Privacy Policy

How we handle your information at AI Ads Studio

Effective date: 26 July 2026  ·  Last updated: 1 August 2026

AI Next Dev ("we", "us", "our") operates AI Ads Studio (the "Service"), available at ads.ainextdev.com. Contact: info@ainextdev.com.

1. Introduction

AI Ads Studio is a software-as-a-service platform that helps businesses and marketing agencies create, manage, and optimize Google Ads campaigns using artificial intelligence. This Privacy Policy explains what information we collect when you use the Service, why we collect it, how we protect it, and the choices you have over it.

This policy applies to the AI Ads Studio web application, our websites, and our APIs.

2. Information we collect

2.1 Information you provide

  • Account details — your name, email address, and password (stored only as a bcrypt hash).
  • Business profile — your website URL, business name, industry, target country, and advertising budget.
  • Billing information — subscription plan and payment details, processed by our payment provider. We do not store full card numbers.
  • Support communications — messages you send us and our replies.

2.2 Information from Google, with your authorization

  • Google Ads account data — campaigns, ad groups, keywords, ads, budgets, and performance metrics from the Google Ads accounts you choose to connect.
  • OAuth tokens — an encrypted refresh token that lets the Service act on your behalf until you disconnect.

2.3 Information collected automatically

  • IP address, browser type, device type, and operating system.
  • Log data such as pages visited, features used, and timestamps.
  • Essential cookies used to keep you signed in and to maintain your session.

3. Google user data — access, use, storage, and sharing

This section describes specifically how AI Ads Studio handles data obtained through Google APIs, in line with the Google API Services User Data Policy.

3.1 Scopes we request and why

ScopeWhy we request it
https://www.googleapis.com/auth/adwords To read the campaigns, ad groups, keywords, ads, and performance metrics in the Google Ads account you select, and to create or update campaigns that you have explicitly approved.

This is the only scope AI Ads Studio requests. We do not request access to Gmail, Drive, Contacts, Calendar, or your Google profile, and we do not use Google to sign you in — your AI Ads Studio account uses your own email address and password. Google does not offer a narrower scope for Google Ads: adwords is the single scope the Google Ads API provides, and read-only access would not allow the campaign creation the Service exists to do.

3.2 How we use Google user data

  • Displaying your campaigns and performance metrics in your dashboard and reports.
  • Generating campaign strategies, ad copy, and optimization recommendations for your account.
  • Creating and updating campaigns in your Google Ads account after you approve them.

Limited Use commitment. AI Ads Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not:

  • Sell or rent Google user data to anyone.
  • Use Google user data for advertising, retargeting, or building audience profiles.
  • Use Google user data to train generalized artificial intelligence or machine learning models.
  • Transfer Google user data to third parties, except the service providers strictly necessary to operate the Service (section 6), when required by law, or with your explicit consent.
  • Allow humans to read your Google user data, except where you have given explicit permission (for example, to troubleshoot a support request), where required by law, or where necessary for security purposes such as investigating abuse.

3.3 How we store and protect it

  • OAuth refresh tokens are encrypted at rest using Fernet (AES-128-CBC with HMAC-SHA256).
  • Access tokens are held in memory only for the duration of a request and are never written to disk.
  • We never ask for, receive, or store your Google account password.
  • All traffic to and from the Service is encrypted using HTTPS with TLS 1.2 or higher.
  • Each customer's data is logically isolated in our multi-tenant database, and access is scoped per account.

3.4 Revoking access

You can disconnect your Google account at any time from your AI Ads Studio account settings, or from Google Account permissions. When you disconnect, we delete the stored refresh token immediately and stop accessing your Google Ads account. Campaigns already created in your Google Ads account remain yours and are unaffected.

4. How we use your information

  • To provide, operate, and maintain the Service.
  • To process subscriptions, payments, and invoices.
  • To communicate with you about your account, campaigns, and support requests.
  • To diagnose faults, monitor reliability, and improve the Service.
  • To detect, prevent, and investigate fraud, abuse, and security incidents.
  • To comply with legal obligations.

We do not use your data for any purpose incompatible with those listed above without telling you first.

5. Legal bases for processing

Where the GDPR applies, we process personal data on these legal bases:

  • Contract — to deliver the Service you have subscribed to.
  • Consent — for connecting your Google Ads account and for optional communications. You may withdraw consent at any time.
  • Legitimate interests — to secure the Service, prevent abuse, and improve reliability.
  • Legal obligation — to meet accounting, tax, and regulatory requirements.

6. Sharing and sub-processors

We do not sell your data. We share it only with providers that help us run the Service, each bound by contract to protect it and to use it only on our instructions:

  • Cloud hosting and database providers — to host the application and store your data.
  • Payment processor — to handle subscription billing.
  • AI providers — to generate campaign strategies and ad copy from the business details and campaign context you provide.
  • Email delivery provider — to send account and service notifications.

We may also disclose information where required by law, court order, or a valid request from a public authority, or to protect our rights, safety, or property.

7. Data retention

  • Account and business profile data — retained while your account is active.
  • Campaign and performance data — retained while your account is active so you can access historical reporting.
  • OAuth refresh tokens — deleted immediately when you disconnect your Google account or delete your account.
  • After account deletion — your personal data is deleted within 30 days, except records we must keep for legal, tax, or accounting purposes.
  • Server logs — retained for up to 90 days for security and troubleshooting.

8. Your rights

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you.
  • Correct data that is inaccurate or incomplete.
  • Delete your account and the personal data associated with it.
  • Export your data in a portable, machine-readable format.
  • Object to or restrict certain processing.
  • Withdraw consent at any time, including by disconnecting your Google account.
  • Lodge a complaint with your local data protection authority.

To exercise any of these rights, email info@ainextdev.com. We respond within 30 days.

9. Data security

  • In transit — HTTPS with TLS 1.2 or higher on all connections.
  • At rest — OAuth refresh tokens encrypted with Fernet (AES-128).
  • Passwords — hashed with bcrypt; never stored in readable form.
  • Access control — internal access is limited to personnel who need it to operate the Service.
  • Isolation — customer data is separated per tenant.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

10. International transfers

Your data may be processed in countries other than your own. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Cookies

We use strictly necessary cookies to keep you signed in and maintain your session, and limited analytics to understand how the Service is used. We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, though the Service may not function correctly without the essential ones.

12. Children's privacy

The Service is intended for business use and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with a new "Last updated" date, and for material changes we will notify you by email or in the application before the change takes effect.

14. Contact us