Privacy Policy
This Privacy Policy explains what information Adsera processes, why, and the choices available to you. It is currently a structured draft - see the banner above - written from facts that have actually been decided, with every undecided fact shown as a visible placeholder rather than invented.
Effective date
TODO(owner: effective-date-privacy): The date this Privacy Policy takes effect has not been set. It will be set when legal review is complete.
Who we are
The legal entity that operates Adsera and its registered details are set out in the Terms of Service, "Who we are". That section is currently a placeholder; nothing in this policy should be read as identifying the contracting entity until it is filled in.
Information we process
Account and billing information you give us directly (name, email, organization), plus the advertising, analytics and search data you connect from Meta Ads, Google Ads, Google Analytics 4 and Search Console. Those connections are read-only: Adsera reads that data to build your reporting, insights and recommendations, and does not change anything in a connected account through them.
Where your data is hosted
Our infrastructure is hosted in the United States, in AWS region us-east-1.(ADR-0009, B7)
Sub-processors we use
We use the following sub-processors to operate Adsera.(ADR-0009, roadmap N10)
| Sub-processor | Purpose |
|---|---|
| Supabase | database, authentication and file storage |
| Vercel | hosting for the marketing site and the application |
| DigitalOcean | hosting for the background worker |
| Upstash | Redis, used for background job queues and rate limiting |
| Stripe | billing and payment processing |
| Resend | sending transactional email |
| Sentry | error monitoring and performance observability |
| Anthropic | primary AI model provider for the AI manager and recommendations |
| OpenAI | fallback AI model provider |
| Cloudflare | DNS management for our domains |
How long we keep data
Retention windows are enforced by scheduled jobs.(ADR-0009 section 5a)
| Data | Retention window |
|---|---|
| Audit logs | 1 year on the Starter plan, 2 years on Growth and above |
| Job run records | 30 days |
| Raw connected-account metrics | 25 months |
| AI prompts | 30 days, redacted |
Your privacy rights
Adsera is hosted in the United States and CCPA applies to it at launch, with a GDPR-ready design for when we add EU hosting.(ADR-0009 section 5a, B14)
Adsera does not sell or share personal information, as those terms are defined by the CCPA.
TODO(owner: data-subject-request-channel): The formal channel for submitting a verifiable data-subject request (to know, delete or correct your information) has not been decided. It may or may not be the same address as the general privacy contact below.
Contact us
For privacy questions, write to privacy@adsera.app.
Cookies and third parties
This site does not use cookies, analytics, tracking scripts, remote fonts, embedded video or chat widgets. Because there is nothing here that requires consent, there is no cookie banner.
Google API Services data - Limited Use disclosure
This section describes specifically how Adsera uses data obtained through Google APIs.
Scopes we request
https://www.googleapis.com/auth/adwordsUsed to read the connected Google Ads account's campaign, ad group and spend performance data. Read-only: Adsera never changes the connected account through this scope.https://www.googleapis.com/auth/analytics.readonlyUsed to read Google Analytics 4 reporting data for the connected property. Read-only: Adsera never changes the connected account through this scope.https://www.googleapis.com/auth/webmasters.readonlyUsed to read Search Console search-performance data for the connected site. Read-only: Adsera never changes the connected account through this scope.
Adsera's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we do with this data
We use the data read through these scopes only to produce that same customer's own reporting, insights and recommendations, inside that customer's own organization in Adsera. Data read from a customer's connected Google account stays inside that customer's own organization and is not pooled, aggregated or shared across organizations.
What we do not do with this data
- We do not sell this data.
- We do not share it with data brokers.
- We do not use it for advertising or ad retargeting.
- We do not transfer it to anyone other than the sub-processors listed above, who process it on our behalf to operate Adsera.
- Data derived from these Google API scopes is processed only by our AI providers Anthropic and OpenAI, and is not used to train generalized AI models.(ADR-0013)