Privacy Policy

Konstantin Shchegolev (“we”) operates AdTattle at adtattle.com. We are the data controller for the personal data described here. Contact: [email protected], Avenida Sacadura Cabral, Nº 18, 1º D, 1000-274 Lisboa, Portugal.

Two kinds of data

Your account. For data about you — the person or business using AdTattle — we are the controller, as described on this page.

Your clients’ Google Ads accounts. For data we read from the advertising accounts you connect, you (or your client) are the controller and we are your processor, under our Data Processing Agreement.

What we collect

• Account data: your email address and sign-in provider, and your confirmation that you use the service for your business outside the UK.
• The Google Ads customer IDs you add, and what you type into the product.
• From each connected Google Ads account, only what the alerts need: the change history (what was changed, when, and whether by a person or by Google), daily spend and daily conversions. We do not read ad creatives, audiences, customer lists or billing details of those accounts.
• Usage data: pages viewed, actions taken, the campaign or page that brought you here.
• Billing data: subscription status and plan. Card details are handled by our payment provider and never reach us.
• Messages you send us, including feedback and email replies.

How we access Google Ads accounts

The owner of each account adds our Google user, [email protected], to it with Read only access, and we read the account through the Google Ads API as that user. We hold no passwords for your clients’ accounts, and Google Ads does not let a Read only user change anything in them. The owner can remove the access at any time in Google Ads. Data is read once a day and can be up to 24 hours behind Google Ads.

Why we use it

• To provide the service and your account, including the alerts (performance of a contract).
• To take payments and keep records required by law (contract, legal obligation).
• To understand how the product is used and improve it (legitimate interests, or consent where cookies are involved).
• To send service emails such as sign-in links, alerts and onboarding messages (contract, legitimate interests).

We never sell data, and we do not use data from connected accounts for anything but your alerts.

Cookies and analytics

We set cookies that are necessary to keep you signed in and to remember which page or campaign first brought you to the site. Analytics and advertising cookies are set only if you accept them in the cookie banner. If you decline, visits are counted without cookies and without an identifier stored on your device. You can change your choice by clearing this site’s data in your browser.

Who processes data for us

• Paddle — payments, invoicing and sales tax, as merchant of record.
• Supabase — database and authentication; data is encrypted at rest.
• Railway — application hosting.
• PostHog — product analytics, hosted in the EU.
• Resend — transactional email.
• Cloudflare — DNS and network security.
• Google — Google Ads, where the data of connected accounts comes from; sign-in with Google; and advertising measurement if you accept cookies.

Some of these providers are outside the UK and EEA. Where they are, transfers rely on adequacy decisions or standard contractual clauses.

How long we keep it

Data from a connected Google Ads account is deleted within 30 days after you remove the account from AdTattle, after its owner removes our access, or after you close your account — sooner if you ask. Account data is kept while your account is open and deleted within 30 days of a deletion request. What you have typed and not sent is kept until you send it or empty the form. Billing records are kept for as long as tax law requires.

Your rights

You can ask to access, correct, export or delete your data, and object to or restrict its processing, by emailing [email protected]. You can also complain to your data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD).