Privacy Policy

Google User Data

The disclosures in this section apply specifically to data accessed through Google APIs.

1. Data Accessed

We request the OAuth scope https://www.googleapis.com/auth/adwords from authorised Google Ads account holders. Through this scope we access the following Google user data via the Google Ads API:

• Campaign, ad group, and ad metadata (names, IDs, status, settings, structure)
• Performance metrics (impressions, clicks, cost, conversions, conversion value, CTR, CPC, ROAS)
• Asset metadata (headlines, descriptions, image references, video references)
• Account-level identifiers (customer ID, account name, currency, time zone)

We do not access Gmail, Google Drive, Google Calendar, Google Contacts, YouTube user data, Google Photos, or any Google user data outside the Google Ads API. We do not access end-user personally identifiable information through Google APIs.

2. Data Usage

We use Google Ads data exclusively for the following purposes:

• Generating historical and trend reporting on advertising performance for the authorised client account.
• Producing cross-channel performance analysis (combining Google Ads data with the client's data from Meta, GA4, and ecommerce platforms they have separately authorised).
• Surfacing alerts to JAG Media when material performance changes are detected, so the consultancy can advise the client.
• Displaying aggregated performance dashboards to the authorised client and to JAG Media.

Access is strictly read-only. We do not modify campaigns, budgets, bids, ad copy, account settings, or any other configuration via the Google Ads API. We do not use Google user data to develop, improve, or train any general-purpose artificial intelligence or machine learning models.

3. Data Sharing

We do not share Google user data with any third party. Google user data is accessed and processed only by:

• JAG Media (the consultancy operator) for the purposes described above.
• The authorised client account holder, who can view their own data via the password-protected dashboard.

We do not sell, rent, lease, transfer, or licence Google user data to advertisers, data brokers, marketing networks, AI providers, or any other commercial entity. We do not transfer Google user data to third-party service providers other than the hosting infrastructure described in section 4.

4. Data Storage and Protection

Google user data and OAuth credentials are stored as follows:

• OAuth refresh tokens and client credentials: stored in access-restricted configuration files on a dedicated server (file permissions limited to the operating user account). Credentials are never committed to source control and never exposed to client-side code.
• Performance metrics and campaign metadata: stored in a private PostgreSQL database hosted on Railway with AES-256 encryption at rest. The database is not publicly accessible and is reachable only via Railway's internal network from the dashboard application.
• Network transport: all connections between the dashboard application, the database, and Google APIs use TLS encryption.
• Authentication: dashboard access is protected by per-user passwords (bcrypt hashed) and rate-limited login. Each client can only access data for their own authorised account.

5. Data Retention and Deletion

We retain Google user data for the duration of the active client consultancy engagement. Upon termination of an engagement we delete the client's Google Ads data within 30 days.

You may request deletion of your data at any time by emailing jag.mediaa@gmail.com with the subject line "Data Deletion Request" and the Google Ads customer ID for which you are requesting deletion. We will:

• Acknowledge the request within 5 business days.
• Revoke and delete the OAuth refresh token associated with your account.
• Delete all stored Google Ads performance data, campaign metadata, and account identifiers from our database within 30 days of the request.
• Confirm completion of deletion by email.

You may also revoke our access to your Google account at any time independently of contacting us, by visiting myaccount.google.com/permissions. Revoking access via Google immediately stops all future data access; deletion of previously retrieved data still requires an email request as above.

Other Platforms

With separate authorisation from each client we also access equivalent read-only data from Meta Ads (via Meta Business Suite), Google Analytics 4, and WooCommerce. The same principles apply: data is used only for client reporting and analysis, is never shared with third parties, is never used to train AI or machine-learning models, and is deleted within 30 days of engagement termination on request.

Limited Use Disclosure

JAG Media's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. JAG Media certifies that:

• We request only the minimum scope required for the dashboard functionality (the adwords scope only).
• We use Google user data only to provide the user-facing reporting features described in this policy. We do not use it for any secondary business purpose.
• We do not transfer Google user data to third parties except as necessary to provide and improve the dashboard, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to affected users.
• We do not use or transfer Google user data to serve advertisements, including retargeting, personalised, or interest-based advertising.
• We do not use Google user data to determine creditworthiness or for any lending purposes.
• We do not allow humans to read Google user data unless we have obtained the user's affirmative agreement to view specific data, it is necessary for security purposes (e.g. investigating abuse), it is required by law, or the data has been aggregated and anonymised for internal operations.
• We do not use Google user data to develop, improve, or train generalised or non-personalised artificial intelligence or machine-learning models.

Contact

For any privacy-related questions or to exercise the rights described above, contact jag.mediaa@gmail.com.

Changes

We will post updates to this policy at this URL. Material changes will be notified to active clients by email.