Privacy Policy

Information we collect

We collect only what we need to provide the service:

• Account information. When you sign up, we collect your name and email address, and (if you sign in with Google) your Google profile’s basic details, to create and secure your account.
• Organization data. The companies (organizations) you create, your role, and the teammates you invite.
• Google Ads data. If you choose to connect a Google Ads account, we access your Google Ads reporting data (such as campaigns, spend, clicks, impressions, and conversions) through the Google Ads API in order to display analytics to you.
• Technical data. Basic log and device information needed to operate the service and keep it secure.

How we use information

• To authenticate you and provide, maintain, and secure the service.
• To display your Google Ads performance analytics and reporting within the application.
• To communicate with you about your account, invitations, and service changes.
• To detect, prevent, and address fraud, abuse, security, or technical issues.

Google API Services User Data Policy — Limited Use

Starfish Ads’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We request read-only access to your Google Ads data, solely to provide and improve user-facing features within Starfish Ads.
• We do not use Google user data for serving advertising.
• We do not sell Google user data, and we do not transfer it to third parties except as necessary to provide the service, comply with applicable law, or as part of a merger or acquisition.
• We do not allow humans to read your Google user data unless (a) you give explicit consent for specific data, (b) it is necessary for security purposes (such as investigating abuse), or (c) required by applicable law.

How we store and protect your data

• Data is transmitted over encrypted connections (HTTPS/TLS).
• Access credentials and OAuth tokens for connected Google Ads accounts are encrypted at rest and are only ever accessible to our backend — never exposed to the browser or other tenants.
• Each organization’s data is logically isolated; we enforce access controls so one customer cannot access another customer’s data.

Data sharing

We do not sell your personal information. We share data only with service providers that help us operate the platform (for example, cloud hosting and database providers) under confidentiality obligations, or where required by law.

Data retention and deletion

We retain your information for as long as your account is active or as needed to provide the service. You can disconnect a Google Ads account at any time from the application’s integration settings; when you do, we revoke the associated authorization and delete the stored tokens. You may request deletion of your account and associated data by contacting us at privacy@starfish.engineering.

Your choices and rights

• Revoke Starfish Ads’s access to your Google account at any time via your Google Account permissions.
• Access, correct, or delete your account information by contacting us.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you.

Contact us

If you have questions about this Privacy Policy or our data practices, contact Starfish Engineering at privacy@starfish.engineering.