Privacy Policy
Last updated 6 November 2026
This policy explains what personal data Pocket PPC (“we”, “us”) collects, why, and what rights you have. It is written for the EU General Data Protection Regulation (GDPR) and applies to everyone who uses the website, the dashboard, or the Telegram and Slack bots.
1. Who is responsible
Controller: [COMPANY NAME], [REGISTERED ADDRESS, COUNTRY]. Privacy contact: [email protected]. For the Google Ads data you pull through Pocket PPC, you are the controller and we process it on your instructions (see section 6).
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password hash, two-factor secret, sessions, IP address, sign-in method | Create and secure your account, prevent abuse | Contract (Art. 6(1)(b)); legitimate interest in security (Art. 6(1)(f)) |
| Google account id and OAuth tokens (encrypted), list of Google Ads accounts you enable | Read your Google Ads data when you ask the agent | Contract; your explicit Google consent screen authorisation |
| Google Ads reporting data (campaigns, keywords, search terms, spend, conversions) | Answer your questions, build reports and dashboards, propose changes you confirm | Contract. Processed on your behalf (processor) |
| Chat messages, bot replies, Telegram chat id / Slack workspace and user ids | Run the conversation, keep short context, show history in the dashboard | Contract |
| Billing data: Stripe customer id, plan, invoices, VAT id, country. Card numbers are held by Stripe only | Subscriptions, invoices, tax | Contract; legal obligation (tax/accounting) |
| Usage metering (credits, tokens, cost per request) | Enforce plan limits, pricing | Contract |
| Support emails | Help you | Contract; legitimate interest |
We do not sell personal data, do not use it for advertising, and do not train AI models on it.
3. Google user data (Limited Use)
Pocket PPC’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request the adwords scope only to read and, after your confirmation, change the Google Ads accounts you enable. Tokens are stored encrypted (AES-256-GCM) and deleted immediately when you disconnect Google in Settings or delete your account. No human reads your Google data except to debug a problem you report.
4. AI processing
Your questions, the Google Ads data needed to answer them, and recent conversation context are sent to Anthropic (Claude models) to generate the answer. You are always interacting with an automated assistant, never a human agent. The assistant never changes anything in your ad account without your explicit confirmation; no decision with legal or similarly significant effect is taken automatically (GDPR Art. 22).
5. Cookies
We use only strictly necessary cookies: your sign-in session, the two-factor step, short-lived OAuth state values (10 minutes), the selected workspace and sidebar state. There are no analytics, advertising or third-party tracking cookies, so no cookie consent banner is shown. If this changes we will ask for consent first.
6. Who receives data (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Anthropic, PBC | AI model that answers your questions | USA |
| Google LLC | Sign-in, Google Ads API | USA / EU |
| Stripe, Inc. | Payments, invoices, tax | USA / EU |
| Resend, Inc. | Transactional email | USA (EU region selected) |
| Slack Technologies / Telegram FZ-LLC | Only if you connect that channel: delivering messages | USA / UAE |
| Hosting provider | Servers and encrypted backups | EU |
Transfers outside the EU/EEA rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on the European Commission’s Standard Contractual Clauses included in each provider’s data processing agreement.
7. How long we keep data
- Account data: while your account exists, then deleted within 30 days of deletion (backups expire within a further 30 days).
- Chat transcripts: 12 months, then deleted.
- Google OAuth tokens: until you disconnect or delete the account.
- Technical logs and webhook payloads: 30 days.
- Invoices and tax records: as long as tax law requires (typically 7–10 years), kept by Stripe.
8. Your rights
You can access, export, correct, delete or restrict your personal data, object to processing based on legitimate interest, and withdraw consent at any time. Export and deletion are available in Settings, or email [email protected]; we answer within 30 days. You may also lodge a complaint with your local data protection authority.
9. Security
TLS in transit, encryption of tokens and secrets at rest, hashed passwords, optional two-factor authentication, signed webhooks, tenant isolation, least-privilege API keys and regular security reviews. If a breach affects you we will inform you and the supervisory authority as the GDPR requires.
10. Children
Pocket PPC is a business tool for people aged 18 or older.
11. Changes
We will announce material changes by email or in the dashboard before they apply. The date at the top shows the current version.