Privacy Policy

Data we collect

Account information. Your email address, your name (if you provide it), language preference, a one-way hash of your password (we never see the password itself) and your two-step verification records. If you sign in with Google or Apple, we receive only your name, email address and account identifier from that provider. If you use Apple's "Hide My Email", we reach you through Apple's relay address.

Workspace and team. Workspace names, members, roles and invitations.

Data from platforms you connect. When you connect Google Ads, Meta ad accounts, Google Analytics 4, Google Tag Manager or Search Console, we read the data the Service needs to work for you: account and property names, campaign, ad group and ad structures, budgets, performance metrics, conversion and tag configurations, and search performance. The access tokens (OAuth tokens) you grant are stored in an encrypted vault (Supabase Vault).

Ad account setup. If you use the ad account setup wizard, we store: how far the setup has progressed, the goal you choose (Meta, Google or both), which accounts you tell us you have (e.g. a Facebook, Instagram or Google account, a phone, a website; only whether you have them), the business name, country, time zone and currency you enter for the new account, your website address if you provide one, the IDs of the assets created for you (business portfolio, ad account, Google Ads account) and the email address the Google Ads invitation was sent to. This data is deleted when the workspace or your account is deleted. Accounts opened on the platforms belong to you, so deleting data in ad10 does not close them. You never enter card details in ad10; you add your payment method on Meta's or Google's own payment page.

Assistant content. Messages you send to the assistant, its replies, the tools it used and their results, the change proposals it prepared and the approve / reject decisions made on them.

Usage and billing. Your plan, credit usage and number of approved changes. If you pay, your card details stay with the payment provider or app store; we never see or store your card number.

Technical data. IP address, browser / device type, request times, security events (e.g. sign-in, password change) and error logs.

Communications. Information you send us when you contact support.

How we use data

• To provide the Service: open your account, connect your platforms, set up the ad accounts you request, answer your questions, produce reports and apply the changes you approve.
• Security: prevent unauthorized access and abuse, and protect your account.
• Billing and credits: track plan limits and credit usage.
• Account emails: transactional emails such as verification, password reset and security notices. We don't send marketing emails without your explicit consent.
• Improving the Service: fixing bugs and developing features, using aggregated and de-identified data wherever possible.
• Complying with legal obligations.

Our legal bases are performance of a contract, legal obligations, our legitimate interests (security, service improvement) and, where required, your consent (KVKK art. 5; for EU users GDPR art. 6(1)(b), (c), (f) and (a)).

Artificial intelligence

The assistant uses AI models to answer your questions (currently Anthropic's Claude models). When you ask something, your message and the account data needed for the answer are sent to the model provider over its API. Under our commercial agreement with the provider, this data is not used to train the provider's models. We don't use your data to train AI models either.

AI output can be wrong. That's why the assistant never changes your ad accounts directly: it prepares a proposal, and the change is applied only after an authorized team member approves it.

Google user data

ad10's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use your Google data only to provide and improve the user-facing features of the Service (analyzing and reporting on your ad accounts, setting up the ad account you request, applying the changes you approve).
• We don't sell your Google data, and we don't use or transfer it for advertising, retargeting, credit-worthiness assessment or data brokering.
• We don't use your Google data to develop, improve or train generalized AI or machine learning models. We send it to the model provider described above only to generate an answer you asked for.
• Our staff do not read your Google data, except with your permission (e.g. a support request), for security or abuse investigations, or where required by law.

Google permissions we request: Google Ads (adwords), Google Analytics read-only (analytics.readonly), Tag Manager read-only (tagmanager.readonly), Search Console read-only (webmasters.readonly) and basic profile information to identify your account. You can revoke access at any time by disconnecting in ad10 or on your Google Account linked apps page (Access to your Google Account → ad10 → Remove access).

Google Ads account setup. If you ask ad10 to open a Google Ads account for you, ad10 creates it under ad10's own Google Ads manager (MCC) account and invites the email address of the Google account you connected as an administrator (ADMIN). Once you accept the invitation, the account is yours and you control it; you can remove the link to ad10's manager account in Google Ads at any time. Using the adwords permission, ad10 lists the Google Ads accounts you can access (to find your existing or newly opened account and to see that the invitation was accepted) and checks the status of the account's billing setup. You enter your card and billing details on Google's own page; ad10 never sees them.

Meta data

When you connect Meta ad accounts, we read ad account, campaign, ad and performance data within the scope Meta permits (Facebook Login for Business) and apply the changes you approve. We use this data only to provide the Service to the business that connected it; we don't sell it or use it to target ads to others. When you disconnect, the access token is deleted. For deleting Meta data, see the data deletion instructions.

Ad account setup on Meta. If you start the setup wizard, you sign in with Facebook (Facebook Login for Business) and give ad10 a user access token with these permissions: business_management, ads_management, ads_read, pages_show_list, pages_read_engagement, pages_manage_ads, catalog_management. With this token, and only for the steps you start, ad10 acts on your behalf and in your name to:

• read the list of your Facebook Pages (and any Instagram professional account linked to them), your business portfolios (including their verification status) and your ad accounts;
• create a business portfolio if you don't have one;
• create an ad account under your portfolio and assign the portfolio's admins to it;
• check the ad account's status and whether a payment method has been added (funding_source_details).

The portfolio and the ad account are created in your name and belong to you; ad10 does not become their owner. You add your card on Meta's own payment page; ad10 never sees or stores your card number or other card details. To show that the step is complete, we keep only the masked description Meta returns (e.g. the card brand and last four digits).

Who we share data with

• Subprocessors: infrastructure providers we use to run the Service. Current list: Subprocessors.
• Platforms you connect: to apply the changes you approve and carry out the ad account setup steps you start, we send requests to Google and Meta through their APIs. These platforms process data under their own policies.
• Your team: members of your workspace see that workspace's data as far as their role allows.
• Legal requirements: lawful requests from competent authorities.
• Corporate transactions: in a merger or acquisition the protections in this policy continue; we'll notify you in advance.

International transfers

Your data is primarily stored in the European Union (Frankfurt). Some subprocessors (e.g. the AI and email providers) process data in the USA. These transfers rely on the standard contracts published by the Turkish Personal Data Protection Board under KVKK art. 9 and, for EU users, the European Commission's standard contractual clauses or adequacy decisions.

Retention

• Account and workspace data: for as long as your account is open.
• Platform access tokens: deleted immediately when you disconnect.
• Chats and change history: until you or the workspace owner delete them, or the account is deleted.
• Ad account setup data: until the workspace or the account is deleted.
• When you delete your account, live data is deleted immediately and removed from backups within 30 days.
• Technical logs: up to 90 days.
• Invoices and payment records: as long as tax and commercial law requires (up to 10 years).

Security

All connections are encrypted with TLS and data is encrypted at rest. Access tokens are additionally kept in an encrypted vault. We use row-level authorization in the database: each user can reach only the data of workspaces they belong to. We recommend turning on two-step verification. No system is perfect; if a data breach occurs, we'll notify affected people and authorities within the legal deadlines.

Your rights

You have the right to access, correct and delete your data, restrict or object to processing, receive your data in a portable format and withdraw consent (KVKK art. 11; GDPR art. 15–22). You can see and correct most of your data in the app and delete your account yourself. For other requests, write to privacy@ad10.app from your account's email address; we reply within 30 days. You can complain to the Turkish Personal Data Protection Board or, in the EU, to your local data protection authority.

Cookies

We use only cookies that are strictly necessary for the Service; no analytics or advertising cookies. Details: Cookie Policy.

Children

The Service is for businesses and professionals. It is not directed to anyone under 18, and we don't knowingly collect data from children.

Changes

We may update this policy. We'll announce material changes by email or in-app notice before they take effect. The date at the top shows the last update.

Contact

Noyan Bilişim

• Authorised representative: Evren Noyan Kalay
• Address: [Registered address]
• MERSİS: [MERSIS no]
• Tax: [Tax office / no]
• Support: support@ad10.app
• Privacy and KVKK: privacy@ad10.app