netroas privacy policy

Controller and contact

Controller: [NAZWA FIRMY / COMPANY NAME], [ADRES], [NIP/KRS]. Data protection contact: [E-MAIL KONTAKTOWY]. Data protection officer: [IOD/DPO — jeśli wyznaczony].

Role split [DO WERYFIKACJI PRAWNEJ]: netroas processes Google Ads, GA4, Search Console and Merchant Center data on the customer's behalf, so for that data it most likely acts as a processor (data processing agreement — DPA). For account and contact data (e-mail, consent, technical journal) netroas is the controller.

What we collect

• The e-mail you type into the form (a contact address, not verified), plus the consent version and time.
• With Google sign-in netroas receives your Google account identifier (sub) and verified e-mail address (scopes openid, email). We use them to identify the owner of the netroas account and to enforce plan limits (number of Google Ads accounts, the Free monthly change quota); they are stored in the account record (tenants table: owner “google:<sub>” and owner e-mail). Accounts created earlier have a hash of the form e-mail (SHA-256, 32 characters) as owner — on a Google sign-in with the same verified address they move to the Google identifier.
• Your Google refresh token (offline access) and the list of scopes actually granted.
• Google Ads account ID and name, manager account ID, account currency and time zone, the chosen Search Console property, GA4 property and Merchant Center account.
• Audit results (Google Ads data: campaigns, keywords, search terms, costs, conversions) stored in the netroas database.
• Settings you provide: goal, budgets, strategy limits, strategy text, work mode, and their history.
• Change and campaign proposals: the before state, the request and the preview; for a new campaign also business name, website, categories, products, facts, competitors, ad copy and uploaded images (up to 3 PNG/JPG files, up to 5 MB each).
• Change log: what, when, who (customer, autopilot, guard, weekday schedule), values before and after. Log rows cannot be edited or deleted.
• Assistant connection data (MCP OAuth): the client app registration (name, redirect addresses), authorisation codes, and access and refresh tokens linked to your account.
• Technical events: event type, time and a reference (account identifier, MCP client ID or account name). A home-page visit is counted as an event without an IP address.
• E-mail queue: recipient, subject, body, delivery state.
• Server logs for OAuth and MCP addresses: method, path (with the account secret hidden), status, response time, client family (e.g. claude, chatgpt-openai), whether an Origin header was present and the Origin host if it is on the allowlist. No IP address and no tool arguments.

Purposes and legal bases [DO WERYFIKACJI PRAWNEJ]

• Providing the service: audits, reports, proposals and changes you ask for — GDPR Art. 6(1)(b).
• Consent from the form — Art. 6(1)(a) (you may withdraw it; this does not affect earlier processing).
• Security, abuse prevention, change log, logs and funnel statistics — legitimate interest, Art. 6(1)(f).
• Service e-mails (weekly report, spending-guard alert, data-deletion notice) — Art. 6(1)(b) or (f).
• Legal obligations, e.g. billing for paid plans — Art. 6(1)(c).

Google user data

netroas requests these scopes from Google (with offline access, so background jobs work without you being present):

• Identity (openid, email) — your Google account identifier (sub) and verified e-mail address, used only to identify the owner of the netroas account and enforce plan limits; netroas reads no other profile data.
• Google Ads (https://www.googleapis.com/auth/adwords) — reads account reports (campaigns, ad groups, ads, keywords, search terms, budgets, bidding, costs, conversions) and Keyword Planner ideas; writes only the operations described below.
• Search Console (webmasters.readonly) — read only: queries, clicks, impressions and positions of the chosen property, to assess demand.
• Google Analytics 4 (analytics.readonly) — read-only reports, e.g. purchases from paid traffic, to compare with Google Ads conversions.
• Merchant Center (content) — Google offers this scope as read and write. netroas code calls only the product list and a report query (reports:search): product status, disapprovals and their reasons. It writes nothing to Merchant Center.

Writes to Google Ads: changes you confirm in the assistant (preview → your “yes” → execution): negative keywords, daily budget, tROAS/tCPA target, pausing and resuming campaigns, ad groups and ads, excluding and restoring a product, creating a new campaign (it starts paused) and undoing a change. Autopilot performs some of these operations on its own only if you enable it separately on the netroas website, at the earliest after 14 days in confirmation mode (the Free plan has no autopilot). In autopilot the spending guard may pause a campaign that exceeded its daily ceiling and resume its own pause; in confirmation mode it only proposes and sends an alert. The day-of-week budget schedule runs only after the owner approves it.

Proposal previews are checked with Google in validateOnly mode — Google validates the change and saves nothing.

Limited Use commitment (in the wording Google requires):

netroas's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy — https://developers.google.com/terms/api-services-user-data-policy

• We do not sell Google user data.
• We do not use it for advertising, retargeting or ad profiling.
• We do not use it to train generalised AI/ML models.
• Humans do not read this data unless you consent, it is needed for security or abuse investigation, the law requires it, or the data is aggregated and anonymised for internal operations.
• We transfer data only to provide features you request — including to the AI assistant you connected yourself (below).

AI assistants

Tool results (numbers from your accounts, proposals, reports) go to the assistant you connected: e.g. Claude (Anthropic), ChatGPT or Codex (OpenAI), Cursor, VS Code. The assistant's provider processes them under your own agreement with that provider.

netroas does not receive your conversation history — only the tool calls and arguments the assistant sends.

The server keeps no separate log of tool calls or their arguments. The /mcp request log contains only the fields listed under “What we collect”. Arguments are stored only when a tool by its nature saves something: a proposal (request and reason), goal and strategy limits, new-campaign inputs and ad copy, the change log. We also count daily calls of the rule tools and API operations per account.

The assistant can make mistakes. That is why account changes require a preview and your confirmation, and the server enforces limits itself.

Recipients and subprocessors

• Google — the Google Ads, GA4, Search Console and Merchant Center APIs; the Gmail API (gmail.send scope on the netroas sender account) for service e-mails, so the recipient address, subject and body pass through Google.
• Hosting provider: [DOSTAWCA HOSTINGU, LOKALIZACJA].
• Google Fonts — public netroas pages load fonts from fonts.googleapis.com and fonts.gstatic.com; your browser then sends Google your IP address and User-Agent, among others. Private pages and the consent screen do not load Google Fonts.
• National Bank of Poland (api.nbp.pl) — the server fetches the exchange-rate table to display prices; it sends none of your data.
• MCP client metadata document (CIMD) — the server fetches it from the address given by the client app (e.g. the assistant provider); it sends none of your data.
• The AI assistant provider you choose — processes data under your agreement with it [DO WERYFIKACJI PRAWNEJ: role].
• Transfers outside the EEA: [DO WERYFIKACJI — e.g. Google LLC (USA), basis: EU-US Data Privacy Framework / standard contractual clauses; hosting location].

Retention and deletion

• An account connected with Google sign-in that has had no activity for 30 days (account older than 30 days, last use and last audit older than 30 days): the daily sweep (03:15 UTC) deletes the Google token and disables the account, deletes audits, proposals (with images), goal and strategy limits with history, work mode, settings, optimisation results, report links and counters; deletes the consent with the e-mail and the owner's verified e-mail, and replaces the account identifier in the change log, plan counters and events with a “(deleted)” marker. We send an e-mail about the deletion.
• Important: activity means any use of the account — the assistant connection, the installation page, sign-in, and also netroas background jobs (including the hourly spending guard and the weekly e-mail). While the account is enabled these jobs use it, so the 30-day period does not run. To have your data deleted right away, write to [E-MAIL KONTAKTOWY].
• What remains after deletion: the technical account record (Google Ads account ID and name, the owner — Google identifier (sub) or e-mail hash — plan, dates; the owner is kept so that re-creating an account cannot bypass plan limits [DO WERYFIKACJI PRAWNEJ: legal basis and retention period]), the change log with object names and before/after values (no longer linked to the account secret), plan counters, anonymised events, MCP app registrations (app name and redirect addresses) and unsent e-mails in the queue.
• Consent with an e-mail that never became an account: deleted after 30 days. Sent e-mails: deleted 30 days after sending.
• Assistant connection: authorisation sessions and codes are deleted after 1 hour, access tokens (valid 1 hour) after 2 hours, refresh tokens (valid 90 days, rotated on use) after 90 days.
• A proposal is valid for 24 hours; then it expires, but the record stays until the account is deleted. Images in PMax campaign proposals stay with the proposal.
• A report link (/view/…) is valid for 1 hour.
• Server logs: the system journal (journald) with the system's default rotation [DO WERYFIKACJI: retention period at the provider].
• Pilot accounts configured manually by the operator are not deleted automatically — we delete them on request.
• Deletion or a copy of your data: write to [E-MAIL KONTAKTOWY]; the service does not yet have a self-service export or delete button.
• Revoking Google access: https://myaccount.google.com/permissions — netroas loses access immediately; stored data remains until deleted as described above.
• Disconnecting the connector: in Claude — Settings → Connectors → netroas → Disconnect; in ChatGPT — Settings → Apps & Connectors. This ends the assistant's access; it does not delete data in netroas.

Security

• Connections are encrypted with HTTPS (redirect from HTTP, Let's Encrypt certificate).
• Request logs hide the account secret in the path and contain no IP address; web-server and application access logs are disabled.
• Report-link tokens are random, valid for 1 hour and stored only as a SHA-256 hash.
• Account changes go through a closed operation registry, policy and server-side limits; the change log cannot be edited.
• DNS-rebinding protection and an Origin allowlist for the MCP server; CIMD documents are fetched with SSRF protection.
• Google and MCP tokens and the account secret are stored in the server database and are not additionally encrypted by the application [DO WERYFIKACJI: encryption at rest before publication].

Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object, and to withdraw consent. Write to [E-MAIL KONTAKTOWY]. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl, or with the authority in your country.

Cookies and browser storage

netroas sets no cookies and uses no analytics or tracking tools. The home page remembers the chosen price currency in browser storage (localStorage), and the setup assistant remembers the chosen assistant (sessionStorage). These values are not sent to the server. For Google Fonts see “Recipients”.

Changes to this policy

We will announce material changes on this page and by e-mail if you gave one. The effective date is at the top of the page. Changing the consent text requires a new consent version.

Contact

[NAZWA FIRMY / COMPANY NAME], [ADRES], e-mail: [E-MAIL KONTAKTOWY].

• Terms
• Documentation