Privacy Policy

Information we collect

We collect only what we need to run the Service:

• Account information. You sign in with Google. We receive the email address on that Google account and use it as your GoodLads identity through our authentication provider. We never see your Google password.
• Google Ads data. When you connect a Google Ads account, you authorize GoodLads to access that account's data through Google's APIs - including campaigns, ads, and performance metrics - so we can generate recommendations. We request only the access needed for these features.
• Changes you approve. When you approve a recommendation, we record the action so we can apply it through the Google Ads API and show it in your account history.
• Billing information. If you subscribe, Stripe collects and holds your payment details and billing address. We never see or store your card number; we see which plan you are on and whether it is paid.
• How you use the Service. We record which pages you open and which actions you take - a sign-up, a connected account, a generated idea - so we can see where the product works and where people get stuck.
• How you reached us. If you arrive from one of our ads, the ad platform puts an identifier on the link and we keep it, so we can tell which ads lead to sign-ups and which do not.
• Operational data. We keep basic logs needed to operate, secure, and troubleshoot the Service, including your IP address and browser user agent.

How we use information

We use the information above to:

• Provide the Service - generate recommendations and display your campaigns, ads, and performance.
• Apply changes you approve - and only with your explicit approval. Most changes are applied as a new ad or a Google Ads experiment; the rare few that must land directly on a live campaign are marked clearly and need a separate confirmation.
• Keep the Service secure, reliable, and working as expected.
• Communicate with you about your account and respond to support requests.
• Measure our own advertising - see “How we measure our advertising” below, which says exactly what we send and to whom.

Google user data

GoodLads's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means we access only the Google Ads data you connect and authorize; we use it solely to provide and improve the user-facing features described above; we do not sell it; we do not use it for advertising; and we do not use it to train generalized or non-personalized AI or machine-learning models. We do not share Google user data with third parties except as needed to provide the Service, to comply with the law, or in connection with a merger or acquisition, consistent with this policy.

How we store and protect data

Authentication and your account data are handled by our backend provider, Supabase. Access tokens for connected Google Ads accounts are stored securely and used only to perform the actions you authorize.

We rely on reputable infrastructure providers and industry-standard safeguards to protect data in transit and at rest. No method of storage or transmission is completely secure, but we work to protect your information and limit who can access it.

The one place your Google Ads data leaves our own infrastructure is on its way to the AI model that writes a recommendation - OpenAI or Anthropic, through their APIs, which do not train on what is sent. It goes nowhere else.

Sharing and sub-processors

We do not sell your personal information. We share data only with the service providers that help us run GoodLads, and only as needed to provide the Service:

• Google - to read Google Ads data and to apply approved changes through the Google Ads API. Separately, Google Ads receives our own advertising measurement, described below.
• Supabase - authentication and database hosting. Your account and everything the Service stores for you lives here.
• Vercel - hosting. Every request to the Service passes through it.
• OpenAI and Anthropic - to generate recommendations. The campaign, ad and performance data from the Google Ads accounts you connect is sent to whichever of these models is generating the recommendation, along with the questions you ask in the chat. It is sent through their APIs, which do not train on it. OpenAI separately receives our advertising measurement, described below; these are two different things and the recommendation data is never part of it.
• Stripe - payments and subscriptions. Stripe collects your card details directly; we hold none of them.
• PostHog - product analytics. Which pages you open and which actions you take, under your user id and email. Hosted in the EU. We do not record your screen.
• Sentry - error monitoring, so a crash reaches us with enough context to fix it. We do not record your screen here either.
• Crisp - the support chat, and the messages you send in it.
• Loops - the emails we send you, such as the sign-in link and the audit follow-up.

These providers process data on our behalf. We may also disclose information where required by law or to protect the rights, property, or safety of our users and the Service.

How we measure our advertising

We buy ads on Google and in ChatGPT, and we measure whether they work. This is the part of the policy where we share something about you with a company that is not helping us run the Service, so it says exactly what.

When you arrive from one of our ads, the platform puts an identifier for that ad on the link. We keep it in a first-party cookie on our own domain - for ChatGPT ads we keep our own copy of it as well, because the OpenAI script that would otherwise store it is blocked in a lot of browsers. Later, when something happens that we want to measure, we tell the platform it happened.

What we report is: that an account was created, that a Google Ads account was connected, that a checkout was started, that a trial or subscription started, and that a trial turned into a payment. With it goes the plan and its list price, the identifier of the ad you arrived from, your IP address and browser user agent, and - to OpenAI only - a SHA-256 hash of your email address and a SHA-256 hash of your GoodLads user id.

Being plain about the hashes: they are not anonymous. We cannot read an address back out of one, but OpenAI can check a hash against an address it already has, which is the entire reason we send them. It is how OpenAI can tell that the person who started a trial is the person who saw the ad. If you would rather we did not, reach us through our support page and we will stop sending yours.

What never goes to an ad platform: your name, your raw email address, anything you type in the chat, and any data from the Google Ads accounts you connect. We do not sell any of this and we do not use cookies to follow you around other websites. What we cannot promise on their behalf is what Google and OpenAI do with a conversion once we have reported it - they are advertising companies, they receive it under their own terms, and those terms are theirs to change, not ours.

Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the Service. You can delete your account yourself at any time, from Delete your account on your profile in the dashboard. That removes your login, the Google accounts you connected and the tokens behind them, the Google Ads accounts we tracked for you and everything the Service generated for them, and it cancels any running subscription. We keep afterwards only what we are required to keep for legal reasons.

You can disconnect a Google Ads account at any time, or revoke GoodLads's access from your Google Account permissions at https://myaccount.google.com/permissions. Once access is revoked, we stop accessing that account's data.

Two honest limits. The cookie recording which ad you arrived from expires after 90 days, or sooner if you clear it. And what we have already reported to an ad platform about a conversion - including the hashed identifiers - is out of our hands once it is sent; deleting your account stops anything further, it does not recall what went before.

Your rights

Depending on where you live, you may have rights over your personal data - including the right to access, correct, export, restrict, or delete it, and to object to certain processing. To exercise any of these rights, reach us through our support page and we will respond as required by applicable law.

Cookies and similar technologies

We use the cookies and local storage needed to keep you signed in and to keep the Service secure. On top of those: first-party cookies recording which of our ads you arrived from, one for Google and one for ChatGPT; the analytics cookie PostHog uses to tell one visit from the next; the cookie behind the support chat; and, once you are signed in, the hashed identifiers described above, kept in your own browser so the measurement survives you opening a second page. Signing out clears them.

Children

GoodLads is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page. If a change is significant, we will take reasonable steps to let you know.