Privacy Policy

• Waitlist. Your email address, when and how you joined, and a one-way, keyed hash of your IP address that we use only to stop the form being abused. We don't store the IP address itself.
• Your account. Your email address, your name if you give it, and when you agreed to these terms. Your password is handled by our sign-in service and stored only as a secure hash. We keep a record of your sign-in sessions to keep your account secure.
• Apple Ads. When you connect, the API key details (we create the key pair, and the private key is encrypted and kept in a separate, isolated service) and the data your key gives access to: ad accounts and your role on them, campaigns, ad groups, ads, keywords, search terms, bids, budgets, product pages, and performance figures such as spend, impressions, taps and installs. We also read app names and icons from the public App Store.
• RevenueCat (optional). Your secret API key, stored encrypted, and aggregated revenue and conversion figures for your campaigns and keywords. We don't ask RevenueCat for your customers' individual records.
• DeepL (optional). Your API key, stored encrypted, and the keywords and search terms you ask us to translate.
• Records of what happens. A log of every request we make to Apple, RevenueCat, DeepL, our AI provider, the exchange-rate service and our email provider: the time, address, result and, for most requests, their content, with keys and tokens removed. A log of every change made to your campaigns and by whom. Records of the emails we send you.
• Website analytics, only if you accept cookies. Through Google Tag Manager and Google Analytics: pages you visit, how you arrived, your device and browser, and your approximate location. We also use Google Search Console, which shows us how our site appears in Google search, in aggregate.

• To provide the Service you asked for (performance of our contract with you): your account, syncing and showing your data, managed campaigns and the automated changes you turn on, keyword research, translations, plan limits and support.
• To keep the Service secure and working (our legitimate interests): request and change logs, sign-in records, preventing abuse, fixing problems and understanding how the Service is used.
• To email you: closed beta invitations, waitlist confirmations and messages about your account (contract or legitimate interests). We'll ask before sending marketing emails.
• Website analytics (your consent), which you can withdraw at any time from "Cookie settings" at the bottom of our website.
• To meet legal obligations and to establish or defend legal claims.

The automated decisions AdsKitty makes are about your ad campaigns, such as bids and keywords. We don't make automated decisions about you as a person that have legal or similarly significant effects.

We share information only with the service providers we need, under contracts that require them to protect it, and only for the purposes above:

• Google Cloud, which hosts the Service and its databases.
• Resend, which sends our emails.
• Google, for website analytics if you accept cookies, and Search Console.
• Anthropic, our AI provider, which receives public App Store listing text and the keywords and search terms we're checking for your app, to research keywords. We don't send it your name or email.
• DeepL, which receives the texts you ask us to translate.
• Apple and RevenueCat, whose APIs we call on your instructions, with the keys you gave us. A public exchange-rate service receives currency codes only.

We may also disclose information if the law requires it, to protect our rights or users' safety, or to a buyer if our business is sold, who must then honor this policy.

Our providers may process information outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses or the provider's certification.

• Account and workspace data: while your account exists, and deleted when you ask us to delete it, except what we must keep by law.
• Apple Ads data: while the connection exists. Disconnecting deletes the connection, its keys and the campaign data synced through it. The records of managed campaigns you created in AdsKitty and the change log stay with your workspace until you ask us to delete them.
• Request logs: a summary of each request for 2 years, and its full content for 6 months, then deleted automatically.
• Waitlist entries: until the public beta opens and we've told you, or sooner if you ask.
• Website analytics: no more than 14 months in Google Analytics.

Keys and secrets are encrypted, Apple private keys are kept in a separate, isolated service, connections use TLS, and access to data is restricted by role. No system is perfectly secure, so we can't guarantee security. See our vulnerability disclosure policy to report a problem.

Depending on where you live, including under the GDPR, the UK GDPR and Turkey's KVKK, you can ask to access, correct, delete or receive a copy of your information, to restrict or object to how we use it, and to withdraw consent at any time. Email info@adskitty.com; we'll answer within the time the law sets, usually a month. You can also complain to your data protection authority.

The app itself never loads Google Analytics; only the public website does, and only after you accept.

AdsKitty is for businesses and isn't meant for anyone under 18. We don't knowingly collect information about children.

We'll update this policy when what we do changes. If a change matters, we'll tell you in the app or by email before it takes effect.

Questions or requests about your information: info@adskitty.com.