Privacy Policy

Last updated: 26 July 2026

This policy explains what data we collect when you use AdsAudit at adsaudit.io, why we collect it, who we share it with, and the rights you have under UK data-protection law.

Who we are

AdsAudit is a service provided by KlientBrain Ltd (company number 15306831, registered office 20 Wenlock Road, London, England, N1 7GU). We are referred to here as "we", "us" and "our", and we are the data controller for the personal data described in this policy. If you have any question about this policy or your data, contact us at privacy@adsaudit.io.

This policy covers the AdsAudit application at adsaudit.io and explains your rights under UK data-protection law (the UK GDPR and the Data Protection Act 2018).

The data we process, and why

Account data

When you create an AdsAudit account we process your name, email address and authentication details. Sign-in is handled by our authentication provider, Clerk. We use this to create and secure your account and to contact you about the service. You need to provide this to open an account; without it we cannot give you access. Lawful basis: performance of our contract with you.

Google Ads data

When you connect a Google Ads account, we access it through Google's Ads API. Google provides a single permission for the Ads API (the adwords scope), and its consent screen may describe this as permission to manage your account. AdsAudit only ever reads and reports on your account. We never create, edit, pause or delete anything in it, and this read-only behaviour is enforced in our software. We use the data we read solely to produce your audit and, if you take a monitoring plan, the ongoing analysis you have asked us for. Lawful basis: performance of our contract with you.

Site-signal data (free teaser)

For the free teaser, which needs no login, we fetch publicly available signals about a website you enter (such as page-speed metrics and publicly detectable tags) using Google's PageSpeed Insights API. No account access or login to any advertising platform is involved. Lawful basis: our legitimate interest in offering a useful free tool.

Billing data

If you buy a plan, our payment processor Stripe handles your card details. We do not see or store your card number. We store your plan, billing contact and payment status so we can give you the service you paid for. Lawful basis: performance of our contract with you.

Marketing data

If you ask for the free teaser result or opt in to updates, we store your email address and where you came from (using Kit and HubSpot) so we can send you what you requested. You can unsubscribe at any time using the link in any email. Lawful basis: consent.

Usage data

We collect limited technical and usage information (such as pages visited and features used) to run the service securely and improve it. Lawful basis: our legitimate interest in operating and improving the product.

Google API Services Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, the Google Ads data you authorise is used only to provide and improve the audit and monitoring features you request. We do not sell it, we do not use it for advertising, we do not use it to train generalised artificial-intelligence or machine-learning models, and we do not share it with our marketing tools (Kit or HubSpot). We do not allow humans to read it, except: where you explicitly ask us to (for example, to help with a support request); where it is necessary for security purposes or to comply with applicable law; or where the data has been aggregated and anonymised so it can no longer be linked to you or your account.

How we protect your data

We use appropriate technical and organisational measures to protect your data, including: multi-tenant isolation so that one customer can never access another customer's data; encryption in transit; access controls and authentication; read-only access to your Google Ads account; and storage of your audit history in the EU. We restrict access to your Google data to the narrow cases described under Limited Use above.

How we share data (recipients and service providers)

We do not sell your personal data. We share it only with the providers that help us run AdsAudit, each under a data-protection agreement. Some act as our processors (they process data on our instructions); others, such as Stripe and Google's advertising platform, act as independent controllers of the data they hold:

Our full list is maintained in our sub-processor list and Data Processing Agreement. We will update it if it changes.

Where your data is stored

Your audit history and analysis, and operational data such as your plan and settings, are stored in Supabase (EU region, eu-west-3 Paris). Some providers (such as Cloudflare, Clerk and Stripe) operate globally and may process data outside the UK; where they do, the transfer is made under a valid UK transfer safeguard, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or on the basis that the destination country is covered by UK data-bridge (adequacy) regulations. You can ask us at privacy@adsaudit.io for a copy of the relevant safeguard.

Multi-tenant isolation

Each customer's data is isolated to their own account ("tenant"), and one customer cannot access another customer's data. If you are an agency using AdsAudit to audit your clients' accounts, you are responsible as the controller (or processor) for that client data, and we act as your processor under our Data Processing Agreement.

Automated processing

AdsAudit analyses your advertising data automatically to generate its reported issues, scores and recommendations. This is automated analysis, not a decision that produces a legal or similarly significant effect on you. These outputs are advisory: you decide what, if anything, to change in your advertising. We do not carry out solely automated decision-making of the kind that would give you the additional rights that apply to such decisions under UK data-protection law.

How your data is analysed (no third-party AI)

Your Google Ads data is analysed by our own audit engine, which computes the reported issues, scores and recommendations in software. We do not send your Google Ads data to any third-party AI or chatbot, and we do not use it to train AI models. Your account data stays inside our own systems.

How long we keep your data

• Audit data: for as long as you have an active account, so you can see your history and track changes. If you disconnect an account or close your AdsAudit account, we delete the associated audit data within 60 days, unless the law requires us to keep it. You can also delete individual audits yourself at any time.
• Account data (via Clerk): for as long as your account is open, then deleted within the same 60-day window.
• Billing records: kept for as long as we are legally required to (for accounting and tax), typically six years, even after your account closes.
• Marketing data (Kit/HubSpot): until you unsubscribe or ask us to delete it.
• Usage and log data: kept for a limited period for security and product improvement, then deleted or aggregated.

You can disconnect a Google Ads account or close your AdsAudit account at any time. You can also revoke AdsAudit's access to your Google account at any time from your Google Account permissions page at myaccount.google.com/permissions, as well as by disconnecting in the app.

Your rights

Under UK data-protection law you have the right to: access the personal data we hold about you; ask us to correct it; ask us to delete it; ask us to restrict or object to how we use it; and ask for a copy in a portable format. Where we rely on your consent, you can withdraw it at any time. To exercise any of these rights, contact privacy@adsaudit.io.

Complaining to us. If you think we have handled your personal data incorrectly, you have the right to complain to us directly. Contact privacy@adsaudit.io and we will acknowledge your complaint and respond within the time limits required by law.

Complaining to the regulator. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator, at ico.org.uk. We would ask that you contact us first so we can try to resolve your concern.

Children

AdsAudit is a business product and is not directed at children. You must be at least 18 to use it. We do not knowingly collect data from children.

Cookies

In the application (app.adsaudit.io) we use only strictly necessary cookies to run the service and keep you signed in, such as the authentication cookies set by our provider Clerk and the security cookies set by Cloudflare. These are required for the service to work and do not need your consent.

On our marketing website (adsaudit.io) we also use analytics and advertising cookies, but only if you agree to them. When you first visit, a cookie banner lets you accept or reject these. We do not set any analytics or advertising cookie until you accept, and you can change your choice at any time through the cookie settings link on the site.

• Analytics cookies help us understand how visitors find and use the site so we can improve it.
• Advertising cookies let us measure our advertising and show relevant ads to people who have visited the site.

You can also control cookies through your browser settings. Rejecting analytics and advertising cookies does not affect your ability to use AdsAudit.

Changes to this policy

We may update this policy from time to time. When we do, we will post the new version here and update the "last updated" date at the top. If the change is significant, we will tell you.

Contact

KlientBrain Ltd, 20 Wenlock Road, London, England, N1 7GU. Email: privacy@adsaudit.io.