Privacy Policy

1. What this policy covers

This policy covers advisorppc.com, AdvisorPPC accounts and workspaces, our advertising and analytics connectors, our remote Model Context Protocol (MCP) services, and related support. A connected provider or AI client applies its own privacy policy to information it controls.

2. Information we collect and access

• Account and contact information. Name, email address, company, workspace, role, sign-in records, and information you submit through a form or support request.
• Sign-up source. When you first arrive on advisorppc.com, a first-party cookie (apc_touch, kept for up to 90 days) remembers the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), an ad click identifier if the link carried one (gclid or fbclid), and the page you landed on. On the sign-in page, a second cookie (apc_cc, kept for one hour) holds the two-letter country our network provider, Cloudflare, reports for your visit. If you create an account, we store those values with it. We do not store your IP address with them. We use them to count which posts, ads, and countries bring sign-ups and to choose regional consent defaults. When advertising consent permits, stored ad click identifiers may also be shared with Google Ads or Meta to attribute a sign-up or purchase, as described below.
• OAuth connection information. The connected identity, provider account identifiers, approved scopes, token expiry, and encrypted access or refresh credentials supplied by the provider.
• Advertising and analytics data. Account and manager hierarchy, campaign structure and status, budgets, bids, targeting, ads and creative metadata, keywords, search terms, conversion and performance metrics, attribution data, and other fields needed for the feature you request.
• Requests, approvals, and service records. Tool requests, dry-run results, explicit approvals, bounded change records, timestamps, error and security events, subscription status, and the minimum operational logs needed to run and protect the service.

3. Google data and why authorization is required

For the public Google Ads connection, AdvisorPPC requests basic identity scopes so we can bind and display the connected Google identity, plus the Google Ads scope so the features you select can read accessible Ads accounts, campaign configuration, search-term and performance data, and execute a supported confirmed change. We request a product-specific grant and do not use a Google Ads authorization to access unrelated Google products.

AdvisorPPC uses and transfers Google API data in compliance with the Google API Services User Data Policy, including its Limited Use requirements. We limit Google data to providing or improving visible user-facing features; we do not sell it, use it for advertising, or provide it to data brokers.

4. How we use information

• Authenticate you and keep workspaces isolated.
• Connect accounts you authorize and return the account, reporting, audit, or management result you request.
• Generate visible analysis, recommendations, reports, and drafts, and apply a supported change only after the required confirmation.
• Operate subscriptions, prevent abuse, investigate incidents, troubleshoot errors, and maintain service reliability.
• Reply to support, privacy, security, and account-deletion requests.

5. When information is shared

We share information as needed to provide the service you choose, protect it, comply with law, or carry out the advertising and measurement described below under your consent settings:

• Connected platforms. We send authorized API requests to Google, Meta, Microsoft, or another platform you connect.
• AI clients you choose. When you use AdvisorPPC through ChatGPT, Claude, or another compatible client, that client sends a structured request and receives the responsive result for your conversation. OAuth tokens, provider passwords, and client secrets are never included in tool results.
• Service providers. Infrastructure, database, monitoring, security, payment, and support processors may handle the minimum information needed to perform services for AdvisorPPC under confidentiality and security obligations.
• Legal and safety needs. We may disclose information when required by law or reasonably necessary to protect users, the public, AdvisorPPC, or the integrity of the service.

We do not sell personal information or connected-platform data or share it with data brokers. Customers' connected ad-platform data is never used for our advertising, retargeting, or personalized advertising. We do not use personal information or connected-platform data for credit decisions or surveillance.

Advertising and measurement

When enabled, we use Google Analytics 4 (GA4) to understand use of AdvisorPPC, and Google Ads and Meta to measure our ads and show relevant ads to people who visited our site. Google tags run through Google Tag Manager. We may also enable TikTok, LinkedIn, X, Reddit, and Microsoft Advertising on our public marketing pages. These vendors may set analytics or advertising cookies only when the corresponding consent setting is granted.

Before a saved choice, analytics and advertising are off in the EEA, United Kingdom, Switzerland, and Canada. We use the country signal when available, otherwise your browser time zone; if neither is available, we ask first. A browser's Global Privacy Control signal turns advertising off by default everywhere. Elsewhere, analytics and advertising are on by default until you opt out. Google may receive measurement and consent signals without cookies when consent is denied; these do not permit advertising cookies or personalized advertising.

Depending on your consent settings, shared information includes page visits and campaign or click identifiers; sign-up, connection, checkout, and purchase events; plan and sign-in status; connected provider names and counts; account-age and activity ranges; and purchase value and currency. These describe your use of AdvisorPPC. We never use the campaign contents, budgets, audiences, reports, or performance data from your connected ad-platform accounts for our advertising.

With advertising consent, sign-up and purchase conversions may be sent to Google Ads and Meta with a SHA-256 hash of your trimmed, lowercased account email for matching. The original email is not sent by this tracking layer. A hash can still be matched to an account by the receiving vendor. Meta may also receive a hashed account identifier, your IP address, browser information, page URL, and Meta click or browser identifiers. The hashed email may also accompany signed-in website events in the tag data used for Google Ads enhanced conversions. After you sign in, the Meta and TikTok pixels on our marketing pages also receive the same hashed email when they load, so that vendor can match your visit to your account there.

When tracking is enabled, open Cookie settings in the footer to accept, reject, or change analytics and advertising separately. Reject all turns both off. Do not sell or share my personal information turns advertising off immediately. Your saved choice applies to this browser for up to 13 months, and you can change it at any time. Withdrawing consent stops future consent-based sharing; it does not recall information already received by a vendor. When tracking is disabled, these controls are hidden because there are no enabled tags to configure.

6. Security and human access

Provider and client traffic uses HTTPS/TLS. Stored OAuth credentials use the application's credential-encryption layer and are restricted to services that need them for an authorized request. We limit human access to cases where you ask for support and consent to the access, where access is necessary to investigate security or abuse, where law requires it, or where data is aggregated for legitimate internal operations. No internet service can promise absolute security.

Learn more on our security page.

7. Retention, revocation, and deletion

• Short-lived OAuth state and authorization records expire and are single-use.
• OAuth credentials are retained while needed to operate an active connection. You can disconnect through AdvisorPPC and can also revoke access from the provider's security controls.
• Read-only connector calls do not intentionally persist full provider response bodies in the tool-call log. Bounded security, billing, and change-audit records retain the minimum metadata needed for those purposes.
• We retain account, workspace, support, and operational data while your account is active and afterward only as reasonably needed for security, legal, billing, or dispute-resolution obligations.

To request access, correction, export, or deletion of data controlled by AdvisorPPC, email [email protected]. We will remove data we control unless a limited legal, security, billing, or dispute obligation requires retention. Deleting AdvisorPPC data does not delete copies already sent at your direction to an AI client or held by a connected platform; use that service's controls for data it controls.

Shield: data about your website's visitors

AdvisorPPC Shield detects invalid paid clicks. It is documented at advisorppc.com/docs/shield. Unlike our other connectors, Shield handles data about the people who visit your website, so this section applies in addition to the rest of this policy.

• What the site tag records. For each visit that arrives from an ad click: the IP address, browser user agent, a hashed device fingerprint, referrer, landing URL, ad click identifiers and UTM tags, device type, operating system, browser, screen resolution, time-zone offset, approximate country and region, and behaviour signals (mouse-movement variation, scroll depth, time on page, whether a key was pressed but never which key, and whether a hidden honeypot field was touched). Shield adds the fraud score, its reasons and the verdict. It does not record names, email addresses, form contents or what a visitor types.
• Why. Only to score clicks for invalid traffic, show you the results, and exclude the IP addresses you approve from your own ad campaigns. Visitor data is not sold, not used to advertise to anyone, not combined across customers, and not used to train AI models.
• Your role and ours. You decide to install the tag on your site and are the controller of your visitors' data: give them the notice, and obtain the consent, that your law requires. AdvisorPPC processes the data on your behalf and only on your instructions, and keeps each workspace's data separate from every other.
• Where it goes. IP addresses you approve for exclusion are sent to your Google Ads account through Google's API. Data-centre detection uses published cloud-provider address ranges held on our own servers; visitor IP addresses are not sent to outside reputation services. For Microsoft Advertising, Shield gives you a list to paste in yourself.
• Retention and deletion. Click records are kept while your Shield workspace is active, so repeat clicks can be recognised over time. Email [email protected] to delete your click history or your whole Shield workspace; a visitor of your site who contacts us is referred to you, and we act on your instruction. Exclusions already added to your ad accounts stay there until you remove them.
• Ad-platform access. Your Google Ads and Microsoft Advertising connections use each provider's own sign-in; Shield never receives your password, and the refresh tokens are encrypted before they are stored.

8. Your choices and rights

You choose which platforms to connect, which permissions to grant, which accounts to map, and whether to approve a supported state-changing action. Depending on your location, you may also have rights to access, correct, export, delete, restrict, or object to processing and to withdraw consent. Revoking a provider grant stops future API access but may not by itself delete the AdvisorPPC account or required audit records.

Gravity: your sites and the leads your forms capture

AdvisorPPC Gravity plans, writes and publishes content for your websites and captures leads from their forms. Its Claude connector is documented at advisorppc.com/docs/gravity. This section applies in addition to the rest of this policy.

• Site data. For each site you add: its name, domain and settings, the business profile you give, tracked keywords, planned and published pages, site audit and checklist results, and stored Search Console and GA4 figures. Search Console and GA4 are read under the Google account you connect, and its refresh token is encrypted before it is stored. A WordPress application password, if you connect WordPress, is also encrypted and is never returned by any tool.
• Lead data. When a visitor submits a form on your site that uses the Gravity form tag, Gravity stores what the form sends: usually a name, email address, phone number and message, with the page it came from, a spam score and the lead's status. The tag sets no cookie, and Gravity does not store the visitor's IP address with the lead.
• Your role and ours. You are the controller of your leads and your visitors' data: tell them how you use their details in your own privacy notice. AdvisorPPC processes lead data on your behalf, only to show it to you and your workspace, and keeps each workspace separate. Leads are not sold, not used to advertise to anyone, and not used to train AI models.
• The Claude directory connector. The read-only Gravity connector returns lead counts only, never a lead's name or contact details, and it cannot publish, edit or delete anything.
• Retention and deletion. Site and lead data are kept while your workspace is active, so your pipeline and history stay complete. Email [email protected] to delete a lead, a site or your whole workspace; a person who asks us about a lead your site captured is referred to you, and we act on your instruction. Pages already published to your website stay there until you remove them.

9. Changes to this policy

We will update this page and its effective date when our practices change. If a material change affects how we use connected-platform data, we will provide an appropriate notice and request renewed consent when required before using the data for the new purpose.

10. Contact

Send privacy questions, security reports, and data requests to [email protected]. Do not send passwords, OAuth tokens, API keys, or authentication codes by email.