Documentation index: https://openadmanager.com/llms.txt # Privacy Policy | OpenAdManager > How OpenAdManager, operated by CloudWish LLC, collects, uses, protects and deletes your data, including data received from Google APIs. Canonical: https://openadmanager.com/privacy # Privacy Policy Privacy v4 (13 Nov 2026) **On this page** - 1. Information we collect - 2. How we use information - 3. Google user data - 3a. Reddit and X user data - 3b. Meta Platform Data - 4. Where answers go: your AI tool - 5. Storage and security - 6. Who we share data with - 7. Retention, backups and deletion - 8. When you connect Google Ads from Krypton - 9. Your rights - 10. International transfers - 11. Children - 12. Changes to this policy - 13. Contact OpenAdManager ("OpenAdManager", "we", "us") is a service at openadmanager.com. It connects the AI tool you choose to your Google Ads, Meta ads, TikTok ads, Reddit ads and X ads accounts, so you can ask about your campaigns and make the changes you allow. It is operated by CloudWish LLC, 1509 Coffeen Ave Ste 1200, Sheridan, WY 82801, USA, which is the data controller for the information described here. Contact: [support@openadmanager.com](mailto:support@openadmanager.com). OpenAdManager is also the Google Ads connection used by Krypton (krypton.bot), another CloudWish LLC product. When you connect Google Ads from Krypton, Google's consent screen shows "OpenAdManager", and this policy, including section 3, applies to that data as well. ## 1. Information we collect - **Account information.** When you sign in with Google or Facebook we receive your name, email address and profile picture. If you use email, we store your email and a password hash if you set a password. We never see or store your Google or Facebook password. - **Ad account data.** Only for the accounts you connect and pick: the accounts you can reach, and their campaigns, ad sets or ad groups, ads, keywords, audiences, budgets and performance metrics (such as impressions, clicks, spend and conversions). For Google Ads this needs the `https://www.googleapis.com/auth/adwords` permission, which you grant on Google's own screen. For Reddit and X we read the same kinds of data for the accounts you pick: the account, its campaigns, ad groups or line items, ads and creatives, budgets and performance metrics. Reddit and X each ask you to approve this on their own screen: Reddit for reading and editing ads and sending conversions, X for reading and managing ads, uploading ad media and staying signed in until you disconnect. - **Access tokens.** The access and refresh tokens Google, Meta, TikTok, Reddit and X issue so we can act for you. They are stored encrypted. - **Your settings and activity.** Your AI permission switches, the change log (who asked, which AI tool, what changed, before and after), usage counts and the AI tools you connected, with the time and country of use. - **Billing records.** Plan, invoices and payment status. Card details are handled by Stripe and never reach our servers. - **Support messages** you send us. - **Security and device data.** IP address, browser type and sign-in events, used to protect accounts and prevent abuse. Sign-ups from one address or device may be flagged for review. - **Tracking add-on data (only if you turn it on).** Events from your own website that you choose to track (for example page views, add to cart, purchases with order value and currency), plus the ad click IDs and, where you send them, hashed email or phone, so we can pass conversions to the ad platforms you connect. You are responsible for telling your visitors and for asking for consent where the law requires it. The site settings include consent controls. - **Website measurement.** On our public website we measure page speed with a small script we host ourselves. It sets no cookies and sends no data to third parties. ## 2. How we use information - To sign you in and keep your account secure. - To answer the questions you or your AI tool ask and to make the changes you allow, only when asked. - To enforce limits and plans, bill you and answer support requests. - To detect and prevent fraud, abuse and security threats, and to meet legal duties. We do not use your data to train AI models, we do not sell it, and we do not use it for advertising. ## 3. Google user data This section describes data we receive from Google APIs, including Google Sign-In and the Google Ads API. OpenAdManager's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. - **What we access.** Your name, email and profile picture (sign-in), and, if you connect Google Ads, the account, campaign, ad, keyword, audience, budget and metric data described in section 1. - **How we use it.** Only to provide the features you use: showing your accounts and performance to the AI tools you authorized, and making the changes you request or allow. We read or change your Google Ads data only in response to your actions or settings. - **No AI or machine-learning training.** Google user data is never used to train AI or machine-learning models, ours or anyone else's. - **Answers go to your AI tool.** Data goes only to the AI tools you authorized, only when they ask. That tool's provider handles it under its own terms and settings, which we do not control. - **No selling, no advertising use.** We do not sell Google user data and do not use or transfer it for advertising, retargeting, interest-based ads, credit-worthiness or lending decisions. - **Transfers.** We transfer Google user data only as needed to provide the features you use (for example to Krypton, when you connected Google Ads from Krypton, and to the infrastructure providers in our [subprocessor list](https://openadmanager.com/subprocessors)), for security, to comply with law, or as part of a merger or acquisition with notice to you. - **Human access.** When you connect an ad account you agree that OpenAdManager staff can view and manage that account, including its Google user data, only to run and support the service. Staff do not download lead or customer contact data from accounts that are not on a managed plan. Every staff action shows in your activity log as "OpenAdManager team" with the expert's name, and you are notified of changes. Otherwise no person reads your Google user data unless it is needed for security or to comply with law, or the data is aggregated and anonymized for internal operations. You can withdraw this at any time by disconnecting the account. - **Audit logs.** Records of access to Google data are kept for 25 months. ## 3a. Reddit and X user data This section describes data we receive from the Reddit and X APIs when you connect an ad account. - **What we access.** Only what you approve on the platform's own screen, listed in section 1. For Reddit this is reading and editing your ads and sending conversions; for X, reading and managing your ads and uploading ad media. We read or change this data only in response to your actions or your AI's requests that your AI permissions allow. - **No AI or machine-learning training.** Data from these platforms is never used to train AI or machine-learning models, ours or anyone else's. - **No selling, no advertising use.** We do not sell it and do not use or transfer it for advertising, retargeting, interest-based ads or credit decisions. - **Changes are yours to allow.** Changes to your ads on these platforms follow your AI permissions, which you can turn off one kind at a time. You always keep read access. - **Retention.** Access tokens are kept until you disconnect the account, then deleted at once. Ad data we fetched is kept for the history period of your plan, then removed, and is deleted with your account as described in section 7. - **Revoke or disconnect.** Disconnect the ad account in OpenAdManager, or remove OpenAdManager on the platform's side (see the data deletion page). ## 3b. Meta Platform Data This section describes data we receive from Meta (Facebook and Instagram) when you sign in with Facebook or connect a Meta ad account. - **What we access.** Only what you approve on Meta's own screen: your name, email and profile picture (sign-in), and, for the accounts and Pages you pick, your ad accounts, campaigns, ad sets, ads, creatives, audiences, budgets and performance metrics, your Pages and their posts, and the leads collected by your lead forms. - **Why.** Only to provide the features you use: showing this data to the AI tools you authorized, making the changes you request or allow, and letting you view and download your leads. We read or change it only in response to your actions or your AI's requests that your AI permissions allow. - **No AI or machine-learning training, no selling.** Meta platform data is never used to train AI or machine-learning models, is not sold, and is not used or transferred for advertising, retargeting or credit decisions. We do not combine it with data from other customers. - **Lead data.** Lead contact details stay in your Meta account and are shown to you on request. Staff do not download them unless the account is on a managed plan. - **Retention.** Access tokens are kept until you disconnect the account, then deleted at once. Ad data we fetched is kept for the history period of your plan, then removed, and is deleted with your account as described in section 7. - **Deletion.** Disconnect the ad account in OpenAdManager, remove OpenAdManager under **Settings, then Apps and Websites** in Facebook, or ask us to delete your data. The steps, including how to request deletion as a Facebook sign-in user, are on the [data deletion](https://openadmanager.com/data-deletion) page. - **Meta's terms.** Our use of Meta platform data follows the Meta Platform Terms and Developer Policies. ## 4. Where answers go: your AI tool When your AI tool asks OpenAdManager a question, we return the data needed to answer it. After that, the AI tool's provider (for example Anthropic, OpenAI, Anysphere or Microsoft) handles it under its own terms, retention and training settings. We do not control them. Check your AI tool's data settings. ## 5. Storage and security - All traffic is encrypted in transit with TLS. - Access and refresh tokens are encrypted at rest and never sent to your browser. Personal tokens are stored only as hashes. - Each customer's data is isolated from other customers' data. - Access to production systems is limited to authorized staff. ## 6. Who we share data with We do not sell personal data. We share it only with: - the ad platforms you connect (Google, Meta, TikTok, Reddit, X) to read and manage your accounts as you authorize; - the AI tools you connect, as described in section 4; - Higgsfield, when you connect your own Higgsfield account to create images or video through your AI; - our service providers, listed on the [subprocessors page](https://openadmanager.com/subprocessors); - Krypton (CloudWish LLC), when you connected Google Ads from Krypton, so Krypton can show you that data; - authorities, when required by law. ## 7. Retention, backups and deletion - We keep your data while your account is active, and for the history period of your plan. - **Disconnect any time.** Disconnecting an ad account under Ad accounts, in its Connections list, deletes our stored access and refresh tokens for it at once. You can also revoke our access in your Google, Meta, TikTok, Reddit or X account. - **Delete your account** in the dashboard, or write to [support@openadmanager.com](mailto:support@openadmanager.com) from your account email. A deletion job runs within 48 hours: it deletes your account and associated data, destroys your per-customer encryption keys, so stored platform tokens can no longer be read. Your paid plan is cancelled at once, with no refund. We keep a change log without your identifiers for compliance, then purge it. We do not revoke grants at Google, TikTok or the other ad platforms, and at Meta only when nothing else of yours uses the same Meta identity (see data deletion); remove OpenAdManager in their security settings to end a grant. See [data deletion](https://openadmanager.com/data-deletion). - **Backups.** Encrypted backups keep data for up to 21 days after deletion, then it is overwritten. Backups are not used for any other purpose. - We keep records we must keep by law, such as invoices. ## 8. When you connect Google Ads from Krypton - **Storage.** Krypton stores the Google refresh token encrypted and keeps the short-lived access token only in server memory. - **Use.** Data is read or changed only when you ask your Krypton bot. Results go to the AI model provider you chose for that bot, only to answer you. - **Removal.** Removing the Google sign-in in Krypton under Integrations deletes its token and revokes it at Google. Disconnecting Google Ads here also disconnects Krypton's Google Ads, because both use the same connection. ## 9. Your rights Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict some processing, and to withdraw consent. Write to [support@openadmanager.com](mailto:support@openadmanager.com). You may also complain to your local data protection authority. ## 10. International transfers We may process data in countries other than yours. Where required, we use contractual safeguards. Our servers are in Finland (see the [subprocessor list](https://openadmanager.com/subprocessors)). When personal data leaves the European Economic Area, the United Kingdom or Switzerland for a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses. ## 11. Children OpenAdManager is a business tool for people 18 and older. We do not knowingly collect data from children. ## 12. Changes to this policy We will post changes on this page and update the date. If a change materially affects how we use Google user data, we will ask for your consent first. ## 13. Contact CloudWish LLC, 1509 Coffeen Ave Ste 1200, Sheridan, WY 82801, USA. [support@openadmanager.com](mailto:support@openadmanager.com).