Privacy preferences

Your account works regardless of these choices. Preferences are remembered for 180 days.
Start free — 60 days of AI + monitoring
TryAdCortex.com

Data Safety

We take the security and privacy of your data seriously. This page explains the technical and organizational measures we use to protect your information, how your advertising data is handled, and the controls you have over it.

Last updated: September 10, 2026 Contact: support@tryadcortex.com

1. Encryption & Data in Transit

All communication between your browser and AdCortex is encrypted using HTTPS/TLS. This applies to:

  • Every page load and API call within the app.
  • OAuth token exchanges with Google during account authorization.
  • Outbound requests from AdCortex servers to Google Ads APIs and other third-party services.

We do not serve any AdCortex page or endpoint over unencrypted HTTP in production.

2. Data at Rest

Your advertising data and account information are stored on Microsoft Azure infrastructure. Sensitive credentials — including OAuth tokens and service account keys — are stored using server-side protections and are never exposed in logs, API responses, or client-side code.

Report outputs and cached data are stored in Azure Blob Storage with access scoped to authorized application services only.

3. Authentication & Access Controls

Access to AdCortex is controlled at multiple levels:

  • Google OAuth 2.0 — Users sign in via Google. We never store your Google password.
  • Workspace isolation — Each workspace is siloed. Users in one workspace cannot access data from another.
  • Role-based access — Workspaces enforce user roles (admin, member, read-only), restricting which features and data each user can reach.
  • Domain allowlisting — Workspace admins can restrict access to specific email domains, preventing unauthorized sign-ups.
  • CSRF protection — All state-changing requests are protected against cross-site request forgery using per-session tokens.
  • Session security — Sessions are server-managed, cryptographically signed, and expire after inactivity.

4. Google API Data — Limited Use

AdCortex's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • Google Ads data is used only to generate reports, dashboards, alerts, and the Google Ads changes you review and approve within your AdCortex workspace.
  • We do not sell, transfer, or disclose Google user data to any third party for advertising, data brokering, or any purpose unrelated to delivering the service.
  • We do not use Google user data to train or improve AI or machine learning models.
  • Gmail send access is used exclusively to dispatch reports you configure — we never read the contents of your inbox.

5. AI Features & Third-Party Inference

AdCortex uses OpenAI's API for AI inference. Advertising data reaches OpenAI in these ways, and only these:

  • On-demand AI tools — Ask AdCortex, AI Create, AI Full Mode, AI Copy, Headline Creator, Campaign Creator, Ad Competitor, Negative Keyword suggestions, campaign tag review, account matching and profile fill, and the AI explanations in Dayparting, Quality Score, Budget Pacing, Anomalies and Portfolio Health run only when you click to run them or open the panel that shows them. They send the subset of your account data needed for that request and nothing else. AI Full Mode also runs one review on its own when you finish onboarding, and Headline Creator's site research sends your website address to OpenAI's web search.
  • Pro monitoring (automated) — For accounts where Pro is enabled, anomaly detection runs each night without a click. Its statistical layers run entirely on our infrastructure; only entities that fail a check are passed to an AI judgement step, which receives aggregated performance metrics, campaign names, recent change history, and budget history for that entity. Enabling Pro on an account is what authorizes this scheduled processing; disabling Pro stops it.
  • Pro briefs and profiles (automated) — For the same Pro accounts, each scheduled portfolio brief your recipients receive (daily, weekly, monthly or quarterly) includes an AI write-up, which receives that account's totals for the period and the prior period, its largest campaign spend changes, and its anomaly findings. When a new Pro account appears, its name and its website's title, description and headings are sent once to draft its company profile. Disabling Pro stops both.

In every case:

  • OAuth tokens, passwords, email addresses, and other credentials are never included in any AI request.
  • Data is not retained by OpenAI beyond what is required to return a response, consistent with OpenAI's API data usage policies.
  • Workspaces may supply their own OpenAI API key so inference runs under their own agreement with OpenAI.
  • AI output is advisory. Nothing an AI step produces is written to Google Ads until a person reviews and approves it (see section 6).

6. Google Ads Write Access

AdCortex can change Google Ads accounts — budgets, negative keywords, keyword pauses, ad schedules, ad groups, ads, and Performance Max campaign settings. Every write follows the same path:

  • Nothing writes immediately. Every change from every tool is staged in a review queue (Checkout). No report page writes to Google Ads on its own.
  • A person pushes it. Only platform admins, workspace admins, and the Google Ads MCC owner can execute the queue. The customer role is read-only and cannot reach the queue or its API.
  • Nothing is automatic. AdCortex never adjusts bids, budgets, or campaign status on a schedule or on its own judgement. Monitoring produces findings; people make changes.
  • Everything is logged. Each executed change — including partial failures — is recorded with who pushed it and when, viewable in-app for 90 days and exportable in full as CSV.

7. Infrastructure & Operational Security

Our infrastructure and operational practices include:

  • Cloud hosting on Microsoft Azure — benefiting from Azure's physical and network security controls, availability zones, and compliance certifications.
  • Least-privilege access — Application services access only the resources they need. No overly permissive service accounts.
  • Dependency management — We keep third-party libraries updated and monitor for known vulnerabilities.
  • Error logging and monitoring — Application errors are logged server-side for rapid diagnosis. Logs do not capture sensitive user data or OAuth tokens.
  • No shared credentials — Each workspace's OAuth tokens are stored and accessed separately. A compromise of one account does not expose another.

8. Data Minimization

We request only the Google API scopes required to deliver the service. We do not request access to your personal Google Drive, Gmail inbox, Contacts, Calendar, or any other Google service beyond Google Ads (read and write, as described in section 6) and Gmail (send-only).

Within Google Ads, we read campaign performance data, keywords, search terms, geographies, conversions, change history, and account structure — for the purpose of generating the reports, alerts, and reviewed changes you use. We keep each account's full performance history while it is active. After an account is deactivated, we keep its data for at least 180 days unless you delete it sooner (section 10); after that, how long we keep it depends on the account's history and how long it has used AdCortex.

9. Incident Response

In the event of a security incident that may affect your data, we will notify affected users promptly and take immediate steps to contain and remediate the issue. We will provide clear information about what happened, what data was involved, and what actions you should take.

To report a suspected security vulnerability or incident, contact us directly at support@tryadcortex.com.

10. Your Controls

You have direct control over your data:

  • Revoke Google access — You can disconnect AdCortex from your Google account at any time via your Google Account permissions page. This immediately stops all data access.
  • Disconnect and delete — Workspace administrators can disconnect Google Ads and delete the stored Google Ads data themselves from Settings in the app, or email us and we will do it within 3 business days. See Manage and Delete Your Data.
  • Workspace admin controls — Admins can manage users, revoke access, and configure domain restrictions directly within the app.
  • Email report controls — Manage report recipients and scheduling from within the app without needing to contact us.

11. Contact

Questions about our data safety practices or to report a concern: support@tryadcortex.com

For more detail on how we collect and use data, see our Privacy Policy.