Uplify Ads Assistant

Privacy Policy

In short: Uplify Ads Assistant reads your Google accounts (Google Ads, Merchant Center, Google Analytics 4, Search Console) to show you audits and proposals. Changes are written to your accounts only after you have approved that specific change. We do not sell your data, do not share it for advertising, and do not use it to train models. You can disconnect access and delete all your data from the cabinet at any time.

1. Data we receive

• Google Ads (…/auth/adwords): campaigns, ad groups, keywords and search terms, budgets, conversions, placements, geo settings, asset groups, change history and performance metrics.
• Merchant Center (…/auth/content): product statuses, disapproval reasons, feed diagnostics, product attributes.
• Google Analytics 4 and Search Console (read-only scopes): traffic sources, channels, conversions, queries, clicks, impressions.
• Site speed: public PageSpeed Insights results for your website address.
• Account data: email, password hash (bcrypt), company name (optional).
• Google OAuth tokens — stored encrypted only (a dedicated application key).
• Payments: the fact and amount of a payment, plan and period. We never receive or store card details — they are handled by the payment provider WayForPay.
• Telegram (optional): chat identifier and connection time, used to deliver critical alerts after you explicitly connect the bot.
• Support messages and technical logs (sign-ins, syncs, applied changes, errors).

Google data may be stored temporarily in the raw form needed for synchronisation and in derived form: account snapshots, calculated metrics, findings, audits, recommendations and logs of approved actions. These data remain linked to your account. We do not use them to create cross-customer profiles, advertising audiences, benchmarks, or anonymised or aggregated datasets for sale, advertising or model training.

2. How we use the data

To build your account snapshot, deterministic audit and proposals, visible only to you. Minimised data is sent to Anthropic for text explanations, audit summaries and generated product copy; under the provider's terms it is not used to train models. Service emails are delivered via Resend; payments are processed by WayForPay. If you connect alerts, their text is delivered through Telegram. Raw and derived Google data is used only for the features you request and see in your account. We do not sell data, do not share it for advertising, and do not combine it with other users' data.

3. Writes to your accounts

The service can change your Google Ads and Merchant Center — only the changes you approved individually. In Merchant Center, corrections are written into a separate supplemental data source created by the service; your primary feed is untouched, and price, availability, link and item id are never modified. Every applied change is logged in "Actions" and most can be reverted in one click. When you connect Merchant Center, the service registers Content API access on your behalf once; this changes none of your data.

4. Our role

For your account and payment data the operator acts as controller. For data obtained from the Google accounts you connect, the operator acts on your instructions and on your behalf (as processor), solely to provide the features you see in the cabinet.

5. Google API compliance

Our use and transfer of raw or derived information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: data is used solely to provide user-facing features, is not transferred to third parties other than the subprocessors listed below, is not sold, is not used for advertising, and is not used to train generalised AI models. The service does not request Google Workspace or Google Photos scopes and does not use Google API data to develop, improve or train generalised AI or machine-learning models.

6. Sharing, transfer and disclosure of Google user data

We share, transfer or disclose raw or derived Google user data only as necessary to provide, secure and support Uplify Ads Assistant, or when required by law. The recipients, data and purposes are:

• Hetzner Online GmbH (Germany, EU) — application, database and backup hosting. Raw and derived Google user data and encrypted OAuth tokens may be stored on this infrastructure.
• Anthropic PBC — only minimised metrics, excerpts and findings needed to generate the text explanations, audit summaries and product copy you request. OAuth tokens, passwords and Google account credentials are never disclosed to Anthropic.
• Resend — the email address and content necessary to deliver transactional messages. OAuth tokens are never disclosed to Resend; if a service message contains a limited Google-derived finding, only that message content is transmitted.
• Telegram — only after you explicitly connect the bot: the chat identifier and alert text, which may contain a limited Google-derived finding.
• Authorised personnel or contractors — only on a need-to-know basis, under confidentiality obligations, when you authorise review of a specific support case or access is necessary to investigate a security incident.
• Public authorities — only when disclosure is required by applicable law.

WayForPay receives billing and payment information only and does not receive Google user data. We do not disclose Google user data to other customers or to the public. Service providers may process it only on our instructions for the purposes listed above and may not use it for their own advertising or to train generalised AI or machine-learning models.

7. Storage and security

Google user data and encrypted OAuth tokens are hosted on Hetzner servers in the European Union (Germany).

Data in transit between your browser and the service is protected by HTTPS/TLS. Google OAuth tokens are encrypted at rest with a dedicated application key. Account-scoped authorisation isolates each customer's data. Employees and contractors do not read Google data unless you affirmatively authorise review of a specific support case, or access is necessary to investigate a security incident or comply with applicable law.

8. Retention and deletion

Disconnecting a Google account asks Google to revoke the token, deletes the stored OAuth credentials on our side and stops syncing. Existing snapshots, audits, recommendations and action logs remain in your product account so you can access its history until you delete the account or request deletion. Deleting the account ("Profile → Delete account and all data", password-confirmed) irreversibly deletes your product data, including raw and derived Google data, snapshots, audits, proposals, tokens, support messages and product logs. Security logs and records we must keep by law (including payment records) are retained only for the applicable statutory period. The same deletion can be requested at hello@uplify.agency — we act within 30 days.

9. Your rights

You have the right to access, correct, delete and object to the processing of your data: hello@uplify.agency.

10. Changes

We will announce material changes on this page and/or by email. The effective date is shown at the top.