Privacy Policy

This Privacy Policy explains how MyAd ("we", "us") collects, uses and protects information when you use the MyAd platform, website and API (the "Service"). It applies to visitors, trial users and paying customers.

1. Information we collect

Information you provide

• Account details: name, work email address, company name and billing details.
• Support content: messages you send us, including attachments and any screenshots.
• API metadata: names of API keys you create and the scopes you assign to them.

Information from connected advertising platforms

• Campaign data from Google Ads and Meta Ads: campaigns, ad groups, keywords, search terms, audiences, creatives, costs, conversions and performance metrics.
• OAuth tokens issued by Google or Meta so we can access those accounts on your behalf. We never receive or store your Google or Meta password.

Information collected automatically

• Log data: IP address, browser type, operating system, referring page and timestamps.
• Usage data: pages visited, features used, API calls made and error events.
• Cookies and local storage for session management, theme preference and affiliate attribution.

2. How we use information

• To provide the Service: analysing accounts, generating recommendations, executing approved changes.
• To operate your account: authentication, billing, plan enforcement and usage metering.
• To communicate: transactional emails, security notices, and product updates you can opt out of.
• To improve the Service: aggregated, de-identified usage analysis and error diagnostics.
• To meet legal obligations and enforce our Terms of Service.

3. What we never do

• We never sell your personal data or your advertising data to third parties.
• We never share your advertising data with competing advertisers.
• We never use your advertising data to train AI models for other customers.
• We never access your accounts for any purpose other than providing the Service you asked for.

4. AI processing

MyAd uses large language models to generate recommendations and answer questions. When a request needs a model, we send only the minimum data required — aggregated metrics, account structure and the specific question. Account credentials and personal identifiers are never included. Model providers used for inference are contractually prohibited from training on data submitted through our API.

5. Legal bases for processing (GDPR)

• Performance of a contract — providing the Service you signed up for.
• Legitimate interests — securing the Service, preventing fraud and improving the product.
• Consent — marketing communications and non-essential cookies, which you can withdraw at any time.
• Legal obligation — tax, accounting and lawful requests from authorities.

6. Data retention

Account data is retained while your account is active. After cancellation, personal data is deleted within 30 days and advertising data within 90 days, except where we must retain records for legal, tax or fraud-prevention purposes. You can request earlier deletion at any time.

7. Security

• OAuth2 for all platform connections — we never handle your platform passwords.
• AES-256-GCM encryption for credentials and refresh tokens at rest.
• TLS 1.2+ for all data in transit, including API and dashboard traffic.
• Scoped API keys, per-account permissions and full audit logging of changes.
• Regular dependency review and least-privilege access for our own staff.

8. Sub-processors

We use a small number of infrastructure providers: Cloudflare (hosting, CDN, edge compute, database and object storage), our payment processor for billing, and model providers for AI inference. A current list with locations is available on request.

9. International transfers

Data may be processed outside your country. Where personal data leaves the EEA or UK, we rely on Standard Contractual Clauses or an equivalent approved transfer mechanism.

10. Your rights

Depending on your jurisdiction you may have the right to access, correct, delete, port or restrict processing of your personal data, and to object to processing based on legitimate interests. To exercise any right, email hello@myad.si. We respond within 30 days.

11. Cookies

We use strictly necessary cookies for authentication and security, and a small number of functional cookies for theme preference and affiliate attribution. We do not use third-party advertising cookies on this site.

12. Children

The Service is not directed to anyone under 16, and we do not knowingly collect their personal data.

13. Changes

We will post any material changes to this policy on this page and, for significant changes, notify account holders by email at least 14 days before they take effect.

14. Contact

Data protection enquiries: privacy@$myad.si. General enquiries: hello@myad.si.