Security

Your AI stays inside your switches

• You choose what your AI can change. Each kind of change is a switch you can turn off, for all platforms or one at a time. Presets (Read only, Daily optimizer, Full control) set them in one tap.
• AI permissions. Every kind of change your AI could make is a switch you control. We check the switch on our server before each change, so a change that is off is never made, whatever your AI tool does. A change your AI tried while its switch was off shows in your activity with a link to turn it on.
• Change log. Every change made through OpenAdManager is logged: who asked, which AI tool, what changed, before and after.
• Undo, where possible. Pauses, status, budget and bid changes can be undone from the log within the history your plan keeps, if nothing changed since. Undo restores the setting, not money already spent. Deletes, uploads and text or asset edits cannot be undone, and the switch for them says so.
• Server limits you cannot turn off. A daily cap on budget increases and an always-ask rule for deletes.
• Kill switches. We can stop all changes, changes on one platform, or changes for one customer at once.

Sign-in and tokens

• Sign in with Google, Facebook, an email code or a password. Two-step sign-in is optional for customers and can be turned on in account settings; it is asked at sign-in. It is required for our administrators.
• AI tools sign in with OAuth in your browser. Each grant is one AI tool, scoped to the accounts and permissions you choose, and you can revoke it any time. Personal tokens, where used, are shown once, stored only as hashes, scoped and expiring: you pick 7, 30, 90 or 365 days (90 unless you choose otherwise).
• Staff access is agreed, limited and logged. Staff never use your password. When you connect an ad account you agree that our team can view and manage it to run and support the service. Every action shows in your activity log as "OpenAdManager team" with the expert's name, and changes notify you. Lead and customer contact data is not downloaded from accounts that are not on a managed plan. Disconnect an account to end access to it. To help with a support request, an administrator can open your dashboard as you for up to 30 minutes, without your password; they cannot change your sign-in, billing, team or tokens, every start is recorded, and anything they do is marked in your activity log.

How we protect data

• All traffic uses TLS. Access and refresh tokens are encrypted at rest and never sent to your browser.
• Each customer's data is isolated from other customers' data, with per-customer keys that are destroyed when you delete your account.
• The services that talk to ad platforms run isolated from the rest of the system, with only the outbound access they need.
• Ad text, comments and other content from your accounts are treated as data, never as instructions to your AI.
• Encrypted backups are kept for a limited time (21 days after deletion).

Deleting your account

• You can cancel a deletion. After you ask us to delete your account, you have 24 hours to change your mind. After that, the deletion runs and is done within 48 hours.
• The change log is kept as a compliance record. When an account is deleted, its change log is pseudonymised (names, people and ad objects removed) and kept for 25 months, then deleted.

Your ads and your bill

If your OpenAdManager payment fails or you cancel, your campaigns keep running. Only your AI's access changes.

Platform rules

We use the official Google Ads, Meta Marketing, TikTok, Reddit Ads and X Ads tools only, with your own sign-in. Our use of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. See how we use Google Ads data.

Each platform's access token is stored encrypted, is limited to the permissions you approved on the platform's screen, and is deleted at once when you disconnect the account.

Report a problem

Found a vulnerability or something wrong with your account? Write to support@openadmanager.com. We read every report.

Related: Privacy Policy · Terms · Data deletion · Subprocessors.