Data and privacy
Updated November 12, 2026
AdsGuru stores the minimum it needs to manage your ads: campaign structure, performance metrics and change history for connected accounts, plus your account and billing details. It never stores platform passwords or your customers' personal data, and disconnected account data is deleted within 30 days.
What AdsGuru stores
Four categories, each tied to a function the product cannot perform without it:
| Data | What it is | Why it is needed | Kept until |
|---|---|---|---|
| Campaign structure | Campaigns, ad groups and ad sets, ads, keywords, budgets, settings | Proposals need to know what exists and how it is configured | Disconnection + 30 days |
| Performance metrics | Spend, impressions, clicks, conversions, frequency and the like, per day | Baselines, diagnosis and evidence all come from history | Disconnection + 30 days |
| Change history | Every applied change: timestamp, reason, before and after values, approver | The audit trail that makes changes verifiable and reversible | Disconnection + 30 days |
| Your AdsGuru account | Login email, settings, plan and billing details | Operating the subscription | Account deletion |
Access tokens for the platform connections are stored encrypted and used server-side only; they are credentials rather than data about your business, and revoking them on the platform invalidates them regardless of anything stored.
What AdsGuru never stores
The never list is the more important half:
- Platform passwords: never seen, by design; OAuth means authentication happens on Google's and Meta's own pages.
- Your customers' personal data: no names, emails, addresses or purchase identities of the people who buy from you. AdsGuru reads aggregate ad metrics, never customer records.
- Your website or store data: no access to your site, checkout, or customer database exists in the first place.
- Payment methods for ad spend: your Google and Meta billing arrangements are invisible to AdsGuru.
- Creative files beyond API references: ads are referenced as the platforms expose them, not harvested into an asset library.
The design rule behind the list: data that is not collected cannot leak, be subpoenaed, or be repurposed. The product needs account-level ad data; it does not need to know who your customers are, so it does not.
Where conversion data comes from
The conversion numbers AdsGuru works with are the platforms' aggregates: conversions, revenue and cost per result as Google Ads and Meta report them per campaign, ad set and ad. These aggregates are the same numbers in your Ads Manager; they arrive already stripped of individual identity.
Individual-level tracking, pixels, the Conversions API, cookies and consent, happens between your website, your customers and the platforms, under your policies and the platforms' terms. AdsGuru audits whether that pipeline works (events arriving, deduplicating, consistent with platform numbers; see the Shopify page for the store-side view) without receiving the underlying personal data.
Practical consequence: connecting AdsGuru adds no new script to your site, drops no new cookies on your users, and changes nothing about what your customers share with anyone.
Deletion and retention
Two clocks cover everything. Disconnect an ad account, and its synced data, structure, metrics, change history, is deleted within 30 days. Delete your AdsGuru account entirely, and account data follows the same path, with billing records retained only as long as accounting and tax law requires.
The 30-day window exists for operational reasons stated plainly: accidental disconnections happen, and reconnecting within the window restores history instead of rebuilding the 7-to-14-day baseline from zero. If you want deletion faster than the window, ask.
Deletion is real deletion rather than a soft hide: after the window, the records are removed from production systems, and backup copies age out on the backup cycle. The billing-record exception exists because tax law requires invoices to be kept; it covers invoices, never ad account data.
Export before you disconnect if you want to keep anything: reports and change logs are yours to take, and Agency plans can pull them through the read-only API.
Data requests
One address handles all of it: hello@adsguru.co. Supported requests, with no form-maze in front of them:
- Export: a copy of the data held about your account and connected ad accounts.
- Deletion: removal of your data, honoring the legal-retention carve-out for billing records.
- Correction: fixing wrong account details.
- Questions: anything this page or the privacy policy leaves unclear.
Requests are verified against the account email before anything is exported or deleted, for the obvious reason: a data export is exactly what an attacker would love to social-engineer.
GDPR, CCPA and your rights
If you operate under GDPR, CCPA or a similar regime, the request paths above are the practical implementation of the rights those laws name: access (the export), erasure (deletion, with the legal-retention carve-out for billing records), and rectification (correction). Write to hello@adsguru.co and name the regulation if it matters for your records; the handling is the same either way.
The division of roles is the part worth being precise about. For your AdsGuru account data, AdsGuru answers your requests directly. For your customers' data inside the ad platforms, the relationships run between you, your customers and Google or Meta; AdsGuru never holds that data, so requests about it belong with the platform or with you. A customer of yours exercising their rights does it through your site's privacy process and the platforms' own tools, unchanged by AdsGuru's existence.
This is also the short answer to the diligence question procurement teams ask: the simplest data-protection posture a vendor can offer is not holding the sensitive data in the first place.
Questions to ask any ads tool about data
The checklist worth running on every vendor in this category, including us:
- Does it authenticate by OAuth, or does it ask for passwords? Password-based access is disqualifying in 2026.
- What scopes does it request, and are they the minimum for the job? Ads management is enough for ad management; broader grants deserve an explanation.
- Can you revoke access from the platform side, without the vendor's cooperation?
- What exactly is stored, for how long, and what is the deletion path?
- Does it store any of your end customers' personal data, and if so, why?
- Is every write it makes visible in the platform's own change history, so its claims are checkable?
AdsGuru's answers are this page and the security model: OAuth only, ads-management scope, platform-side revocation, 30-day deletion, no end-customer data, and every change platform-verifiable.
Your customers and the ad platforms
Worth stating because the responsibility boundary confuses people: your obligations to your own customers, privacy policy, consent banners, pixel disclosures, regional rules like GDPR and CCPA, exist between you, your customers and the platforms, and they are unchanged by AdsGuru. AdsGuru sits downstream of all of it, reading aggregates.
One place the product helps with the consequences: consent and tracking changes on your site show up as measurement artifacts, conversions sagging while clicks hold, and the tracking checks and alerts are built to catch exactly that signature. Fixing the consent configuration remains yours; noticing that it silently broke your measurement is something the system watches for.
If you are writing your own privacy policy and wondering whether AdsGuru needs a mention as a processor of your customers' data: it processes your ad account data, never your customer records, which usually puts it in a different category than your email tool or analytics. That is your counsel's call to make, but this page is the factual basis for it.
The honest summary
The privacy posture in three sentences. AdsGuru stores aggregate ad account data because the product cannot diagnose or propose without history, and it stores nothing about the individuals who buy from you. Every piece of stored data has a named function, a deletion clock, and an export path. The formal documents are the privacy policy and security page; the request path is hello@adsguru.co; and the kill switches stay on the platforms, in your hands.
Common questions
What is AdsGuru's data policy?
Store the minimum the product needs (campaign structure, performance metrics, change history, account details), never store platform passwords or your customers' personal data, delete disconnected account data within 30 days, and answer export and deletion requests at hello@adsguru.co.
Does AdsGuru store my customers' personal information?
No. It reads the platforms' aggregate metrics, which carry no individual identities. Your customer data stays between your site, your customers and the platforms.
Does connecting AdsGuru add anything to my website?
No. There is no AdsGuru script, pixel or cookie on your site; the connections are to your ad accounts, not your website.
How long is data kept after I disconnect?
Up to 30 days, then deleted. The window lets accidental disconnections reconnect without losing the account baseline; faster deletion is available on request.
How do I get a copy of my data?
Email hello@adsguru.co from your account address for an export. Agency plans can also pull reports and change logs over the read-only API.
Is the data encrypted?
Yes, in transit and at rest, with platform tokens stored encrypted and used server-side only.
Does AdsGuru sell or share my data?
No. The data exists to run your account's proposals, reports and logs. The privacy policy is the binding statement.
How do GDPR and CCPA requests work in practice?
The request paths map to the rights: export for access, deletion with a legal-retention carve-out for erasure, correction for rectification, all via hello@adsguru.co. For your own customers' data, the relationships run between you, your customers and the platforms; AdsGuru does not hold it.