Privacy policy
In short. Ads Intelligence Studio is a private dashboard in which clients of Ads Intelligence see the results of their own Google Ads account. We display advertising statistics, we do not build visitor profiles, we set no advertising or analytics cookies, and we do not sell or share data with third parties for advertising purposes. Every user only sees the accounts they have been granted access to.
1. Who is responsible
This policy covers the dashboard at studio.adsintelligence.nl (the dashboard, or the service). The controller for the processing of personal data is:
- Ads Intelligence B.V.
- Damsterdiep 10, 9711 SK Groningen, the Netherlands
- Dutch Chamber of Commerce (KvK) number: 98428985
- Email: info@adsintelligence.nl
- Phone: +31 50 234 0806
We have not appointed a data protection officer. Privacy questions reach us at the address above and are handled by us directly.
2. Our two roles
Two kinds of data meet in the dashboard, and our role differs per kind.
- We are the controller for the data of the people who log in: name, email address, role and whatever they record inside the dashboard. We decide why and how that data is processed.
- We are a processor for the advertising data from a client's Google Ads account. That data belongs to the client. We process it on their instructions, under the service agreement and the accompanying data processing agreement, and not for our own purposes.
3. What data we process
3.1 Dashboard user data
- Name and email address, as provided when the account is created.
- Role (administrator, specialist or client user) and which clients the person may access.
- Authentication metadata: when the account was created and confirmed, and the last sign-in. We do not use passwords; signing in happens through a one time link sent by email.
3.2 Content added by users
Specialists and client users can record content in the dashboard: notes on experiments, meeting notes, tasks, monthly targets and background information about the business, including uploaded files. That content may contain personal data if a user puts it there. We do not mine that content for any purpose other than showing it to the people who have access to the same client.
3.3 Advertising and performance data
Through the Google Ads API and the Google Merchant API we retrieve, per client account: campaigns, ad groups, keywords, search terms, ads, landing pages, audience lists, products and their statistics such as impressions, clicks, cost and conversions. This is business data at its core. Two exceptions are worth naming:
- Search terms are typed by people. Very occasionally they contain something personal, such as a name. Google delivers these terms in aggregate, without any data about the person behind them, and we only show them to the client and to the specialist managing the account.
- Audience lists are shown by name and size only. We do not retrieve customer lists, email addresses or any other data about individuals.
All access to Google is read only. The dashboard changes nothing in a Google Ads account: no bids, no budgets, no ads.
3.4 Technical data
- Server logs from the hosting platform and the database, containing IP address, timestamp, requested page and error messages. We use these to resolve incidents and detect abuse.
- Cookies. Functional only: a cookie from the authentication service so you stay signed in, and a cookie remembering which client you last had open. There are no analytics, advertising or tracking cookies on the dashboard, and therefore no cookie banner.
4. Why we process this data
| Purpose | Data | Legal basis |
|---|---|---|
| Granting access to the dashboard and showing the right client | Name, email address, role, access rights | Performance of the contract with the client, and our legitimate interest in a working service |
| Reporting on the client's advertising results | Advertising and performance data, notes and targets | Performance of the contract, with the client acting as controller |
| Sending sign-in links | Email address | Performance of the contract |
| Security, incident resolution and preventing abuse | Technical logs, IP address | Legitimate interest in a secure and working service |
| Meeting legal obligations, for example bookkeeping | The data prescribed by law | Legal obligation |
We do not use the data for anything beyond the above. No profiling, no resale, no advertising aimed at dashboard visitors.
5. Google Ads and Merchant Center
The dashboard uses the Google Ads API and the Google Merchant API to retrieve statistics for the accounts inside our manager account (MCC). The following applies:
- We use our own authorised access to those accounts. Dashboard users do not sign in with a Google account and we do not request access to their Google user data.
- Data from different clients is never combined, benchmarked against each other or disclosed to third parties. Each client sees only their own account.
- We do not sell Google Ads data and do not use it to build other products or models.
- We comply with the Google Ads API Terms and Conditions, the Google Ads API policies and, where applicable, the Google API Services User Data Policy, including its Limited Use requirements. Data we obtain through Google is used solely to provide the user facing features visible in the dashboard.
- Ads Intelligence Studio is a product of Ads Intelligence B.V. It is not a Google product and Google is not responsible for its content.
6. Who can see the data
Within our company: only staff who manage or support the account.
At the client: only the people the client or we have invited. A client user sees their own accounts only.
We also engage the following processors:
| Party | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of the dashboard | United States and EU, under standard contractual clauses |
| Supabase | Database and authentication | European Union (Ireland) |
| Google Ireland Ltd. and Google LLC | Google Ads API and Merchant API | EU and United States, under Google's terms |
| Google Workspace (Google Ireland Ltd.) | Delivery of sign-in links, sent from our own domain | EU, with storage by Google also outside the EU |
Data processing agreements are in place with these parties. Beyond that, we only disclose data where the law requires us to.
7. Transfers outside the European Economic Area
Some of the parties above are established in the United States or process data there. Such transfers take place under the European Commission's standard contractual clauses, together with the safeguards those parties provide. Where possible we choose processing within the EU.
8. How long we keep data
- User accounts: for as long as access is needed. When the engagement ends, or on request, we deactivate the account and delete it afterwards.
- Advertising data in the daily cache: three years of history, on a rolling basis. Older days drop out automatically. When an engagement ends we delete that account's data on the client's request, and otherwise within six months.
- Notes, tasks, targets and uploaded files: for as long as the client is a client, and deleted on request afterwards.
- Technical logs: we do not store these ourselves. They live at our hosting and database providers and are cleared there automatically: within an hour at the hosting provider and within a day at the database provider. If we set something aside to investigate an incident, we delete it once the issue is resolved and within six months at the latest.
9. Security
- All traffic runs over an encrypted connection (HTTPS).
- Signing in is passwordless, using a one time link to the user's own email address. There are no passwords that can leak.
- Access is granted per client and enforced on the server, including at database level. A user cannot request another client's data.
- Keys and credentials live in the secured environment settings of the hosting platform and never in the source code.
- Only the administrators who need it have access to the production environment.
Do you suspect a leak or a vulnerability? Email info@adsintelligence.nl. We respond as quickly as possible and report data breaches to the Dutch Data Protection Authority and to the people involved where required.
10. Automated decision making
The dashboard shows analyses and recommendations, for example about budget, keywords or landing pages. These are aids. No decisions are taken based solely on automated processing that produce legal effects for individuals. A human decides what happens with a recommendation.
11. Your rights
You have the right to:
- access your data;
- have incorrect data rectified;
- have data erased;
- have processing restricted;
- object to processing based on legitimate interest;
- receive your data in a common file format (data portability);
- withdraw consent, where processing is based on it.
Send your request to info@adsintelligence.nl. We respond within one month. If your request concerns data we process as a processor on behalf of a client, we will refer you to that client, as they are the controller.
If you are unhappy with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.
12. Whether providing data is required
To gain access to the dashboard we need at least an email address, because the sign-in link is sent there. Without it we cannot create an account and therefore cannot grant access.
13. Changes
We update this policy when the dashboard or the applicable rules give reason to. The date at the top shows when that last happened. We notify dashboard users of significant changes.