Privacy Policy
Before publishing: replace [BUSINESS ADDRESS]. These are a starting draft, not legal advice — have counsel review before you take payment.
AdBaseline analyses advertising accounts you connect to it and emails you findings about wasted or misdirected spend. This policy explains what we access, why, who else touches it, and how long we keep it. We have tried to write it so it can actually be read.
Who we are
AdBaseline is operated by Media Yard LLC, a limited liability company organised in New Jersey, at [BUSINESS ADDRESS]. For any privacy question, write to privacy@adbaseline.com.
What we collect
Information you give us
- Your name, work email address and company name
- Billing details, processed by our payment provider — we never see or store full card numbers
- Anything you send us in support correspondence
Advertising platform data
When you connect an advertising account, we read data from that platform's API using read-only access that you grant and can revoke. Specifically:
| Platform | Scope requested | What we read |
|---|---|---|
| Google Ads | https://www.googleapis.com/auth/adwords (read operations only) | Account, campaign, ad group, keyword and search-term configuration; conversion actions; and daily performance metrics including cost, clicks, impressions, conversions and conversion value |
| Meta | ads_read | Ad account and campaign configuration, campaign budgets, and daily campaign performance metrics including conversion events |
We do not request, hold or use any permission that would let us create, modify, pause or delete anything in your advertising accounts. We do not read your Google account contacts, email, files or calendar, and we do not ask for those scopes.
The access token we receive is encrypted with a key held outside the database before it is stored, and it is decrypted only for the duration of a single weekly read.
Before any report is sent, we email the address you gave us and wait for you to click a confirmation link. Nothing is read from a connected advertising account until that address is confirmed, so a report can never be pointed at someone who did not ask for it. Every report carries a one-click link that stops the reports and deletes the token we hold; where that token is not still in use by another account you connected in the same session, it is also revoked with the platform.
Information collected automatically
Standard server logs (IP address, user agent, timestamps, pages requested) retained for up to 30 days for security and debugging. We do not use advertising or cross-site tracking cookies on this website.
Why we use it
- To produce your findings. Establishing your account's normal performance pattern, detecting deviations, and writing the report.
- To deliver the service. Sending your reports, responding to you, and billing you.
- To keep the service working and secure. Debugging, abuse prevention, and meeting legal obligations.
That is the complete list. We do not use your advertising data for our own marketing, for benchmarking against other customers, or for any purpose you have not asked for.
Use of artificial intelligence
We use large language models to analyse account data and draft your findings. We use these under commercial API terms that prohibit the provider from training models on our data, and we send only the data needed for the analysis. Our AI subprocessor is listed below.
Google user data — limited use
AdBaseline's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely: we use Google Ads data only to provide and improve the features you connected the account for; we do not transfer it except as needed to provide the service, comply with law, or in a merger with notice; we do not use it for advertising; and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with law, or where the data has been aggregated and anonymised.
Who else processes your data
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, edge delivery, database storage | United States / global edge |
| Resend, Inc. | Transactional and report email delivery | United States |
| [AI PROVIDER — e.g. Anthropic, PBC] | Analysis and report drafting, under no-training terms | United States |
| [PAYMENT PROVIDER — e.g. Stripe, Inc.] | Subscription billing | United States |
We do not sell your personal information or your advertising data, and we do not share it with other customers. We have never done so and the business model does not depend on it.
How long we keep it
- Advertising account data: retained while your subscription is active and deleted within 30 days of cancellation or disconnection.
- Findings reports: retained for 12 months so you can look back, then deleted.
- Account and billing records: retained as required by tax and accounting law.
- Server logs: up to 30 days.
Your choices and rights
- Revoke access at any time from your Google account permissions or Meta Business settings. It takes effect immediately and does not require our involvement.
- Request access, correction, export or deletion of your data by writing to privacy@adbaseline.com. We respond within 30 days.
- Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA, including the right to object to processing and to lodge a complaint with a supervisory authority.
Security
Data is encrypted in transit and at rest. Access tokens are stored encrypted and are never exposed in our web interface or in your reports. Access to production systems is limited to personnel who need it. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data we will notify you promptly and tell you what we know.
International transfers
We are based in the United States and process data there. If you are outside the US, connecting an account means your data will be transferred to and processed in the United States.
Children
AdBaseline is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.
Changes
If we change this policy in a way that materially affects how we handle your data, we will email you before it takes effect. The date at the top always reflects the current version.
Contact
Media Yard LLC · [BUSINESS ADDRESS] · privacy@adbaseline.com