AdAce Ads
This policy explains what data AdAce Ads at https://ads.adace.website processes, why,
who receives it and how long it is kept. The data controller is FOP Verbovetskyi Mykhailo Ivanovych, doing business as Ad Ace Agency. The operator's representative is Mykhailo Verbovetskyi, founder.
The service helps advertising agencies and advertisers manage ads on Google Ads, Meta, LinkedIn, TikTok, Microsoft Advertising, Snapchat Ads, Reddit Ads and ChatGPT Ads: it shows performance, checks website tracking, prepares change proposals and executes approved changes.
1. Account and sign-in
| What | Why |
|---|---|
| Email address, name | sign-up, sign-in, team invitations, service emails |
| Password hash; encrypted second-factor secret if enabled | sign-in verification; the password itself is not stored |
| Technical session cookie | keeping you signed in; not an advertising cookie |
| Technical browser mark (cookie adace_dev, a random value; we store only its hash) | protecting the free plan from abuse: free workspaces from one browser share the same ad platform and ad account limits; not used for advertising and not shared with third parties |
| Hashed IP address and email in an attempt counter (up to 10 minutes) | protection against brute force and abuse |
| Business description from the “Starting plan” form (what you sell, where, goal, budget, website — no names or contacts) and the resulting plan; the plan secret is stored only as a hash, the browser keeps its ID and secret (localStorage); hashed IP address in a request counter (up to one day) | to prepare a first ad plan with an AI model and show it in your workspace after sign-up; an unclaimed plan is deleted after 7 days |
| Activity log: who did what and when | accountability for ad changes and security |
| Payment records: Stripe customer and subscription identifiers, plan, invoice and payment status | paid plans; card details are entered on Stripe's page and never reach the service |
Protecting the free plan (see the Terms of Use): technical signals — the same browser mark, the same irreversible fingerprints of a Google or Meta sign-in and of ad accounts (section 2) — are compared between free workspaces to detect attempts to get around plan limits. Refusals due to plan limits are recorded in the activity log without personal data (only the kind of refusal and the platform).
The service has no third-party analytics or advertising identifiers. Our own website visit statistics use no cookies: a random tab session number, pages viewed and buttons clicked, the referral source (utm or click tags), device class, browser language and country. The country is looked up from the IP address in a database on our server (IP Geolocation by DB-IP); the address itself is not stored. Records are deleted after 90 days.
We may link the referral source on ads.adace.website to your account during registration. The temporary link record is valid for up to 10 minutes and is deleted after use or expiry. Sanitized source information is retained for up to 90 days to analyze user acquisition. No cross-site tracking is used for this purpose.
2. Ad platform data (Google Ads, Meta, LinkedIn, TikTok, Microsoft Advertising, Snapchat Ads, Reddit Ads, ChatGPT Ads)
Amazon Ads is in preparation and is not offered as an available connection. Current channel capabilities and limits are listed in the integration matrix.
An ad account is connected through the platform's official consent screen; the service never asks for or receives ad account passwords. The exception is ChatGPT Ads: OpenAI has no consent screen, so the workspace owner or an admin pastes an Advertiser API key they created in Ads Manager for a single ad account.
| What | How it is used |
|---|---|
| Platform access tokens | stored encrypted; never written to logs or shown on screen |
| The ChatGPT Ads account's Advertiser API key | checked with a request to OpenAI before it is saved; stored encrypted like access tokens; never shown (at most its last four characters) and never written to logs; disconnecting erases the key in the service, and the key itself is deleted in Ads Manager |
| ChatGPT Ads data: account name, currency and time zone; campaigns, ad groups and ads (titles, texts, links, images), budgets, statuses; daily impressions, clicks, spend and conversions | display, analytics, paused creation and proposals for supported budget, status, targeting and ad changes |
| List of ad accounts, names, currency, time zone | so the user can choose accounts to work with |
| Campaigns, ad sets, ads, their texts and images, budgets, statuses, audience settings | display, analysis and change proposals |
| Daily metrics, search terms, conversion actions and the status of supported pixels and tags | analytics for the agency and its client, wasted-spend detection |
| Irreversible fingerprints of Meta and Google user identifiers | handling Meta deauthorization and deletion requests; safe revocation of Google access; linking one person's free workspaces for plan limits; the identifiers themselves are not stored |
| Irreversible ad account fingerprints (SHA-256 of the platform and ad account ID) in the activity log | plan limits: a disconnected ad account keeps its slot for 30 days, and the same ad account cannot be connected in several free workspaces |
Changes to ads. The service can change budgets and statuses of campaigns, ad sets and ads, add keywords and negative keywords, supported targeting, bids and ad text; and create campaigns, ad sets and ads paused. Available actions depend on the platform and account permissions. A change to existing ads starts as a proposal with a reason; it is executed by a human approver or — only if the workspace owner configured the client's policy that way — by the system within limits and for reversible actions only. New campaigns, ad sets and ads are created only paused, with no spend, and only by a workspace owner or admin (or the AI on their command); enabling them is again a proposal. Writes to live campaigns are enabled by the owner separately for each ad account. Every change is logged, and the state before and after the write is verified. In the dashboard, approval uses a button; an authenticator code is required when two-factor sign-in is enabled. In an AI chat over MCP, an approval code is always required for everyone.
3. Google Analytics, Search Console, Tag Manager, Klaviyo and client websites
- Google Analytics 4: list of properties; daily sessions, key events and revenue by source, medium and campaign. If the user granted edit access, the service creates a property, web stream, key event or Google Ads link on the user's command.
- Search Console: list of sites; daily clicks, impressions and positions by query and page.
- Klaviyo (read-only): account name, currency and time zone; email campaigns (name, status, send time) with aggregate metrics — recipients, delivered, opens, clicks, unsubscribes, orders and revenue. The service does not request or store individual recipient data (addresses, profiles, lists).
- Tag Manager: reading the published container configuration; changes are prepared in a separate workspace and published only after the user confirms with their password.
- Website audit: the service fetches public pages and tag scripts of websites whose addresses the user enters, to check tag installation.
- Scripts for client websites: if a client puts the service's script on their website, a tap on "Telegram", "WhatsApp", a call or email link, or a form submission becomes a lead. Meta events (Conversions API) are only forwarded to Meta and are not stored. If the advertiser enabled feedback to Microsoft Advertising and the site has measurement consent, the script loads the Microsoft UET tag (bat.bing.com) and reports the lead to it; likewise the LinkedIn Insight Tag (snap.licdn.com) when feedback to LinkedIn is enabled. For a lead the service stores technical marks only: channel, page address without parameters and its language, UTM tags, Google (gclid, gbraid, wbraid), Meta (fbc, fbp), Microsoft (msclkid), LinkedIn (li_fat_id) and Snapchat (ScCid, _scid cookie) ad click marks, time and the status set by the advertiser. The service does not store names, phone numbers, email addresses, IP addresses or browser data; the IP address is used only for rate limiting, as a hash kept for 10 minutes.
4. Google API Services User Data Policy (Limited Use)
AdAce Ads's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data (Google Ads, Analytics, Search Console, Tag Manager) is used only to provide user-facing features the user sees and controls in the service: displaying and analyzing performance, checking tracking, proposing and executing approved changes. Google data is not sold, not used for advertising, not transferred to third parties except as necessary for these features (see section 6), not used to train artificial intelligence models, and not read by humans unless the user explicitly agreed, it is needed for security, or the law requires it.
5. AI analyst and AI clients
In-product AI analyst. If the AI analyst is enabled in a workspace, the user's question and the data needed to answer it (for example, campaign metrics) are sent to the model provider — Anthropic — only to generate the answer. The data is not used to train models.
Claude, ChatGPT, Cursor and other AI clients (MCP). A user may connect their own AI client to the service via OAuth or an API key, choosing the workspace and permissions. The data that client requests on the user's instruction is then sent to it under the user's account, and its further processing is governed by that client's terms. Access can be revoked at any time in the app under “Settings → AI clients”.
Support chat. After you confirm and send your first message, we store your email address and the conversation history in your workspace: your messages, AI assistant replies, service messages and manager replies. Text that resembles a secret is masked before storage in the service database. To produce an AI reply, we send Anthropic your latest question together with selected excerpts from product guidance. The assistant does not automatically access your ad account data and has no tools to change ads, plans, bonuses or payments. If you type client information into the chat, that text is processed too.
We send chat messages to a separate topic in a private Telegram support group; the topic name is based on your email address when the conversation began. Delivery can be delayed; its status is shown in the chat. Group members can see the history. Any current member of the private support group can reply to you through the service from the corresponding Telegram topic after their membership is verified. The chat always shows an AI assistant label; after handoff, it shows that you are waiting for a manager or receiving a manager reply. The AI assistant pauses when a manager takes over.
6. Who receives data
- Advertising and analytics platforms (Google, Meta, LinkedIn, TikTok, Microsoft, Snapchat, Reddit, OpenAI — ChatGPT Ads, Amazon) — API requests on the user's behalf.
- The server hosting provider; the email provider for service emails (sign-in, invitations, notifications).
- Anthropic — if the AI analyst is enabled or you ask the support chat AI assistant a question (section 5).
- Telegram and members of the private support group — a copy of the chat history in a topic named based on your email address (section 5).
- Stripe — payment processing for paid plans (card, invoices, refunds).
- AI clients the user connected (section 5); viewers of public dashboards if the user shared a link (links can be revoked).
Data is not sold and not used for advertising.
7. Retention and deletion
Data is kept while the account and the client relationship are active. Disconnecting an ad account erases the stored access tokens and asks the platform to revoke the permission; for Google this happens together with the last connection of the same Google account, so other connections keep working.
A Meta user can remove the app in Facebook settings or request data deletion: Meta notifies the service and the related
data is erased automatically; a confirmation code is issued, and the request status is shown at
https://ads.adace.website/privacy/meta/deletion. We delete
your account, imported performance data and other related data on request to info@adace.website.
Ad account performance belongs to the advertiser: an individual's request does not erase a business's ad statistics — contact the advertiser for that.
Leads from client websites are deleted automatically after 90 days.
The support chat history policy provides for 90 days after the last message. After that period, the history enters a separate review for cleanup; automatic deletion is not currently performed. Removing a record from the service database does not itself remove a copy already sent to Telegram. Telegram cleanup requires a separate procedure; the expiry period for backup copies has not yet been determined. Contact info@adace.website about access to or deletion of the chat history.
8. Security
HTTPS only. Access tokens are encrypted with a key stored separately from the database. Each workspace's and client's data is isolated at the database level; background processes run with separate, restricted permissions; actions are logged.
9. Your rights
You can ask what data about you is stored, request correction or deletion, restrict processing or withdraw the permissions you granted. Write to info@adace.website; we respond within 30 days.
10. Changes
If data processing changes, this text changes too and the date at the top is updated. The Ukrainian version prevails in case of discrepancies.