Privacy Policy

1. Information We Collect

AdPilot collects information you provide directly: your name, email address, and password when you create an account. If you connect your Google Ads account, we store an OAuth refresh token to enable API access on your behalf.

We also collect website URLs you submit for campaign generation, and usage data to improve the service (page views, feature interactions).

2. How We Use Your Information

• To provide and operate the AdPilot service
• To generate Google Ads campaigns using AI based on URLs you submit
• To push campaigns to your Google Ads account (only when you authorise it)
• To send transactional emails (password reset, account notifications)
• To improve our AI generation quality

3. Data Sharing

We do not sell your personal information. We share data only with service providers necessary to operate AdPilot (database hosting, AI API, email delivery). We may disclose information if required by law.

4. Google Ads Account Access & Google User Data

Connecting your Google Ads account is optional. When you connect, you sign in through Google's secure OAuth flow and grant AdPilot permission to read and manage Google Ads campaigns on your behalf (the adwords scope). This access is what lets AdPilot build, review and publish the campaigns you generate, and read basic account information (such as the account IDs you can access and a linked Merchant Center, where applicable) so you can choose where campaigns are created.

We only ever use this access to provide the service to you. Specifically:

• We perform only the actions you explicitly initiate: generating, editing and pushing your campaigns.
• Campaigns are always created paused; AdPilot never spends your budget or launches ads automatically.
• We never use Google user data for advertising, never sell it, and never share it with third parties except the service providers needed to operate AdPilot (and never for their own purposes).
• We never use your Google Ads data to train, retrain or improve any artificial intelligence or machine-learning models. AdPilot's AI generates campaigns from the website URL you provide, not from your Google Ads account data.
• Humans do not read your Google Ads data except where strictly necessary for security, to comply with applicable law, or with your explicit consent for support.

We store your OAuth refresh token securely and treat it with the same care as a credential. You can revoke AdPilot's access at any time, by clicking Disconnect in AdPilot Settings, or from your Google Account under Security → Third-party access.

AdPilot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Retention

We retain your account data for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us.

6. Security

Passwords are hashed using bcrypt and all data is transmitted over HTTPS. Sensitive credentials, including the Google OAuth refresh token used to access your Google Ads account, are encrypted at rest using AES-256-GCM. We use industry-standard practices to protect your data, though no system is perfectly secure.

7. Cookies & Tracking

We use strictly necessary cookies for site security and user authentication. We also utilize performance and analytics cookies (such as Google Analytics) to understand visitor traffic, and targeting cookies to tailor marketing messages.

Where you are determines how these are applied. If you are visiting from the European Economic Area, the United Kingdom, or Switzerland, no analytics or advertising cookies are set until you accept them in the cookie banner, and if you decline they stay off. Everywhere else, these cookies are active by default and you can switch them off at any time using the control below. A choice you record is respected wherever you are.

When you buy a subscription and tracking is permitted under the rules above, the purchase (amount and currency) is reported to Google and Meta as an ad conversion. The report to Meta may also be sent from our server for reliability and can include your email address in one-way hashed form, so Meta can match the conversion without receiving the address itself. You can change or withdraw your choice at any time:

8. In Short

AdPilot connects to your Google Ads account, with your permission, to create and manage campaigns on your behalf, always created paused for your approval. We never share your data with third parties for their own purposes, and we never sell it. Our use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Contact

Questions about this policy? Email us at privacy@adpilotapp.com or use our contact form.