ads.ainative.kz

Privacy policy

This policy describes what data ads.ainative.kz processes, why, how it is obtained, stored and shared, and how you can manage it. By registering in the service or signing in with Google, you agree to this policy. The use of data is limited to what is described here.

Operator and contacts

Operator: [Sole proprietor], IIN/BIN [IIN/BIN], address: [Address]. Questions about data, and requests to change or delete it: [Contact email].

What data we process

  • Account. Email address, name, interface language. The password is not stored: only its cryptographic hash is kept. When you sign in with Google (permissions openid, email, profile): your Google identifier, name and email address.
  • Google Ads data. Only when you yourself click “Connect Google Ads” and grant a separate permission (https://www.googleapis.com/auth/adwords), we read: the list of accounts available to you and the hierarchy of manager accounts (MCC); account settings — currency, time zone, tracking template, final URL suffix; structure — campaigns, ad groups, keywords, ads, assets, final URLs and URL parameters at all levels; negative keywords of campaigns and ad groups, shared negative keyword lists with their contents and campaign links; statistics — cost, impressions, clicks and conversions by conversion action, by day and by device; the search terms report — the texts of queries that triggered your ads, with aggregated metrics.
  • Google refresh token. Stored encrypted (AES-GCM); the encryption key is kept separately from the database. It is never written to logs.
  • Work in the service. Organizations, members and their roles, agencies, invitations (email addresses of invitees), signal settings and thresholds, prepared and applied negative keywords.
  • Technical data. The browser type (User-Agent) of a session. To protect against password guessing and abuse, the service counts sign-in attempts and requests by email address and IP address; only hashes and counters are stored, and they are deleted automatically.

What we do not collect

The Google Ads API does not provide personal data about the people who clicked your ads, and we do not receive it. We receive only aggregated metrics and the texts of search queries that triggered your ads.

Why we need the data

  • to show analytics for your Google Ads accounts: conversions and their cost, signals, expensive queries, negative keyword coverage, landing pages and UTM;
  • to prepare negative keyword suggestions and a forecast of what they will block, and to apply them to the account when you click;
  • to create an account, sign you in and separate access: organizations, roles, agencies;
  • to send emails — email confirmation, password reset and invitations;
  • to protect the service from abuse.

We use access to Google Ads only to provide these user-facing features. We do not sell data and do not use it for advertising. Google data is not passed to AI models.

What we write to your Google Ads account

Only the addition of negative keywords — to a shared list, a campaign or an ad group — and only when a user with the Manager or Owner role explicitly clicks and confirms on the confirmation screen. The “applied” status is set only after the service has read the account and found the word. The service changes nothing else in the account: it does not create or delete campaigns, ads, budgets, bids, shared lists or their links. The nightly analysis only lays out suggestions on screen and does not write to the account. An added word can be removed manually in Google Ads.

Compliance with the Google API Services User Data Policy (Limited Use)

ads.ainative.kz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In line with the Limited Use requirements:

  1. We use data received from Google APIs only to provide or improve the user-facing features of the service described in this policy.
  2. We do not transfer this data to others, except when it is necessary to provide those features and you consent; necessary for security purposes (for example, investigating abuse); required by law; or part of a merger, acquisition or sale of assets, with your explicit prior consent.
  3. Humans do not read this data, except when you have given explicit consent to view specific data; it is necessary for security purposes (for example, investigating a bug or abuse); it is required by law; or the data is aggregated and anonymized and used for internal operations.
  4. We do not transfer or sell this data to third parties such as advertising platforms, data brokers or resellers; we do not use it to serve ads, including retargeting, or to determine creditworthiness or for lending.
  5. Our employees, contractors, agents and successors are required to comply with this policy.

Who we share data with

  • Google — the source of Google Ads data and sign-in with Google; processing on Google's side is governed by Google's terms and policy.
  • Email service — receives the recipient address and the text of the message.

There are no other recipients, except where disclosure is required by law. Data is not sold, not used for advertising or retargeting, and not passed to AI models.

Where data is stored

Data is stored on servers in the Republic of Kazakhstan. The recipients listed above process data on their own side: Google (data source and sign-in) and the email service (messages).

Cookies and local storage

We use only necessary cookies: the session (so you stay signed in; valid for up to 30 days and extended while you use the service) and a temporary cookie for verifying sign-in with Google (10 minutes). There are no advertising or analytics cookies or trackers, and no third-party scripts are loaded. The app remembers the interface language and theme in the browser's local storage.

Retention

  • Account — while it exists.
  • Google Ads account data — while the account is connected to an organization; it is deleted when the account is disconnected, when the organization is deleted and when your account is deleted.
  • Google refresh token — until the account is deleted or you revoke access.
  • Database backups — 14 days: deleted data also disappears from backups within this period.

Data deletion and revoking access

You can delete your account in the app: “Account” → “Delete account”, or by email to [Contact email]. You can disconnect an account on the organization “Accounts” screen. You can revoke the service's access to your Google account at https://myaccount.google.com/connections: after revocation, loading stops and the service asks you to reconnect Google Ads. The refresh token is deleted together with the account.

Your rights

Under the personal data legislation of the Republic of Kazakhstan, you have the right to know what data about you is processed and to receive it; to demand correction, blocking or deletion of data; to withdraw consent to processing; and to apply to the authorized state body. To exercise your rights, write to [Contact email].

Changes to this policy

We may update this policy. The current version is always published on this page. If we change how we use Google data, we will notify you and obtain your consent to the updated policy before we start using the data in the new way.