Privacy Policy

Who We Are and Our Role

PaidSync.ai is a product operated by Advanced Technology Labs LLC, a company registered in the State of Wyoming, United States (“PaidSync”, “we”, “us”). You can reach us at support@paidsync.ai for any privacy-related inquiry.

Under the EU General Data Protection Regulation (GDPR) and the UK GDPR we hold two different roles, depending on the data.

We are the data controller of the personal data we decide the purposes for. That means your account and profile information, billing records, security and login records, support correspondence, and how you use the product and our website.

We are a data processor for the advertising account data you connect and the instructions you issue through the product. We act on your documented instructions and do not decide what to do with that data ourselves. If you use PaidSync on behalf of your own clients, you are the processor and we act as your sub-processor. Our Data Processing Agreement governs that relationship and includes the European Commission’s Standard Contractual Clauses, the technical and organisational measures we apply, and a link to the current list of sub-processors.

Our database, its scheduled backups and uploaded files are in the United States, in Google Cloud region us-central1 in Iowa, where our backend also runs, and the web application’s server functions run on Vercel in Washington, D.C., United States. Copies of the database made for a May 2026 hosting migration are in Google Cloud’s United States multi-region. Requests reach them through Vercel’s and Google’s global networks. Application logs are kept for 30 days in Google Cloud Logging, which may store them in any Google data centre, and some of the services listed on our security page, including the AI model providers, may process data outside the United States. We are not certified under the EU-US Data Privacy Framework. For the advertising account data you connect and the instructions you issue through the product, transfers from the EEA and the UK are covered by the Standard Contractual Clauses incorporated in the Data Processing Agreement, and you can obtain a copy of them there.

1. Information We Collect

When you create an account, we collect your name, email address, and profile information provided by Google Authentication. We also collect usage data such as pages visited and features used. The advertising account data you choose to connect is processed on your behalf, as described under Who We Are and in section 5. We may collect device information, browser type, and IP address for security and analytics purposes.

2. How We Use Your Information

We use your information to provide and maintain the PaidSync.ai service, process your transactions, send you service-related communications, and improve the platform. We may use aggregated, anonymized data about how the product is used for analytics and to develop new features; we do not use data from your connected advertising accounts for these purposes without your separate written instruction, as our Data Processing Agreement sets out. We will never sell your personal information to third parties.

3. Data Storage

Your data is stored securely using industry-standard encryption. We use Firebase and Google Cloud infrastructure to host and process your data.

When you delete your account, our automated deletion permanently removes, after a 30-day recovery window (see “Your Rights” below), your profile, the brands you created with each brand’s profile, brief and saved instructions, up to 200 approval cards per brand, any workspace you own, your automations and PaidSync API keys, your connected ad-platform tokens and your authentication record. It does not by itself remove the records below. Your chat and Operator conversation history, the other records kept for your brands (such as plans, findings, notes, knowledge files and agent run records), the log of changes made through PaidSync to your connected ad accounts, the daily summaries and cached reports kept for those accounts, the records of code runs made through PaidSync, and any AI model provider key you supplied, which is kept encrypted, stay until we erase them. Removing a chat in the workspace only hides it, and deleting a brand only archives it. We erase these records, which we hold on your behalf, within 30 days after your deletion becomes permanent, and within 30 days of a request to support@paidsync.ai, for your whole account or a single brand, including after your account is deleted. Records of your use of the product and of your correspondence with us stay until you ask us to erase them, except the records below.

Some records are kept after deletion on the basis of our legitimate interests (Article 6(1)(f) GDPR) in keeping billing and tax records and in being able to show that a deletion was carried out. Records of the individual tool calls made on your account are kept for 7 years, with your user identifier, email address and name removed, because they support our billing and tax records under the rules that apply to us in the United States; until we erase it as described above, the record of a call that failed can also hold up to 300 characters of the error message returned for it. A deletion audit log, recording with your email address that an account deletion was requested and completed, is kept for 7 years. Our email provider, Resend, also keeps your email address in a list of deleted accounts, marked as unsubscribed, until you ask us to remove it. Invoices and the customer record held by our payment provider, Stripe, keep the details, such as your name, email address and any billing address, that tax records need. Deleted data can remain in backups and archived copies after that. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, or destruction.

4. Third-Party Services

PaidSync.ai integrates with third-party services to provide core functionality. We use Firebase for authentication, database, and hosting services. Google Authentication is used for secure sign-in. These services have their own privacy policies, and we encourage you to review them. We only share the minimum data necessary for these services to function.

AI model providers. When you ask PaidSync to do something, your instruction and the data needed to answer it are sent in session to a large-language-model provider. When a report is refreshed, including automatic background refreshes that can run as often as hourly for brands viewed in the previous 24 hours or where an approval card was applied in the previous 30 days, the report’s figures and the names of the accounts in it are sent to OpenAI to write a short summary. The providers we use are Anthropic, OpenAI, Google (Gemini), and Groq. Each operates under contractual terms that prohibit using PaidSync customer data to train their foundation models. If you supply your own API key for a provider, that provider acts under your own agreement with it. The services that receive data from your workspace or your connected ad accounts, and the services that handle your sign-in, billing and usage data, are listed with what each one receives, its legal entity and its location at paidsync.ai/security.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products and services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products and services and online activity. Additionally, we use this information for site optimization, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement. Clarity runs on our website, where it loads with most pages and your cookie choice does not currently control it, and in the PaidSync workspace, where it loads only if you allow analytics cookies, except after you complete a purchase, when our tag manager loads it on the workspace page you paid on or return to, for the rest of that visit. Clarity is set to mask all text shown on screen in its session recordings, on our website and in the workspace. Recordings made before September 11, 2026 used a setting that masked only numbers, email addresses and form fields. Microsoft keeps recordings for up to 30 days, and favorite recordings, a sample of recordings and heatmaps for up to 9 months.

We use Google Analytics 4 and Google Tag Manager to analyze site traffic and understand how visitors interact with our website. This data helps us improve the user experience. You can manage your cookie preferences using the cookie settings on our site. Our servers also send Google Analytics events about how the product is used, such as the name of each tool called and whether it succeeded, and about purchases, linked to your account identifier; your cookie settings do not control these.

When you complete a conversion event on PaidSync.ai (such as creating an account, submitting a lead form, or completing a purchase), we may send a hashed (SHA-256) version of your email address to Google through Google Tag Manager to improve the accuracy of conversion measurement via Google Enhanced Conversions. Google’s tags, including these conversion events, follow your cookie choice through Google Consent Mode: in the EEA, the UK and Switzerland they do not use advertising or analytics cookies until you accept them, and elsewhere they use them unless you decline. Our tag manager also loads the Meta Pixel, the LinkedIn Insight Tag, the OpenAI Ads measurement pixel and the Reditus and Affonso affiliate tracking scripts with most pages of our website and on the workspace page after you complete a purchase, for the rest of that visit, and sends conversion events such as sign-ups and purchases to Meta, LinkedIn and OpenAI; your cookie choice does not currently control these. You can change your cookie choice for Google’s tags at any time in the cookie preferences. When you book a demo, our server sends a hashed (SHA-256) version of the email address you booked with to Google Analytics for conversion measurement; this is sent from our server when the booking reaches us, and your cookie choice does not control it.

5. Google User Data and Limited Use

When you connect your Google account to PaidSync, we request OAuth access to specific Google API scopes that power the in-app features you ask us to perform. The scopes we request, and the user-facing feature each one enables, are:

• openid, email, profile: identify and label each connected Google identity in your dashboard so you can tell connected accounts apart.
• Google Ads (https://www.googleapis.com/auth/adwords): list, read, and manage Google Ads campaigns, ad groups, keywords, and budgets on your explicit instruction.
• Google Data Manager (https://www.googleapis.com/auth/datamanager): upload offline conversion data that you supply (for example CRM leads that later closed) to a Google Ads conversion action, on your explicit instruction. PaidSync does not read your Google Ads data through this scope.
• Google Analytics 4 (analytics.readonly, analytics.edit): read GA4 reports and create or update conversion (key) events on your explicit instruction.
• Google Tag Manager (tagmanager.readonly, tagmanager.edit.containers, tagmanager.edit.containerversions, tagmanager.publish): audit your container, create or update tags and triggers, snapshot a version, and publish on your explicit instruction.
• Google Search Console (webmasters.readonly): read Search Console performance data (clicks, impressions, queries, pages). Read-only.
• Google Merchant Center (https://www.googleapis.com/auth/content): read Merchant Center account status, product feed, and disapproval data. PaidSync does not insert, update, or delete products.

What we store from your advertising accounts. So that reports open quickly and so you can compare one period against another, PaidSync keeps a daily summary for each connected advertising account: the date, the account identifier, the currency, and that day's totals for spend, impressions, clicks, conversions and conversion value. These are aggregate daily figures. With them we keep the account’s name and, for its recent ads, their name, status, metrics and a link to their thumbnail image. We do not copy your keyword lists, ad text, audience lists, or customer match data into this store. When an account is first connected we fetch the last 90 days of its history, and older history, up to 365 days back, can be fetched later. We then keep the running daily totals until we erase them, which we do within 30 days of your request, or within 30 days after your account deletion becomes permanent; deleting your PaidSync account does not erase them by itself. When you use the chat or the Operator, your conversation history also keeps up to 4,000 characters of each result used to answer; section 3 explains how long it is kept. The store is held in Google Cloud Firestore and encrypted at rest. Disconnecting an advertising account stops further collection for it. To have the stored daily figures for an account erased, email support@paidsync.ai and we will delete them within 30 days.

The free Google Ads grader. paidsync.ai/grader runs a one-off audit without you creating a PaidSync account. When you sign in to it with Google we request the Google Ads scope described above and keep the resulting refresh token, your Google account identifier and the email address of your Google account, which we also record as a grader lead; we read the account to produce your score and findings, and store the resulting report so that its link keeps working. Google publishes a single Google Ads permission and it covers both reading and changing; the grader only reads, and never creates, edits, pauses or deletes anything in your account. If you ask for the PDF version we also store the email address you provide. You can withdraw the grader's access at any time at https://myaccount.google.com/permissions, and you can ask us to delete a grader report by emailing support@paidsync.ai.

Limited Use: PaidSync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

No AI or ML model training on Google user data. We do not use Google user data obtained through these APIs to develop, improve, or train generalized or non-personalized AI or machine learning models. Google user data is processed only to provide the features you use in PaidSync: your in-session requests, the daily summaries, cached reports and report summaries described above, and automations you set up. When a large-language-model provider (Anthropic, OpenAI, Google, or Groq) answers a request or writes a report summary, it receives the instruction and the data needed to do so, strictly to return the result; the provider operates under contractual terms that prohibit using PaidSync customer data for training their foundation models.

No sale, no advertising use, no human reading. We do not sell Google user data, do not use it to serve advertisements, and PaidSync staff do not read it except where strictly necessary to provide user-requested support, comply with applicable law, or investigate a security incident.

Revocation. You can disconnect any Google account from inside the PaidSync dashboard at any time, or revoke PaidSync's access directly at https://myaccount.google.com/permissions. On disconnect, the associated OAuth tokens are deleted from our systems.

6. Your Rights

You have the right to access, correct, or delete your personal data at any time. You can request a copy of all data we hold about you by emailing support@paidsync.ai. If you are located in the EU, you have additional rights under GDPR, including the right to data portability and the right to lodge a complaint with a supervisory authority. You can also object, under Article 21 GDPR, to processing based on our legitimate interests by emailing support@paidsync.ai.

You can delete your account directly from Settings > Security > Delete account. Type DELETE to confirm. You are signed out immediately, and you are removed from all marketing communications that same day. You have 30 days to change your mind: sign back in and choose Cancel deletion in Settings > Security. Until then, automations you have enabled keep running and your connected ad accounts can keep syncing; to stop that at once, pause your automations and disconnect your ad platforms before you request deletion. After 30 days, the deletion becomes permanent and cannot be undone: the records that section 3 lists as removed by our automated deletion are hard-deleted, and your Stripe subscription is cancelled. We erase the other records we hold on your behalf within the following 30 days, as section 3 describes. No refund is issued for any unused portion of a paid billing period.

If you own a team workspace with active members, you must transfer ownership or remove those members before you can delete your account.

To request a copy of your data before deleting, email support@paidsync.ai. Self-serve data export is coming in a future update.

7. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@paidsync.ai. We will respond to all privacy-related inquiries within 30 days.