Privacy Policy
This Privacy Policy describes how Media Access ("we", "us", "our") collects, uses and protects information when you use the AdTool web application (the "Portal") and the website at adtool.no(together, the "Service"). Media Access is a company registered in Norway and acts as the data controller for personal data described here, except where we act as a data processor on your behalf (see section 3). If you have any questions about this policy or your data, contact us at privacy@adtool.no.
Summary in plain language: AdTool is a web tool for auditing and optimizing your own Google Ads account. We process Google Ads data only to deliver the analysis and optimization features you ask for. We also keep records of the issues our AI detects, the changes that are made, and the results that follow, and we may use that information — in aggregated and de-identified form — for internal research to improve the Service (section 6). We never use Google Ads data to serve ads or to train generic AI models, and we never sell it. Separately, our website uses standard analytics and advertising cookies (Google Analytics and the Meta Pixel) to understand traffic and measure marketing — you can control these as described in section 4. You can disconnect AdTool from your Google Ads account at any time.
1. Information we collect
1.1 Information you provide directly
- Account information. When you create an AdTool account or contact us, we collect your name, email address, a chosen notification email (optional), preferred language and time zone, and (optionally) company name.
- Authentication data. We support password and passwordless (magic-link) sign-in and optional two-factor authentication (2FA). Authentication and session management are handled by our infrastructure provider, Supabase. We store hashed two-factor recovery codes, not your authenticator secret.
- Business context. Information you choose to add to improve recommendations (for example website URL, products/services, target locations, protected brand terms, budget goals and notes).
- Billing information. If you purchase a paid plan, our payment processor (Stripe) collects the information needed to process the payment. We do not store full payment-card numbers on our systems.
- Support communications. Messages you send us by email or the contact form.
1.2 Information from Google services (Google user data)
To use AdTool you link your Google Ads account to AdTool's Google Ads manager account (MCC) by approving a manager-account link request inside Google Ads. Once linked, AdTool accesses your account through the official Google Ads API. The data we may access includes:
- Your Google Ads customer IDs and account structure (campaigns, ad groups, ads, keywords, assets, extensions).
- Performance metrics for the above (impressions, clicks, cost, conversions, conversion value, search-term reports, quality scores).
- Recommendations, change history, and billing, geographic, language and time-zone settings of the Google Ads account.
AdTool accesses the Google Ads API using the https://www.googleapis.com/auth/adwords scope. This is the only scope Google provides for the Google Ads API. We do not request access to Gmail, Drive, Calendar, Contacts or any other Google service. We act as a data processor with respect to the Google Ads account data we access on your behalf.
1.3 Information generated by the Service (Service Data)
When AdTool audits a connected account, it generates records about its own operation: the issues, errors and opportunities our automated and AI-driven analysis detects, the Proposals it produces, the changes you (or, where you have enabled it, the Service) apply, and the performance results and outcomes that follow from those changes. We refer to this as "Service Data". See section 6 for how we use it.
1.4 Information collected automatically
- Cookies and similar technologies. On our website and Portal we use cookies and similar technologies for sign-in/session management, analytics and marketing measurement. See section 4 for details and your choices.
- Usage and device data. Limited information about how the Service is used (pages viewed, feature usage, approximate location derived from IP, browser/device type, referring source). This helps us operate, secure and improve the product.
- Log data. Standard server logs (timestamp, IP address, request path) for the website and service endpoints. Logs are retained for up to 30 days.
2. How we use the information
We use the information described above only for the following purposes:
- To analyze your Google Ads account and generate the audits, recommendations and optimizations you have asked AdTool to produce.
- To apply changes to your Google Ads account that you explicitly approve.
- To run scheduled audits on the day you choose and email you the results and secure review links.
- To authenticate you, secure your account, and provide customer support.
- To operate, maintain, secure and improve the Service, including detecting and preventing fraud and abuse.
- To process payments and manage subscriptions for paid plans.
- To measure and improve our website and marketing (analytics and advertising measurement — section 4).
- To carry out internal research, evaluation and quality assurance on the Service's performance using Service Data, in aggregated and de-identified form (section 6).
- To send transactional communications about your account and, only where permitted, occasional product updates you can opt out of.
- To comply with our legal obligations.
Where GDPR applies, our legal bases are: performance of our contract with you (to deliver the Service), your consent (for non-essential cookies/marketing and certain communications), our legitimate interests (to secure, research and improve the Service and measure our marketing), and compliance with legal obligations.
3. Roles: controller and processor
We act as a data controller for your AdTool account data, website usage and marketing data, and for the aggregated and de-identified Service Data we use for internal research under section 6. We act as a data processor for the Google Ads account data we access and process on your behalf to deliver the Service; in that role we process such data according to your instructions and these terms.
4. Cookies, analytics and advertising technologies
Our website and Portal use cookies and similar technologies in three categories:
- Strictly necessary. Required for sign-in, sessions and security. These cannot be switched off without breaking the Service.
- Analytics. We use Google Analytics 4 (measurement ID
G-8CJCPEQSYL) to understand how visitors find and use our website and Portal (pages viewed, navigation, approximate location from IP, device and referral source). This helps us improve the product and content. - Advertising/measurement. We use the Meta (Facebook) Pixel (ID
2235725777189912) to measure the effectiveness of our marketing, understand conversions (for example sign-ups and subscriptions), and optimize and target advertising on Meta platforms (Facebook and Instagram), including retargeting visitors to our website.
Important separation: these analytics and advertising technologies run on the AdTool marketing website and Portal interface and measure your interaction with our own site. They are notapplied to, and do not receive, the Google Ads API "Google user data" of the accounts you connect. We never use Google Ads account data for advertising, retargeting or measurement (see section 5).
Your choices. You can control cookies through your browser settings, use the Google Analytics opt-out browser add-on, and manage Meta ad preferences in your Facebook/Instagram settings. Where required by law, we will request your consent for non-essential cookies before they are set, and you can withdraw consent at any time. Most browsers also support a "Do Not Track" or global privacy control signal.
5. Google API Services User Data Policy — Limited Use disclosure
AdTool's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we confirm that:
(a) We use Google user data only to provide or improve user-facing features that are prominent in the AdTool application and the website.
(b) We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with the user's consent.
(c) We do not use or transfer Google user data for serving advertisements, including retargeting, personalized or interest-based advertising.
(d) We do not allow humans to read Google user data unless we have obtained your affirmative agreement for specific messages, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or our use is for internal operations and the data (including derivations) has been aggregated and anonymized.
(e) We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models.
Our internal research described in section 6 is carried out within these limits: any Google user data used for internal operations and research is aggregated and de-identified, is never used to train generalized AI models, and is never used for advertising.
6. Research, error analysis and product improvement
We keep records of how the Service performs — the issues and errors our AI detects in connected accounts, the Proposals generated, the changes that are applied, and the performance results and outcomes that follow (together, "Service Data"). We reserve the right to retain and analyse Service Data for our own internal research, evaluation, benchmarking, quality assurance, troubleshooting, debugging and improvement of the Service — for example to understand which kinds of issues recur, how accurate our AI's findings are, and how effective different Proposals are over time. This applies whether or not a given Proposal was accepted or rejected.
- Where Service Data constitutes Google user data, we use it for these internal-research and operational purposes only in aggregated and/or de-identified form, consistent with the Limited Use commitment in section 5.
- We do not use this data to serve advertising, and we do not use it to train generalized or non-personalized AI or machine-learning models.
- Aggregated and de-identified insights derived from Service Data (statistics that do not identify you, your account or the end users of your ads) may be retained and used by Media Access without time limit to operate and improve the Service.
Where GDPR applies, the legal basis for this research use is our legitimate interest in maintaining, securing, evaluating and improving the Service, balanced against your rights; you can object as described in section 11.
7. AI processing
AdTool uses AI models to generate audits and recommendations. When AI processing is required, prompts containing your campaign data may be sent to AI providers acting as our data processors. Before data is sent:
- We do not include personally identifying information about the end users of your ads.
- Data is transmitted over encrypted (TLS) connections.
- Our AI providers are contractually prohibited from using your data to train their generic models, consistent with the Limited Use commitment in section 5.
8. How long we keep your data
- Account and business-context information is kept while your AdTool account is active and for up to 12 months after deletion, after which it is purged.
- The Google Ads account link and any associated access credentials are kept until you remove the link or delete your AdTool account, after which the connection and stored credentials are deleted.
- Cached campaign data, audits and proposals on our servers are deleted within 30 days of account deletion. Aggregated and de-identified insights derived from Service Data (section 6), which can no longer be linked to you, may be retained beyond this period.
- Support communications are kept for up to 24 months.
- Server logs are kept for up to 30 days. Analytics and advertising data are retained according to the providers' standard retention settings.
9. Sharing of information and sub-processors
We do not sell your personal information. We share information only with service providers that help us operate the Service, bound by data-processing agreements, and in the limited legal cases described below. Our main sub-processors are:
| Provider | Purpose |
|---|---|
| Supabase | Authentication, database and backend hosting |
| Google Cloud | Application/worker hosting and the Google Ads API |
| Stripe | Payment processing and subscription billing |
| Resend | Transactional email delivery (audits, links, account emails) |
| AI provider(s) (e.g. OpenAI) | Generating audits and recommendations |
| Google Analytics | Website and Portal usage analytics |
| Meta Platforms | Advertising measurement and optimization (Meta Pixel) |
We may also disclose information for legal compliance (when required by law, court order or government request) and in connection with a business transfer (merger, acquisition or sale of assets), in which case we will notify affected users.
10. International transfers
Media Access is based in Norway (EEA). Some of our service providers are located outside the EEA, including in the United States. Where this is the case we ensure that transfers are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses and/or recognised certification frameworks.
11. Your rights (GDPR)
If you are located in the EEA, the United Kingdom or Switzerland, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data ("right to be forgotten").
- Restrict or object to certain processing, including profiling for marketing and the research use described in section 6.
- Request a copy of your data in a portable format.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with your local supervisory authority. In Norway, this is Datatilsynet (datatilsynet.no).
To exercise any of these rights, contact privacy@adtool.no. Note that requests cannot reach data that has already been aggregated and de-identified, because it can no longer be linked to you.
12. Disconnecting AdTool from your Google Ads account
You can end AdTool's access to your Google Ads account at any time by removing the manager-account (MCC) link from within Google Ads: open Admin → Access and security (or Linked accounts / Account access), find AdTool's manager account, and remove it. After the link is removed, AdTool can no longer access or change that account, and we delete the associated connection and credentials from our systems within 7 days. You can also delete your AdTool account entirely by contacting us.
13. Children
AdTool is a B2B advertising-management tool and is not directed to or intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us so we can delete it.
14. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Portal before the changes take effect. The "Last updated" date at the top of this policy shows when it was last revised.
15. Contact
Media Access
Fridtjof Nansens plass 4, 0160 Oslo, Norway
Sentrumsgata 6, 7970 Kolvereid, Norway
C. las Azaleas, 51, 29660 Marbella, Málaga, Spain
Privacy contact: privacy@adtool.no
Security contact: security@adtool.no
General contact: post@mediaaccess.no