Privacy Policy

GMLabs ("we", "our", or "us") operates the GMLabs Ads Dashboard application available at ads.gmlabs.dev (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service, including information obtained through the Google Ads API.

By using the Service, you agree to the collection and use of information in accordance with this policy.

Account Information

When you sign up, we collect your name, email address, and profile information through our authentication provider (Stack Auth).

Google Ads Data

With your explicit authorization via OAuth 2.0, we access the following data from the Google Ads API using the adwords scope:

• Google Ads account structure (MCC and child accounts)
• Campaign, ad group, and keyword performance metrics
• Search query reports and search term data
• Budget and bidding configuration
• Conversion tracking data

We do not access your Gmail, Google Drive, or any other Google services. Our access is strictly limited to Google Ads data.

Usage Data

We may collect information about how you access and use the Service, including your IP address, browser type, pages visited, and timestamps.

We use the collected data exclusively to:

• Display your Google Ads performance data in the dashboard
• Generate AI-powered campaign analysis and recommendations
• Detect anomalies in campaign performance metrics
• Provide budget pacing and forecasting insights
• Send you notifications about significant account changes
• Generate reports you explicitly request

We do not sell, rent, or share your Google Ads data with any third party for advertising, marketing, or any other purpose unrelated to providing the Service.

Specifically, we commit to the following:

Limited Use

• We only use Google Ads data to provide and improve the features described in this policy (analytics, anomaly detection, AI analysis, reporting).
• We do not use Google Ads data for serving advertisements.
• We do not use Google Ads data for any purpose unrelated to the core functionality of the Service.

No Unauthorized Transfers

• We do not transfer Google user data to third parties unless necessary to provide or improve the Service, comply with applicable laws, or as part of a merger or acquisition with adequate data protection.
• We do not allow humans to read your Google Ads data unless you have given explicit affirmative agreement, it is necessary for security purposes, it is required by law, or it is aggregated and anonymized for internal operations.

Secure Data Handling

• All data is transmitted using TLS/HTTPS encryption.
• OAuth tokens are stored securely and encrypted at rest.
• Access to production systems is restricted to authorized personnel with multi-factor authentication.

Your Google Ads performance data is stored in our secure cloud infrastructure (Google Cloud Platform) for the purpose of providing historical analytics and trend analysis.

• OAuth refresh tokens are stored encrypted and are revoked upon account deletion or disconnection.
• Cached campaign data is retained for as long as your account is active to support historical analysis features.
• Upon account deletion, all your data — including cached Google Ads data, tokens, and analysis results — is permanently deleted within 30 days.

We do not share your personal information or Google Ads data with third parties except in the following circumstances:

• Service providers: We use trusted third-party services (cloud hosting, authentication, email delivery) that process data on our behalf under strict confidentiality agreements.
• Legal obligations: We may disclose data if required by law, regulation, or valid legal process.
• With your consent: We may share data when you explicitly authorize us to do so.

You have the right to:

• Access: Request a copy of the data we hold about you.
• Revoke access: Disconnect your Google Ads account at any time from the dashboard settings or through your Google Account permissions.
• Delete: Request deletion of your account and all associated data.
• Correct: Update or correct your personal information.

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest
• OAuth 2.0 for Google Ads API authentication
• Regular security audits and access reviews
• Infrastructure hosted on Google Cloud Platform with SOC 2 compliance

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us at:

privacy@gmlabs.dev