Privacy Policy

When you sign in with Google: your name, email address, profile picture and Google account ID.

From your Google Ads accounts, through the Google Ads API with the access you grant:

• ·Account names and IDs, time zone and currency.
• ·Campaigns, ad groups, keywords, ads and their headline and description text, final URLs, ad schedules and location targeting.
• ·Budgets, bids and bidding settings (read; see below for what we change).
• ·Performance data: impressions, clicks, cost, conversions, click-through and conversion rates, Quality Score and impression share, by day and by hour.
• ·Search terms: the actual queries people typed that triggered your ads.
• ·Ad approval and policy status, including the text of ads Google disapproved.

When you connect an account we read up to 37 months of history once, then refresh the most recent 90 days every 6 hours.

From your website: when you ask Rotatad to build a campaign or write ad copy, our servers fetch pages from your site (the page you give us, your About page and pages it links to) and extract facts about your business, such as ratings, credentials, service areas and pricing, so the copy we write is accurate. When Rotatad writes new copy for ads you already run, it reads the page those ads link to in the same way, at most once a month per site. Those facts are stored with your account.

Keyword research:when building a campaign we request keyword ideas and search-volume estimates from Google’s Keyword Planner and store them with the campaign draft.

Billing: payments are handled by Stripe. We never see your card details; we store your Stripe customer and subscription identifiers and your subscription status.

Early-access list: if you join it, your email address and the IP address you joined from. If you sign in with Google before you have been let in, we add your email address to the list, keep nothing else from your Google account, and give back the access you granted.

Logs: our servers log requests and errors. Some log lines include your email address (for example, when we send you an email).

• ·To analyse your campaigns and propose changes: which ad copy to replace, pause or add, which search terms to add as keywords or block, which hours to stop running ads, and when to split a campaign.
• ·To write ad copy and build campaigns, using an AI model (see “Anthropic” below).
• ·To make the changes you approve, or the kinds of change you have told Rotatad to make without asking (see below).
• ·To email you: decisions awaiting your approval, changes made, and problems with your account such as a disconnected Google login, a disapproved ad, a broken conversion tag, spend with no recorded conversions, or Rotatad stopping because your access or subscription ended.
• ·If you join the early-access list, to confirm it and to tell you when your access is ready.
• ·To contribute pseudonymised performance data to cross-customer benchmarks, unless you turn this off (see below).
• ·To keep the service secure and working.

We do not sell your data, and we do not use it for advertising.

The access you grant lets Rotatad change your Google Ads account. It can: edit, add and remove ad headlines and descriptions; add keywords (with a bid) and negative keywords; replace a campaign’s ad schedule; pause a campaign when you ask it to; create a conversion action; and create new campaigns, with a budget and bid settings, when you deploy a campaign it built or approve a campaign split.

By default, nothing changes until you approve it. You can choose to let Rotatad make certain kinds of change on its own. Changes made that way wait six hours before they are applied, and only go ahead if the evidence still holds. You can change this at any time in Settings.

New campaigns are created paused; you turn them on. When Rotatad creates a campaign it declares to Google, on your behalf, that the campaign does not contain EU political advertising, which Google requires for every new campaign.

We use these service providers. Each receives only what it needs for its part of the service:

• ·Anthropic (AI model): see the next section.
• ·Google: sign-in, and the Google Ads API.
• ·Resend (email delivery): your email address and the contents of the emails we send you, which can include account names, ad text, decisions and spend figures.
• ·Stripe (payments): your email address and Rotatad user ID, plus the payment details you give Stripe directly.
• ·Railway (hosting our servers, database and background jobs), Vercel (hosting this website) and Cloudflare (network): they process data in transit and at rest as part of running the service.

We do not sell or rent your data, and no one pays us for it.

Rotatad uses Anthropic’s Claude models, through Anthropic’s API, to write ad copy, to build campaigns from your website, and to classify your account and ad groups by industry and search intent. Deciding which changes to propose is done by statistical tests, not by the AI model.

What is sent to Anthropic, depending on the task:

• ·Your existing headlines and descriptions, and their performance figures.
• ·Your keywords and ad group names.
• ·Search terms from your account.
• ·Your website address, text from your website (which usually includes your business name, address and phone number), and the facts we extracted from it.
• ·Copy our checks rejected and the reasons, so the model can correct itself.

What is not sent: your email address, your Google account ID, your Google Ads account name and customer ID, your OAuth credentials and your billing details.

Under Anthropic’s commercial terms, data sent through its API is not used to train its models. Anthropic deletes API inputs and outputs within 30 days, except that content its automated systems flag as violating its Usage Policy may be kept for up to 2 years. Rotatad has not joined any Anthropic programme that shares data for training.

Every night, Rotatad adds performance data from each connected account to a shared dataset used to build industry benchmarks, for example which kinds of headline tend to perform in your industry. This is on by default.

What goes in: for each ad asset, its daily impressions, clicks, conversions and rates; features of the copy such as its length and whether it contains a number or a question, but not the copy itself; the industry and search-intent category of the account and ad group; and, when Google disapproves an ad, the policy topic and the same copy features. Records are labelled with a one-way hash of the account’s internal ID, not with its name or Google Ads ID.

What that means: these records are pseudonymised, not anonymous. Rotatad could link them back to your account. Other customers cannot: a benchmark is only shown once at least five separate accounts have contributed to it.

Your choice: turn it off in Settings, under Industry benchmarks. Turning it off, or disconnecting the account, stops new contributions.

Test accounts, demo accounts and accounts without an active subscription never contribute.

Rotatad’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising, and we do not use it to train general-purpose AI models.

Rotatad is run by one person, who is the only person with access to your data. That access is used only when it is needed to run the service: to investigate a problem you report, to respond to an automated alert, or for security and legal reasons. Our internal alerts can include your account name, the change Rotatad made or detected, and before-and-after values.

Data connected to your Rotatad account, including the performance history and search terms synced from Google Ads, the campaigns and copy Rotatad built or proposed, its decisions, and the record of the changes it made, is stored until you delete your Rotatad account. It is not deleted on a schedule while your account is open: that history is what Rotatad learns from, and Google itself holds detailed data only for a limited time.

Anthropic’s retention is described above. Our other providers store data under their own policies.

We use no advertising or analytics trackers. We use:

• ·refresh_token: a secure, HTTP-only cookie that keeps you signed in for up to 30 days.
• ·oauth_state: a short-lived cookie (10 minutes) that protects the Google sign-in step.
• ·Browser local storage: your current session token and which of your accounts you are viewing.

Your Google authorisation (the refresh token) is encrypted with AES-256-GCM before it is stored. We never see or store your Google password. Traffic between you and Rotatad is encrypted (HTTPS), and so are connections between our servers and our database.

Disconnect an account from the account menu at the top of the dashboard. We delete the Google credentials we hold for it and stop syncing and analysing it. If it was the last account using your Google authorisation, we also ask Google to revoke that authorisation. Reconnecting it later restores its history. Note: signing in to Rotatad with Google again currently reconnects accounts you disconnected.

Delete your Rotatad accountin Settings. This cancels your subscription, asks Google to revoke Rotatad’s access, and immediately and permanently deletes:

• ·your Rotatad login and profile, and your settings, including your benchmark choice;
• ·every Google Ads account you connected, and the Google credentials we hold for it;
• ·the performance history, keywords and search terms synced from those accounts;
• ·the campaigns, drafts and ad copy Rotatad built or proposed;
• ·its decisions, and the record of the changes it made;
• ·the facts extracted from your website.

Access, correction, export, objection: email us and we will respond within 30 days.

Which laws apply. Rotatad is run by one person in New York, United States, and your data is processed in the United States. Which privacy laws apply to you depends on where you are:

• ·In the United States, US and New York law apply. State consumer privacy laws such as California's apply to businesses above size thresholds, which Rotatad does not currently meet.
• ·In the European Union or the United Kingdom, the GDPR or UK GDPR may apply when we process personal data about you, for example if you advertise as a sole trader. Where it does, we rely on our contract with you to run the service, and on our legitimate interests to keep it secure and to build the cross-customer benchmarks, which you can object to by turning contribution off in Settings.
• ·Elsewhere, your local law may give you further rights. Email us and we will tell you what we can do.

We have not appointed a representative in the EU or UK, and we do not claim to meet every requirement of those laws. The rights above, and deleting your account in Settings, are available to everyone, wherever you are.

Rotatad is a business service and is not intended for anyone under 18.

When we change this policy we update the date at the top.