Privacy Policy
Last Updated: September 20, 2026
Adsage Data Uploader ("we", "our", or "the application") is a business intelligence tool operated by Markethical Agency that helps marketing teams aggregate and analyze advertising metrics from multiple platforms. This Privacy Policy explains how we collect, use, store, and protect your data when you use our service.
Key Principle: We are a read-only analytics tool. We only request the minimum permissions necessary to fetch advertising metrics and analytics data. We never modify your campaigns, posts, or settings on any connected platform.
1. Information We Collect
1.1 Authentication Data
When you authorize Adsage to access your advertising accounts, we collect and store:
- Email Address: Used to identify your authorization and manage your OAuth tokens (Google Ads, Google Analytics 4, Facebook only)
- OAuth Access Tokens: Temporary tokens that allow us to fetch data from your advertising accounts
- OAuth Refresh Tokens: Used to automatically renew access tokens without requiring re-authorization (Google, TikTok TT_User only)
- Account Identifiers: Platform-specific user IDs or display names for token management
1.2 Advertising Metrics and Campaign Data
We fetch and store the following types of data from your authorized accounts:
- Campaign Metrics: Impressions, clicks, cost, conversions, reach, engagement rates
- Campaign Dimensions: Campaign names, ad group names, ad names, budgets, status
- Google Analytics 4 Data: User behavior metrics, e-commerce transactions, traffic sources, session data (read-only access)
- Google Merchant Center Data: Product catalog information, inventory data (read-only access)
- Social Media Metrics: Facebook page follower counts, Instagram follower counts, engagement metrics
- Creative Data: Ad creative descriptions, image URLs, preview links (Facebook only, when enabled)
1.3 Technical and Usage Data
- System Logs: Application activity logs for debugging and error tracking
- API Response Data: Cached currency codes and last successful data fetch timestamps
2. How We Use Your Information
2.1 Primary Purpose
We use your data exclusively for:
- Data Aggregation: Fetching advertising metrics from multiple platforms and storing them in a centralized database
- Analytics and Reporting: Providing unified views of your marketing performance across platforms
- Token Management: Maintaining authentication to automatically fetch updated data
2.2 Read-Only Operations
Important: We NEVER write to, modify, or delete your campaigns, ads, or settings on any connected platform. All our API requests are read-only operations for fetching metrics and analytics data.
3. Specific Platform Permissions
3.1 Google Services
We request the following scopes from Google:
https://www.googleapis.com/auth/adwords - Read Google Ads campaign data, metrics, and performance reports
https://www.googleapis.com/auth/analytics.readonly - Read-only access to Google Analytics 4 data (user behavior, e-commerce metrics)
https://www.googleapis.com/auth/content - Access to Google Merchant Center data (product catalog, inventory) - Note: While this scope technically allows write access, we only perform read operations
https://www.googleapis.com/auth/userinfo.email - Access your email address for authentication and token management
What we do with Google data:
- Fetch campaign metrics (impressions, clicks, cost, conversions) from Google Ads
- Retrieve user behavior and e-commerce data from GA4 properties you have access to
- Read product catalog data from Google Merchant Center accounts you have access to (product listings, inventory status, pricing)
- Store metrics in our database for historical tracking and reporting
- Normalize traffic source and medium data for unified analytics
What we DON'T do:
- We never create, modify, pause, or delete Google Ads campaigns or ads
- We never change your Google Analytics settings or configurations
- We never modify, add, or delete products in your Merchant Center catalog - despite having technical permission, we only perform read operations
- We never access personal user data beyond aggregate metrics
3.2 Facebook/Meta Services
We request the following permissions from Facebook:
ads_management - Access to read advertising accounts and campaigns
ads_read - Read campaign metrics and insights
read_insights - Read page and ad insights
business_management - Access business-managed assets
email - Your email for authentication
pages_show_list - List Facebook Pages you manage
pages_read_engagement - Read page follower and engagement metrics
instagram_basic - Access basic Instagram Business Account info
instagram_manage_insights - Read Instagram insights and metrics
What we do with Facebook data:
- Fetch ad campaign metrics (reach, impressions, clicks, cost, conversions)
- Retrieve creative data (ad copy, image URLs, preview links) when enabled by the user
- Collect Facebook Page follower counts and organic engagement metrics
- Collect Instagram Business Account follower counts and insights
What we DON'T do:
- We never create, edit, or delete your Facebook ad campaigns
- We never post to your Facebook Pages or Instagram accounts
- We never access private messages or personal communications
3.3 TikTok Services
TikTok Marketing API:
user.info.basic - Basic user information for authentication
ad_account.read - Read advertiser account information
campaign.read - Read campaign and ad group data
reporting.read - Read advertising metrics and reports
audience.management - Read audience data for reporting
TikTok TT_User API (for creative access):
user.info.basic, user.info.username, user.info.stats - User identification and stats
video.list, video.insights - Access to video content and metrics
user.insights - TikTok profile insights
What we do with TikTok data:
- Fetch advertising campaign metrics (impressions, clicks, spend, conversions)
- Access boosted/organic video creative data for reporting
- Collect campaign and ad group performance data
What we DON'T do:
- We never create, modify, or delete TikTok ad campaigns
- We never post or publish content to TikTok accounts
- We never access private account data or direct messages
3.4 LinkedIn Advertising API
When you choose to connect a LinkedIn advertising account, LinkedIn asks you to authorize Adsage through its OAuth 2.0 authorization flow. We request only the permissions needed to identify advertising accounts you can access and retrieve their reporting data:
r_ads - Read the advertising accounts available to the authorized LinkedIn member and their advertising account structure
r_ads_reporting - Read advertising reporting data for accounts to which the authorized member has access
What we do with LinkedIn data:
- Retrieve account, campaign group, campaign, creative, and performance-reporting data such as impressions, clicks, spend, engagement, video, lead, and conversion metrics.
- Provide aggregated reporting and historical analysis for the authorized advertising accounts.
- Where available, retrieve aggregate professional-demographic reporting. This data is aggregated by LinkedIn and does not identify individual LinkedIn members.
What we do not do:
- We do not request
rw_ads and do not create, edit, pause, or delete LinkedIn campaigns, ads, targeting, or account settings.
- We do not use LinkedIn member data to create leads, enrich profiles, build audience lists, target advertising, or send messages.
- We do not sell, export, or disclose LinkedIn-derived data except as necessary to provide the authorized customer's reporting within Adsage.
4. Data Storage and Security
4.1 Storage Location
- All data is stored on secure servers operated for the service in Europe
- OAuth tokens are stored securely with restricted file permissions and are accessible only to authorized system processes
- Campaign metrics are stored in a MySQL 8.0.42 database with SSL/TLS encryption
4.2 Security Measures
- Access Control: OAuth tokens are protected by file system permissions and accessible only by authorized system users
- Email Whitelist: Only pre-approved email addresses can authorize Google and Facebook accounts (prevents unauthorized access)
- HTTPS Only: All OAuth callbacks and web interfaces use HTTPS encryption
- Token Refresh: Access tokens are automatically refreshed and expire after short periods (1 hour for Google)
- CSRF Protection: OAuth flows use state parameters to prevent cross-site request forgery
- Logging and Monitoring: All authorization attempts are logged for security auditing
4.3 Data Retention
- OAuth Tokens: Stored until you revoke access or tokens expire
- Campaign Metrics: Retained only for as long as needed to provide the service and in accordance with the applicable platform's data-retention rules. LinkedIn advertising-account administration and reporting data is retained for no more than one year.
- System Logs: Retained for 90 days for debugging and security purposes
5. Data Sharing and Third Parties
5.1 No Third-Party Sharing
We do NOT sell, rent, or share your data with third parties. Your advertising metrics and OAuth tokens are used exclusively for the purpose of data aggregation and reporting within our system.
5.2 Platform APIs
We interact with the following third-party APIs to fetch your data:
- Google Ads API - Campaign metrics and performance data
- Google Analytics 4 API - User behavior and e-commerce analytics
- Facebook Marketing API - Ad campaign metrics and creative data
- Facebook Graph API - Page and Instagram insights
- TikTok Marketing API - Advertising campaign data
- TikTok TT_User API - Video content and insights
- LinkedIn Advertising API - Advertising account structure and reporting data
These API requests are made on your behalf using your authorized OAuth tokens. We only request the data necessary for analytics and reporting purposes.
6. Your Rights and Controls
6.1 Access and Portability
You have the right to:
- Request a copy of all data we have stored about your accounts
- Export your advertising metrics in CSV or JSON format
6.2 Revocation of Access
You can revoke Adsage's access to your accounts at any time by:
- Via Adsage: Visit oauth.markethical.agency and use the token revocation interface
- Via Platform Settings:
- Google: myaccount.google.com/permissions
- Facebook: Settings > Business Integrations
- TikTok: Settings > Privacy > Apps and websites
- LinkedIn: LinkedIn account settings or the LinkedIn authorization flow, as applicable
Upon revocation, we will stop fetching new data from the affected account. Historical data will be retained only as described in this policy unless you request deletion.
6.3 Data Deletion
You can request complete deletion of:
- Your OAuth tokens and email address
- All campaign metrics and dimensions associated with your accounts
- System logs containing your authentication data
Contact us to initiate a data deletion request. We will process requests within 30 days.
7. Limited Use Disclosure
Adsage's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Limited Use Commitment: We only use Google user data for the sole purpose of providing and improving our advertising analytics service. We do not use Google user data for:
- Serving advertisements
- Training machine learning models unrelated to our service
- Selling to data brokers or third parties
- Any purpose unrelated to aggregating and reporting advertising metrics
8. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:
- We will update the "Last Updated" date at the top of this policy
- For material changes, we will notify users via email (if provided) or through the application interface
- Continued use of the service after changes constitutes acceptance of the updated policy
9. Children's Privacy
Adsage is a business tool intended for use by marketing professionals and organizations. We do not knowingly collect data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately.
10. Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA), our legal basis for processing your data is:
- Consent: You provide explicit consent when authorizing our application to access your advertising accounts
- Legitimate Interests: We process data to provide analytics and reporting services you have requested