Privacy Policy

Advestigate is an independent software product operated from India. We are responsible for the information described in this policy. Advestigate is not affiliated with, endorsed by, or sponsored by Google LLC. Google Ads is a trademark of Google LLC.

Contact for any privacy question or request: advestigatehq@gmail.com.

Account information. When you create an Advestigate account: your name, email address, and password. We store the password only as a salted scrypt hash and cannot read it. We also record your plan and when your account was created.

White-label settings (optional): the company name, logo, brand colour, footer text and “prepared by” line you enter for your reports, and any client labels you give connected accounts.

Technical data. Standard request logs kept by our hosting provider (IP address, browser user agent, time of request) for security and troubleshooting. We do not use advertising, analytics or tracking scripts.

Google user data is described separately in the next section.

You can connect a Google Ads account by signing in on Google's own consent screen and granting Advestigate access to the Google Ads API (OAuth scope https://www.googleapis.com/auth/adwords). Your Google password is entered only on Google's pages; we never see or store it. We do not request access to your Google profile, email, contacts, Gmail, Drive, or any other Google service.

What we access. For each Google Ads account you choose to connect, we read reporting data for the last 90 days through read-only queries of the Google Ads API:

• the list of Google Ads accounts your Google login can access, including client accounts under a manager (MCC) account, with each account’s ID, name and currency;
• account settings: name, currency and whether auto-tagging is enabled;
• campaigns: names, status, type, budget, bidding strategy and targets, network and location-targeting settings, and performance metrics (cost, impressions, clicks, conversions, conversion value, impression share);
• ad groups and keywords: names, status, keyword text and match type, Quality Score and performance metrics;
• ads: type, status, approval status, ad strength, and responsive search ad headlines and descriptions;
• conversion actions: name, category, status, type and whether each is a primary goal;
• negative keywords and shared negative keyword lists;
• the number of change events recorded in the account over the last 90 days.

How we use it. Only to provide the features you see in Advestigate: running the automated audit checks, calculating your account's health score and estimated wasted spend, and showing the results to you in the app, in PDF reports and in share links you create. We do not use Google user data for any other purpose.

We never modify your Google Ads account. Google offers a single permission for its Ads API that would also allow changes, so Google's consent screen describes it broadly. Advestigate uses it only to read reporting data; the product contains no functionality that creates, edits, pauses or deletes campaigns, ads, keywords, budgets or settings.

What we store. The OAuth refresh token Google issues (encrypted, see Section 6), the IDs and names of the accounts you connect, and the audit results we produce: findings, the campaign, ad group and keyword names they refer to, and summary metrics. The raw reporting data is processed in memory while an audit runs; we do not keep a copy of it.

How we share it. We do not sell Google user data or share it with anyone, except: the service providers listed in Section 5 that host our application and database on our behalf; people you choose to send a report or share link to; where required by law; or as part of a merger or acquisition, with prior notice to you.

Limited Use. Advestigate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

• do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising;
• do not sell Google user data, or give it to data brokers or information resellers;
• do not use Google user data to determine creditworthiness or for lending purposes;
• do not use Google user data to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models;
• do not allow humans to read Google user data, unless you give us explicit permission for specific data (for example, when you ask us to look at a finding with you), it is necessary for security purposes such as investigating abuse, or it is required by law.

We use account information to:

• create and secure your account and sign you in;
• provide the service, including audits, reports, share links and white-label branding;
• send service emails such as password resets;
• respond to support requests;
• prevent abuse and keep the service secure.

We do not use your information for advertising and do not sell it.

We use a small number of providers who process data only on our instructions:

• Vercel — hosts the website and application.
• Turso — hosts our database, including account information, encrypted OAuth tokens and audit results.
• Resend — delivers service emails such as password resets. It receives your email address, not Google user data.

These providers may process data on servers outside India, including in the United States. We do not transfer Google user data to any other third party.

• All traffic to Advestigate is encrypted in transit with TLS (HTTPS).
• OAuth refresh tokens are encrypted at rest with AES-256-GCM before they are stored.
• Passwords are stored only as salted scrypt hashes.
• Session cookies are HTTP-only and cryptographically signed, and expire after 30 days.
• Each account’s connections, audits and reports are accessible only when signed in to that account, or through a share link the account owner created.
• Access to production systems is limited to the people who operate Advestigate.

Disconnecting a Google Ads account (Accounts page → Disconnect) immediately revokes our access with Google and deletes the stored OAuth token from our database. You can also remove Advestigate's access at any time from your Google Account at myaccount.google.com/permissions; after that, we can no longer read any data from your account.

Audit history is kept while your Advestigate account is open, so you can compare audits over time.

Share links remain viewable by anyone who has the link until you revoke them from the audit page, or until your account is deleted.

Deleting everything. Email advestigatehq@gmail.com from the address on your account and ask us to delete it. Within 30 days we delete your account, connected accounts and tokens, audit history, share links and white-label settings, and confirm when it is done. We keep only records we are legally required to keep, such as billing records.

You can ask us for a copy of your information, to correct it, or to delete it, by emailing advestigatehq@gmail.com. We respond within 30 days. Depending on where you live — for example under India's Digital Personal Data Protection Act, 2023, or the EU or UK GDPR — you may have further rights, including the right to complain to a data-protection authority. We honour these requests wherever you live.

We use one cookie: a first-party session cookie that keeps you signed in. Your light or dark theme choice is saved in your browser's local storage. We do not use advertising or analytics cookies.

Advestigate is a business tool for people aged 18 and over. We do not knowingly collect information from children.

If we change how we access, use, store or share Google user data, or make any other material change, we will update this page and email account holders before the change takes effect. The effective date at the top of this page always shows the current version.

Privacy questions and requests: advestigatehq@gmail.com. You can also use the contact page.