Privacy Policy — AgencyOS 24/7
1. Data we receive
From you when you register: e-mail address, a password (stored only as a hash) or your Google sign-in identifier, and optionally your company name and contact details.
From the accounts you connect, read-only unless you approve a change:
- Google Ads: campaigns, ad groups, ads, keywords, search terms, budgets, bidding settings, conversion actions, performance metrics, account balance and billing status, change history.
- Google Merchant Center: products, prices, availability, product and account diagnostics, data sources.
Technical credentials: OAuth access and refresh tokens issued by Google when you grant consent. They are stored encrypted.
Payment information: the fact, amount, date and period of your payment, and the identifier that our payment provider returns. We do not receive or store your card number.
Support and usage: messages you send us, and basic technical logs (time of request, error messages, IP address) needed to run and secure the Service.
We do not ask for Google Workspace, Gmail, Drive, Contacts or Photos permissions, and we do not read data of your customers' personal accounts.
2. How we use the data
We use the data only to provide the features you see in the Service:
- to build snapshots of your accounts and show audit findings, alerts, product classification and recommendations, visible only to you and to people you invite;
- to run the AI assistant, which answers questions about your own account data;
- to send you service messages (verification, alerts you enabled, subscription reminders);
- to process payments, prevent abuse, and keep the Service secure and working.
We do not sell your data, use it for advertising, or combine it with other users' data to build profiles. Aggregate, anonymised statistics about the operation of the Service (for example, how many audits ran) may be used to improve it.
3. Changes to your accounts
The Service changes your Google Ads, Merchant Center settings only after your explicit approval of each action, or of a specific set of actions you have reviewed. Every applied change is recorded in a log (what changed, the previous value, who approved it, when) and, where the platform allows it, can be reverted from the Service. Before reverting, we check that the item has not been changed by someone else in the meantime.
4. Our role
For your registration and payment data, we are the data controller. For data that comes from your connected advertising accounts, we act on your instructions to deliver the features you requested (in GDPR terms, as a processor); you remain responsible for having the right to connect those accounts.
5. Google API Services User Data Policy
AgencyOS 24/7's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data received from Google APIs:
- is used only to provide and improve the user-facing features described above;
- is not transferred to others except as needed to provide those features, to comply with law, or as part of a merger or sale with notice to you;
- is not sold and is not used for serving advertisements;
- is not used to develop, improve or train generalised artificial-intelligence models;
- is not read by our staff unless you ask for support, it is needed for security or abuse investigation, or the law requires it.
6. Who else processes the data
We share data only with providers that are needed to run the Service, under agreements that limit their use of it:
| Provider | Purpose | Data |
|---|---|---|
| Hetzner Online GmbH (Germany, European Union) | Servers and database | All stored data |
| OpenAI (USA); Google, Gemini API on the paid tier (USA) | Generating explanations, summaries and drafts for the AI assistant | Minimised excerpts of account data needed for the specific request, without your credentials |
| Resend (USA) | Sending service e-mails | E-mail address and message content |
| Hosting Ukraine (Ukraine) | Hosting the support mailbox support@agencyos24.com | Messages you send to support and our replies |
| WayForPay (Ukraine) | Accepting payments | Billing data only, never data from Google or Meta |
AI providers process data in the United States. We use only their commercial API terms, under which data sent through the API is not used to train their models, and we send them only the minimum needed for the request. Where the law requires safeguards for transfers outside Ukraine or the European Economic Area, we rely on contractual protections. We may also disclose data to authorities when required by law, and to advisers bound by confidentiality. Providers may change; the current list is kept on this page.
7. Storage and security
Data is stored on servers of Hetzner Online GmbH in Germany (European Union). It is encrypted in transit (HTTPS/TLS). OAuth tokens are encrypted at rest with a dedicated key that is kept separately from the database. Every account's data is isolated from other accounts, and access by our staff is limited to what is needed to operate the Service. No system is perfectly secure; if a breach affecting your data occurs, we will notify you as required by law.
8. Retention and deletion
- Disconnecting a source (for example, Google Ads) revokes our access token at the provider and stops synchronisation. Historical snapshots and logs that were already saved stay in your account until you delete them or the account.
- Deleting your account in the Service removes your account data and imported advertising data from our active systems and revokes all tokens at Google. Deleted data leaves backups within 30 days.
- Legal records (for example, payment records) are kept for as long as accounting and security laws require.
- You can also ask by e-mail; we act on deletion requests within 30 days.
9. Your rights
You can ask us to give you access to your data, correct it, delete it, restrict or stop its processing, and export it in a common format. If you are in the European Economic Area or the United Kingdom, these are your rights under the GDPR, and you may complain to your data-protection authority. Write to support@agencyos24.com. We may need to verify that the request comes from you.
10. Cookies
We use cookies and similar storage that are necessary to keep you signed in and to remember interface preferences. We do not use analytics, tracking or advertising cookies.
11. Children
The Service is for businesses and is not directed at people under 18. We do not knowingly collect their data.
12. Changes to this policy
If we change this policy in a material way, we will publish the new version on this page and, where appropriate, e-mail you. The version and date at the top show when it took effect.
13. Contact
Bilobaba Andrii Volodymyrovych · support@agencyos24.com · 37 Demiivska St., apt. 40, Kyiv 03040, Ukraine