Privacy Statement
1. Who we are
AdsOtter (“AdsOtter”, “we”, “us”) provides a software platform that helps businesses plan, launch, manage and optimise online advertising across connected advertising platforms. This Privacy Statement explains how we handle personal data when you visit adsotter.com, create an account, or use the AdsOtter application at app.adsotter.com (together, the “Service”).
You can reach us about privacy at privacy@adsotter.com. The operating legal entity and its registration details are published here once incorporation is complete and can be requested in the meantime via that address.
2. Controller and processor
AdsOtter plays two roles, depending on the data:
- As controller — for the data of our own customers and their users: the account and workspace information you give us, billing details, and technical usage data. This statement describes that processing.
- As processor — for the personal data of your customers or website visitors that you route through the Service (for example conversion events and click identifiers you send us, or data we retrieve from your advertising accounts on your behalf). You remain the controller of that data; we process it only on your documented instructions under a data processing agreement (see section 12).
3. The data we process
a. Account & workspace data
Your name and email address (via Google sign-in), the workspaces you create, the colleagues you invite, and their roles.
b. Connected advertising accounts
When you connect a Google, Microsoft or Meta advertising account, we store the identifiers of that account and the access/authorisation token needed to act on it. Tokens and credentials are encrypted at rest (AES-256-GCM) and are never shared with other customers.
c. Advertising & performance data
On your instruction we retrieve campaign, ad group, keyword and search-term data together with metrics such as impressions, clicks, spend and conversions from your connected platforms, so we can report and advise on them.
d. Conversion & measurement data you provide
If you use our conversion tracking, you may send us conversion events, values, and click identifiers (such as gclid, msclkid or fbclid). This data can include personal data of your end-users; for it we act as your processor.
e. Research data sources
Keyword and market data from sources you connect (e.g. Ahrefs, Google Search Console) or from a shared research source (DataForSEO), used to support keyword research.
f. Usage & technical data
Server logs, IP address, and an append-only audit log of the actions taken in your workspace (who changed what, and when) — kept for security and accountability.
g. Cookies
The application uses strictly necessary cookies to keep you signed in and secure. The marketing site (adsotter.com) does not set advertising or tracking cookies.
4. Google user data
When you connect a Google Ads account, you sign in with Google and grant AdsOtter two permissions (OAuth scopes). This section describes exactly how AdsOtter accesses, uses, stores and shares the data it receives from Google APIs (“Google user data”).
a. What we access
- Google Ads API (
https://www.googleapis.com/auth/adwords) — the campaigns, ad groups, ads, keywords, budgets, bid strategies, conversion actions, search terms and performance metrics (such as impressions, clicks, cost and conversions) of the Google Ads account you connect, so AdsOtter can show them, advise on them and carry out the changes you approve. - Data Manager API (
https://www.googleapis.com/auth/datamanager) — used only to send conversions from your own website to your own Google Ads account, and to read back whether Google processed them. For each conversion we send the Google click identifier (gclid), the time of the conversion, a transaction id, an optional value and currency, and the consent status recorded for that visitor.
b. How we use it
Google user data is used only to provide the features of AdsOtter that you use: showing your campaigns and their results, giving advice, making the changes you approve (for example pausing a keyword or changing a budget) or that an automation rule you switched on is allowed to make, and reporting conversions to your Google Ads account so its bidding can learn which ads lead to results. We do not use Google user data for advertising, to build profiles of people, or to develop, improve or train generalised artificial-intelligence or machine-learning models.
c. How we store and protect it
Access tokens are encrypted at rest (AES-256-GCM). Campaign data and metrics are stored in our database with strict per-customer separation and are only visible to the members of the workspace that connected the account. All traffic is encrypted in transit (TLS), and access to production data is limited and logged.
d. How we share it
We do not sell Google user data. We share it only with Google itself (to carry out your instructions), with our hosting provider, and — to write ad text suggestions when you ask for them — with Anthropic, which does not use that data to train its models. We do not transfer Google user data to any other party unless the law requires it. People at AdsOtter only look at it when you ask us for support, when it is needed for security, or when the law requires it.
e. Retention and deletion
We keep Google user data while the Google Ads account is connected to AdsOtter. When you disconnect the account in AdsOtter, we stop accessing it straight away. You can also revoke AdsOtter’s access at any time at myaccount.google.com/permissions, after which the stored token no longer works. To have the stored token and the data retrieved from the account deleted, email privacy@adsotter.com; we delete it within 30 days.
f. Limited Use
AdsOtter’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Why we process data, and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Acting on your connected advertising accounts on your instruction | Contract / your instructions as processor |
| Securing the Service, preventing abuse, keeping audit logs | Legitimate interest (Art. 6(1)(f)) |
| Billing and administration | Contract and legal obligation (Art. 6(1)(c)) |
| Optional communications you opt in to | Consent (Art. 6(1)(a)) |
6. Sharing and subprocessors
We do not sell personal data. We share data only with service providers that help us run the Service, and with the advertising platforms you instruct us to act on. Our main recipients are:
- Google, Microsoft and Meta — the advertising platforms you connect; we send and retrieve data there on your behalf.
- DataForSEO, Ahrefs — keyword and market data sources.
- Anthropic — writes ad text suggestions when you ask for them; the data sent is not used to train its models.
- Infomaniak — EU hosting and backups.
- Payment and email providers, once those features are enabled.
An up-to-date list of subprocessors is available on request via privacy@adsotter.com.
7. International transfers
Your data is hosted in the EU. Some advertising platforms (Google, Microsoft, Meta) are based in the United States; where personal data is transferred to them at your instruction, that transfer relies on the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.
8. How long we keep data
We keep account and workspace data for as long as your account is active, and for a limited period afterwards to meet legal and administrative obligations. Advertising and measurement data is retained only as long as needed for reporting and optimisation. Audit-log entries are kept for accountability. You can ask us to delete your data (see section 10), subject to any legal retention duties.
9. How we protect data
We encrypt credentials at rest, enforce strict per-customer data isolation in the database, serve all traffic over TLS, and host within the EU. Access to production data is limited and logged.
10. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. To exercise these rights, contact privacy@adsotter.com. If your personal data was provided to us by an AdsOtter customer (as controller), we will refer your request to that customer. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
11. Children
The Service is intended for businesses and is not directed to individuals under the age of 16.
12. Data processing agreement
Where we act as your processor, our processing is governed by a data processing agreement (DPA) that forms part of our Terms of Use. Contact us to receive the current DPA.
13. Changes to this statement
We may update this Privacy Statement from time to time. Material changes will be announced through the Service or by email, and the “last updated” date above will change.
14. Contact
Questions about privacy? Email privacy@adsotter.com.