when our data processing activities change. Material changes will be reflected by an updated "Last updated" date at the top of this page. Where required under the GDPR (for example, where we introduce a new purpose requiring consent), we will request renewed consent before the change takes effect.

12. Contact