Privacy Policy — AgencyOS 24/7

Version 1.11 · effective 18 October 2026
Service: AgencyOS 24/7 — an operating system for your own Google Ads, available at agencyos24.com (the "Service").
Contact: support@agencyos24.com, Telegram: t.me/agencyos24. The operator's registered-entity details are available on request from support.

This policy explains what data the Service receives, why, who else sees it, how long we keep it, and how you can delete it. It is written for advertisers who connect their own advertising account to the Service. We update this page when we add a new data source or a feature that processes data differently — see section 12.

In short. The Service only reads data from your Google Ads account (and, with your separate permissions, Merchant Center, Google Analytics 4 and Search Console) to show audits and alerts, and changes nothing in your accounts. We do not sell your data, use it for advertising or train models on it. You can sign in with Google or with an e-mail and password. You can disconnect access and delete all your data at any time.

1. Data we receive

From you when you sign in or sign up: if you sign in with Google — your name, profile picture and e-mail address, as returned by Google. If you sign up with an e-mail and password — your e-mail address, your company name (if you give one) and your password: we store only its hash, created with the scrypt algorithm, not the password itself. To confirm your e-mail and to reset a password we create one-time tokens (only their hash is stored) and send you e-mails with links. E-mail sign-ups that are not confirmed within 7 days are deleted automatically.

From the account you connect, read-only:

• Google Ads (permission https://www.googleapis.com/auth/adwords, which the Service uses read-only): campaign name, status and type, daily budget, bidding strategy and target, whether it is limited by budget, daily performance metrics (impressions, clicks, cost, conversions, conversion value) and the prepaid account balance. To analyse search and conversion quality, the Service also reads: the search terms that triggered your ads over the last 30 days (the query text with its clicks, cost and conversions) and how many negative keywords each campaign has; the account change log (when, which Google user's e-mail made the change, which type of object and which fields changed, and the campaign it relates to; Google keeps it for 30 days, we keep our copy for up to 35 days); the list of conversion actions (name, type, category, status, whether it is primary, and conversions and value for 30 days); and how many search themes each Performance Max asset group has.
• Google Merchant Center (permission https://www.googleapis.com/auth/content, with your separate permission): the account ID and name and, for every product, its title, page link, price, currency, availability, approval status in Google Shopping and the main disapproval reason, as well as the attributes needed to analyse feed completeness: brand, Google category, gender, age group, colour, material, whether a GTIN and an image are present, and the length of the description (we do not store the description text itself). The Service does not read orders, customers, or payment or tax data from Merchant Center. If you use feed improvement, the Service additionally reads, live and only for the products you selected, their title, description, brand, product type, page link, Google category, gender, age group, colour and attributes: these are sent to the AI provider (section 2) and are not stored except for the suggestions the AI prepares (the original value and the proposed one), which are kept in your workspace until you delete them.
• Google Analytics 4 (permission https://www.googleapis.com/auth/analytics.readonly, read-only, with your separate permission): the list of Google Analytics accounts and GA4 properties you can access (account and property name and ID), so you can choose which property to connect, and, for the property you choose, aggregated report figures for a fixed period: users, sessions, key events (conversions), bounce and engagement rates, sessions, transactions and purchase revenue by channel group (for example, organic search, paid search, direct), users and key events by device category, and revenue and quantity purchased by product name. The Service does not read individual visitor data: no user IDs, client IDs, individual visitor paths, audiences, page-level or event-level logs, and it does not modify the property, its settings, audiences or data streams.
• Google Search Console (permission https://www.googleapis.com/auth/webmasters.readonly, read-only, with your separate permission): the list of sites you can access (address and permission level) so you can choose which one to connect, and, for the site you choose, aggregated figures for a fixed period: clicks, impressions, CTR and average position, top search queries and top pages. The Service does not read individual visitors' data.

The Service does not change anything in the connected accounts — see section 3.

Google data may be stored in the raw form needed for synchronisation and in derived form: account snapshots, calculated metrics, audit findings, logs. These data stay linked to your account; we do not use them to create cross-customer profiles, advertising audiences or benchmarks, and we do not prepare anonymised or aggregated datasets from them for sale, advertising or model training.

Technical credentials: OAuth access and refresh tokens issued by Google when you grant consent. They are stored encrypted.

Telegram (optional): if you connect Telegram alerts, we receive the chat identifier Telegram issues so we can send critical alerts about your account there. We do not receive your phone number, contacts, or Telegram messages beyond this identifier. You can disconnect Telegram and delete this identifier at any time in settings. If you enabled Telegram, a short weekly summary of your account (spend, revenue, audit score, new and resolved findings) is also sent there.

Support and usage: messages you send us, and basic technical logs (time of request, error messages, IP address) needed to run and secure the Service.

AI assistant (if you use it): the text of your questions, the assistant's answers and deep-audit reports. They are stored in your workspace and you can delete them at any time. If you use feed improvement, the suggestions the AI prepares (the original and proposed values of titles, descriptions, categories and attributes), the product label rules you set and the weekly snapshots of your account are also stored in your workspace.

Visitors to agencyos24.com: technical data about a visit (page address, device and browser type, approximate country) and a browser identifier in Google Analytics cookies. This is website visit statistics; it contains no data from your workspace or advertising accounts.

We do not ask for Google Workspace, Gmail, Drive, Contacts or Photos permissions, and we do not read data of your customers' personal accounts. The connection of your own Google Analytics 4 property (read-only) described above is optional and separate from the Google Analytics cookies on our marketing website (section 10).

2. How we use the data

We use the data only to provide the features you see in the Service:

• to build snapshots of your account and show audit findings and alerts, visible only to you and to people you invite;
• to show, from your Google Analytics 4 property, real orders and revenue across all channels, traffic sources and devices, top products, and the share of advertising in revenue;
• to send you service messages (confirmations, alerts you enabled);
• to prevent abuse and keep the Service secure and working.
• to answer your questions and prepare reports with the AI assistant (see below).
• to prepare, at your request, suggestions for improving product data (titles, descriptions, categories, attributes) and product labels, and to give them to you as an XML file for a supplemental feed;
• to build a weekly snapshot of your account.

Artificial intelligence. To answer a question or prepare a report we send the language-model provider minimised data from your workspace: campaign metrics for the period, campaign and product names, audit findings, product statuses in Merchant Center, aggregated figures from your connected Google Analytics 4 property (the report totals described in section 1) and the text of your question. We do not send OAuth tokens, your password, your e-mail address or the identifiers of your Google accounts. The numbers are calculated by the Service itself; the model only explains them. Providers: Google (Gemini API) and OpenAI (GPT); which one answers depends on your plan, and we may change the provider by updating this policy. Under the terms of these providers' paid APIs, the data sent is not used to train their models. Providers may process data outside Ukraine and the European Economic Area; we send them only the minimised data described above. For feed improvement we send the AI provider (Google Gemini API) the title, description, brand, product type, page link and attributes of the products you selected, and no other data.

We do not sell your data, use it for advertising, or combine it with other users' data to build profiles. We keep only operational statistics about the Service (for example, how many audits ran); they contain no data received from Google APIs.

Supplemental XML feed. If you use feed improvement on a paid plan, the Service publishes a file at an address that contains a secret token. It has no sign-in because Google Merchant Center fetches it itself after you add it as a supplemental feed. The file contains only product identifiers (offer IDs) and the values you approved: titles, descriptions, categories, attributes and product labels. It contains no prices, account data or tokens. Anyone who knows the address can read the file, so do not publish it; you can replace the address at any time with the button in the Service, and the old one stops working. The file stops being served when the paid period ends.

3. Changes to your account

The Service currently only reads data from the connected Google Ads, Merchant Center and Google Analytics 4 accounts and does not change anything in them. The one action in Merchant Center is registering the Service's Google Cloud project in your account (an API access setting that Google itself requires): it changes no products, feeds or store settings. If we add a feature that makes changes (for example, pausing a campaign or adding a negative keyword), it will work only after your explicit approval of each action or a specific set of actions you have reviewed; every applied change will be recorded in a log (what changed, the previous value, when) and, where the platform allows it, can be reverted from the Service. We will update this policy before that feature launches. The XML file described in section 2 is fetched by Google Merchant Center only after you yourself add it there; the Service writes nothing to your Merchant Center.

4. Our role

For your sign-in data, we are the data controller. For data from your connected advertising account, we act on your instructions to deliver the features you requested (in GDPR terms, as a processor); you remain responsible for having the right to connect that account.

5. Google API Services User Data Policy

AgencyOS 24/7's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data received from Google APIs:

• is used only to provide and improve the user-facing features described above;
• is not transferred to others except as needed to provide those features, to comply with law, or as part of a merger or sale with notice to you;
• is not sold and is not used for serving advertisements;
• is not used to develop, improve or train generalised artificial-intelligence models;
• is not read by our staff unless you ask for support, it is needed for security or abuse investigation, or the law requires it.

6. Who else processes the data

We share data only with providers that are needed to run the Service, under agreements that limit their use of it:

We do not disclose Google data to other customers or publish it. Providers may process data only on our instructions and may not use it for their own advertising or to train artificial-intelligence models.

We may also disclose data to authorities when required by law, and to advisers bound by confidentiality. Providers may change; in particular, we plan to add a payment provider — this list will be updated before they start processing data, describing where the data is processed and what safeguards apply for transfers outside Ukraine or the European Economic Area.

7. Storage and security

Data is stored on servers of Hetzner Online GmbH in Germany (European Union). It is encrypted in transit (HTTPS/TLS). OAuth tokens are encrypted at rest with a dedicated key that is kept separately from the database. Passwords are stored only as hashes (scrypt), and tokens from e-mails only as hashes. Every account's data is isolated from other accounts, and access by our staff is limited to what is needed to operate the Service. No system is perfectly secure; if a breach affecting your data occurs, we will notify you as required by law.

8. Retention and deletion

• Disconnecting a source (Google Ads, Merchant Center or Google Analytics 4) revokes our access token at Google and stops synchronisation. Historical data that was already saved stays in your account until you delete it or the account.
• Deleting your account in the Service ("Profile → Delete account and all data") removes your account data and imported advertising data from our active systems and revokes all tokens at Google. Deleted data leaves backups within 30 days.
• AI assistant conversations and deep-audit reports are kept in your workspace until you delete them or delete the account.
• Data of the deep audit and feed improvement: search terms and conversion actions are replaced with each daily refresh; our copy of the account change log is kept up to 35 days; AI suggestions, label rules and weekly snapshots are kept until you delete them or delete the account.
• Legal records (if any arise, for example payment records) will be kept for as long as accounting and security laws require.
• You can also ask by e-mail; we act on deletion requests within 30 days.

9. Your rights

You can ask us to give you access to your data, correct it, delete it, restrict or stop its processing, and export it in a common format. If you are in the European Economic Area or the United Kingdom, these are your rights under the GDPR, and you may complain to your data-protection authority. Write to support@agencyos24.com. We may need to verify that the request comes from you.

10. Cookies

In the dashboard (app.agencyos24.com) we use only cookies and similar storage that are necessary to keep you signed in and to remember interface preferences; there are no analytics, tracking or advertising cookies there.

On the marketing website agencyos24.com we use Google Analytics 4 (Google LLC) to see which pages are read and where visitors come from. This is our own website statistics and has nothing to do with the optional connection of your own Google Analytics 4 property to the Service (section 1). It sets analytics cookies (_ga, _ga_*). Advertising signals and ad personalization are turned off. For visitors from the European Economic Area, the United Kingdom and Switzerland, consent to analytics cookies is declined by default: Google Analytics sets no cookies for them and stores no browser identifiers, although it may receive technical request data. You can block cookies in your browser settings or install the Google Analytics Opt-out add-on, and the website works the same.

11. Children

The Service is for businesses and is not directed at people under 18. We do not knowingly collect their data.

12. Changes to this policy

If we change this policy in a material way — in particular when we add a new data source (for example, a new Google service), payments, or AI-based features — we will publish the new version on this page before we start processing data in the new way, and, where appropriate, e-mail you. The version and date at the top show when it took effect.

13. Contact

support@agencyos24.com · Telegram: t.me/agencyos24