Privacy Policy
Effective date: 6 October 2026
Version: 1.0
1. Who we are
1.1 AdAudit Pro is a trading name of George Own Ltd, a company registered in England and Wales under company number 14317951, whose registered office is at 2 The Martens, Fleet, GU51 5FG, United Kingdom ("we", "us", "our").
1.2 We are registered with the Information Commissioner's Office (ICO) under registration number ZB529802. Our role depends on the data:
(a) we are the controller of your account, payment and transaction, communications, technical and website data; and
(b) when we process Google Ads, Google Analytics and landing page data to produce Reports for a business customer, the customer is the controller of any personal data within it and we act as its processor, under the Data Processing Terms in Schedule 1 of our Terms and Conditions.
1.3 For any question about this policy or your personal data, contact us at [email protected] or by post at the address above. We have not appointed a Data Protection Officer, as we are not required to.
1.4 This policy explains how we collect and use personal data when you visit our website, create an account, purchase or use our Google Ads audit services (the "Services"), in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").
2. The personal data we collect
2.1 Account data: your name, email address and password (stored only in encrypted, hashed form), and the date you registered.
2.2 Payment and transaction data: details of your purchases, Audit Credits and Subscription status, and the customer and payment references issued by our payment provider, Stripe. Card details are entered directly with Stripe; we never receive or store your full card number.
2.3 Google account connection data: when you connect Google Ads or Google Analytics, Google provides us with access tokens that allow read-only access, together with the names and identifiers of the accounts and properties you select.
2.4 Advertising and analytics data: with your authorisation, we read performance data from your Google Ads account (such as campaigns, ads, keywords, search terms, costs, clicks and conversions) and from your Google Analytics property (such as aggregated visits, engagement and conversions by landing page, device and campaign). This is mostly business data, but search terms entered by members of the public may occasionally contain personal information. Google Analytics data we receive is aggregated and does not identify individual website visitors. For any personal data within this data, we act as a processor on behalf of the business customer (see section 1.2).
2.5 Landing page data: the publicly available content of the landing page being audited, retrieved at the time of the Audit.
2.6 Report data: the Reports we produce for you, and any internal review notes or revisions made before delivery.
2.7 Communications data: the content of emails and other correspondence between you and us.
2.8 Technical data: information necessary to keep you securely signed in (such as session cookies) and limited server logs (such as IP address, browser type and time of request) used for security and troubleshooting.
2.9 We do not knowingly collect any special category data, and our Services are not intended for children.
3. How we collect your data
We collect personal data directly from you (when you register, pay, or contact us), from Google (when you authorise us to access your Google Ads and Google Analytics data), from Stripe (confirmation of payments and subscription status), from publicly available sources (your landing page), and automatically when you use our website.
4. How we use your data and our lawful bases
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Creating and managing your account | Account, technical | Performance of a contract |
| Taking payment, managing Audit Credits and Subscriptions | Account, payment and transaction | Performance of a contract |
| Carrying out Audits and producing Reports, including specialist review | Google connection, advertising and analytics, landing page, report | Performance of a contract. Where this involves personal data contained in a business customer's Google Ads, Google Analytics or landing page data, we process it as a processor on that customer's instructions (see section 1.2) |
| Sending service emails (e.g. confirmation that your Report is ready) | Account, report status | Performance of a contract |
| Responding to enquiries and complaints | Account, communications | Legitimate interests (providing good customer service) |
| Keeping the Platform secure, preventing fraud and fixing faults | Technical, account | Legitimate interests (operating a secure, reliable service) |
| Keeping financial and tax records | Payment and transaction | Legal obligation |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interests |
Marketing. If you are an existing customer, we may send you occasional emails about similar AdAudit Pro services, relying on the "soft opt-in" under PECR (regulation 22) and our legitimate interests. You can opt out when you create your account and at any time using the unsubscribe link included in every marketing email, or by emailing us. We do not send marketing emails to anyone else unless they have given their consent. We do not sell your personal data.
5. Use of AI tools and automated processing
5.1 We use AI language models from OpenAI, accessed through our technology platform provider Abacus.AI (see section 7), to help analyse your account data and draft parts of each Report. Every Report is reviewed by a human specialist before release.
5.2 We do not make any decision that produces legal or similarly significant effects about you based solely on automated processing.
5.3 Your data, including any data received from Google APIs, is never used to train public, foundational or generalised third-party AI models (see section 6).
6. Google user data — Limited Use disclosure
6.1 AdAudit Pro's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6.2 In particular, data obtained from your Google Ads and Google Analytics accounts:
(a) is accessed in read-only mode and used only to provide and improve the audit features you request, which are visible to you in your dashboard;
(b) is not transferred to third parties except as necessary to provide those features (for example, to our hosting and AI processing providers), to comply with law, or as part of a merger or acquisition with your notice;
(c) is not used or transferred for advertising, including retargeting or interest-based advertising;
(d) is not sold, and is not used to determine creditworthiness or for lending purposes;
(e) is not used to develop, improve or train generalised or non-personalised AI or machine-learning models; and
(f) is not read by humans except where you have consented (by ordering an Audit, which includes specialist review), where necessary for security purposes or to comply with law, or where the data has been aggregated and anonymised for internal operations.
6.3 You can withdraw our access at any time at https://myaccount.google.com/permissions.
7. Who we share your data with
7.1 We share personal data only with the following categories of recipients, each bound by contractual obligations of confidentiality and data protection:
-
Technology platform and hosting provider — Abacus.AI, Inc. (United States), which hosts our website, database and file storage, provides access to the AI language models used in our analysis, and sends our service emails on our behalf. Abacus.AI acts as our processor (or sub-processor, where we act as processor for a business customer).
-
AI model provider — OpenAI, L.L.C. (United States), whose language models we access through Abacus.AI's API to analyse account data and draft parts of each Report. Data is sent only to return the requested analysis. Under the provider's API data-usage terms, data sent through the API is not used to train its models and is retained only for a limited period for abuse monitoring before deletion. OpenAI acts as a sub-processor.
-
We will keep this list of AI and hosting providers up to date and, where we act as processor for a business customer, give at least 30 days' notice of any new or replacement sub-processor, as set out in Schedule 1 of our Terms and Conditions.
-
Payment processor — Stripe Payments UK Ltd and its affiliates, for processing payments and managing Subscriptions. Stripe acts as an independent controller for some purposes, such as fraud prevention; see https://stripe.com/gb/privacy.
-
Google — when you choose to connect your Google accounts, under Google's own privacy policy.
-
Professional advisers — such as our accountants, lawyers and insurers, where necessary.
-
Authorities — regulators, law enforcement or courts, where required by law.
-
A purchaser of our business — if we sell or transfer all or part of our business, in which case the recipient will be bound by this policy.
8. International transfers
8.1 Our website, database and files are hosted by Abacus.AI, Inc., a company based in the United States, and your personal data is therefore stored and processed in the United States. Some of our other service providers (including AI model providers, Google and Stripe) also process data in the United States or other countries outside the UK.
8.2 Where personal data is transferred outside the UK, we ensure it is protected by an appropriate safeguard recognised under UK data protection law — either transfer to an organisation certified under the UK Extension to the EU–US Data Privacy Framework, or the ICO's International Data Transfer Agreement or International Data Transfer Addendum to the EU Standard Contractual Clauses, incorporated into our contracts with those providers. This applies to transfers to Abacus.AI, Inc., OpenAI, L.L.C., Google and Stripe. The same safeguards apply where we process Google Ads and Google Analytics data as a processor for business customers (see Schedule 1 of our Terms and Conditions). You can request further details, including a copy of the relevant safeguard, by contacting us.
9. How long we keep your data
9.1 While your account is open, we keep your account data, Google connection data, advertising, analytics and landing page data, and Reports so that we can provide the Services and you can access your Reports.
9.2 When you close your account (using the "Close account" option on the Account page of your dashboard, or by asking us to), we immediately and permanently delete your account and all associated data from our application database, including your Reports, Google connection data and purchase history, and we revoke our access to your Google accounts. Any active Subscription is cancelled at the same time. The only exception is where we need to keep specific data to comply with a legal obligation or to establish, exercise or defend legal claims (including where a dispute is active or reasonably anticipated); in that case we keep only the relevant data, securely, and use it for no other purpose (see section 9.3).
9.3 Limited exceptions. After closure: (a) records of payments are retained by Stripe and in our company accounting records for 6 years from the end of the financial year in which the transaction took place, as required by HMRC; (b) correspondence with you may be kept for up to 2 years after our last contact, or longer if relevant to a complaint or legal claim; (c) server logs are deleted automatically within 90 days; (d) residual copies in our hosting provider's encrypted backups are overwritten in the normal backup cycle and are not used or restored except for disaster recovery; and (e) where a dispute, complaint or legal claim is active or reasonably anticipated, we may keep the logs, communications, Reports and records relevant to it until the matter is resolved and any applicable limitation period has expired, after which they are deleted.
9.4 If we terminate your account, the same deletion applies.
10. Cookies
10.1 Strictly necessary cookies and storage keep you securely signed in, protect against cross-site request forgery and remember your cookie choice. Under PECR these do not require consent. When you pay, Stripe may set its own cookies for fraud prevention on its checkout pages.
10.2 Optional cookies — only with your consent. When you first visit, a banner asks whether you allow:
- Analytics cookies (Google Analytics 4): cookies such as
_gaand_ga_<ID>(kept for up to 2 years) that tell us, in aggregate, how visitors find and use our website. IP addresses are anonymised. Google Ireland Limited acts as our processor. - Marketing cookies (Google Ads): cookies such as
_gcl_au(kept for up to 90 days) that measure whether our own advertising leads to sign-ups or purchases.
10.3 These optional cookies are not set, and the Google tag is not loaded, unless you choose "Accept all" or switch the category on under "Manage". We use Google Consent Mode, so Google is told your choice. Our lawful basis is your consent.
10.4 You can change or withdraw your consent at any time using Cookie settings in the footer of our website. Withdrawing consent stops further use and removes the Google cookies we can delete; it does not affect processing that took place before you withdrew it.
11. Security
We use appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), hashed passwords, read-only access to your Google accounts, restricted staff access, and reputable infrastructure providers. No system is completely secure, but we will notify you and the ICO of any personal data breach where we are legally required to do so.
12. Your rights
12.1 Under UK data protection law you have the right to:
(a) access the personal data we hold about you;
(b) have inaccurate data corrected;
(c) have your data erased in certain circumstances — you can do this yourself at any time by closing your account from the Account page;
(d) restrict our processing in certain circumstances;
(e) object to processing based on legitimate interests;
(f) data portability — receive data you provided to us in a machine-readable format; and
(g) withdraw consent at any time, where we rely on consent.
12.2 To exercise any of these rights, email [email protected]. We may need to verify your identity. We will respond within one month, which may be extended by up to two further months for complex requests. There is normally no fee.
12.3 Some rights are subject to exceptions — for example, we must keep payment records for the period required by law even if you ask us to delete them.
13. Complaints
If you have a concern about how we handle your personal data, please contact us first at [email protected] so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office: www.ico.org.uk, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
14. Changes to this policy
We may update this policy from time to time. The latest version will always be available on our website, and each version shows its version number and effective date. If we make significant changes, we will notify you by email before they take effect.