Privacy Policy

Last updated: 7 August 2026

Ads Toolbox (“we”, “us”) is a service of Creative Web Advertising (UK) Limited, a company registered in England and Wales (company number 06346288), registered office: SVS House, Oliver Grove, London SE25 6EJ, United Kingdom. Ads Toolbox helps small businesses run their Google Ads accounts. This policy explains what data we handle, why, and your rights. Contact us any time at [email protected].

What we collect and why

Account details. Your name, e-mail address and password (stored hashed) when you create an Ads Toolbox account — so you can sign in and we can contact you about your service. Legal basis: performance of a contract.

Your Google Ads data. When you connect your Google Ads account, we access it through the official Google Ads API to read your campaigns, keywords, search terms, costs and results, and — only when you explicitly approve a change in the app — to make that change. We store a copy of this data on servers we control in the European Union so the app can show you fast, historical views without repeatedly calling Google. Legal basis: performance of a contract.

Billing data. Payments are processed by Stripe; we do not store your card details. We keep invoices as required by tax law. Legal basis: legal obligation and contract.

Usage and technical data. Standard server logs (IP address, time, pages requested) kept for security and troubleshooting and deleted on a rolling basis. Legal basis: legitimate interest in keeping the service secure.

How we use Google user data — Limited Use disclosure

Ads Toolbox’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: the Google Ads data we access is used only to provide you the Ads Toolbox features you see — reporting, advice, and the changes you approve. We do not sell it, we do not use it for advertising of our own, and no human at Creative Web Advertising reads it except to support you when you ask, to keep the service working, or where the law requires.

Where processing happens

Your data is processed and stored on servers we control in the European Union. The automated analysis that powers our advice (for example, grouping your search terms or drafting plain-language explanations) runs locally on our own infrastructure — your data is not sent to third-party AI providers.

How we protect your data

• In transit — all traffic between you, Ads Toolbox and the Google Ads API uses TLS 1.2 or higher; HSTS is enforced on ads-toolbox.com and app.ads-toolbox.com.
• Google credentials — the OAuth access and refresh tokens issued when you connect Google Ads are encrypted with a separate application key held outside the database, are never written to log files, and are destroyed when you disconnect or delete your account.
• Access control — access to production systems and customer data is limited to named Creative Web Advertising staff who need it to run or support the service, is granted on a least-privilege basis, requires two-factor authentication and is logged in a tamper-evident audit trail. Staff assistance sessions inside Ads Toolbox are recorded in your account’s activity log.
• Separation — each customer’s data is stored under a separate tenant identifier and is never exposed to another customer.
• No third-party AI processing — automated analysis runs on our own EU infrastructure; your Google Ads data is not sent to third-party AI providers and is not used to train third-party models.
• Operational security — systems are patched regularly, credentials and API keys are kept out of our source code and restricted to the systems that need them, and backups are encrypted and retained for disaster recovery.
• Incidents — if a personal-data breach affects you we will notify you and the competent supervisory authority without undue delay and within 72 hours of becoming aware, as required by the UK and EU GDPR.
• Deletion — when you disconnect Google Ads or close your account we delete our copy of your Google Ads data and revoke our Google access within 30 days, except records we are required by law to keep.

Ads Toolbox’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Anonymised learning

With your permission (the “Learning contribution” setting in your account, which you can switch off at any time), we use anonymised, aggregated patterns from across accounts — never your identifiable data, and only in groups large enough that no single business can be recognised — to improve the advice the product gives everyone.

Sharing

We share data only with: Google (to operate your ads account as instructed by you), Stripe (payments), and our server hosting provider (infrastructure in the European Union). Each acts under contracts appropriate to their role. We do not sell personal data. We disclose data to authorities only where legally required.

Retention

We keep your data while your account is active. If you close your account, we delete our copy of your Google Ads data and revoke our Google access within 30 days, and remove personal data except invoices and records we must keep by law. You can disconnect Google access yourself at any time — in the app at Set up → Disconnect Google Ads, or directly at myaccount.google.com/permissions — either immediately ends our ability to access your account.

Your rights

Under the UK GDPR and the EU GDPR you can ask us for access to, correction of, deletion of, or a portable copy of your personal data, object to or restrict processing, and withdraw any consent. Write to [email protected] and we will respond within one month. You may also complain to your data-protection authority (in the UK, the ICO).

Cookies

The app uses only the cookies needed to keep you signed in. This marketing site does not set advertising or tracking cookies.

Changes

If we change this policy in a way that matters, we will tell you in the app or by e-mail before it takes effect.