Privacy Policy

1. Who we are

Adako (adako.ai) is run by Ruslan Balzhyk, an individual (“Adako”, “we”, “us”). We are the controller of the personal data described in this policy, and you can reach us at support@adako.ai.

This policy covers the adako.ai website, the Adako web app, the MCP endpoint at adako.ai/mcp and API access with Adako keys (together, the “Service”). It does not cover the ad platforms or AI assistants you connect. Their own privacy policies apply to them.

If you use Adako for an organisation, for example an agency managing client accounts, that organisation decides which ad accounts are connected and why. Where the law treats us as its processor for that data, we process it only on its instructions and under our Terms of Service. Write to support@adako.ai for a data processing agreement.

2. What we collect

We collect what the Service needs to work. It comes from you, from the platforms you connect, and from the requests your AI assistant makes.

Your account

• Name, email address and password. The password is stored only as a salted one-way hash.
• If you sign in with Google: your Google account ID, name, email address, profile picture and the sign-in tokens Google issues.
• Settings: your write policy (direct or inbox), locale and time zone.

Sessions and security

• Session records with the IP address and browser user agent of each sign-in, and when the session expires.
• Short-lived cookies used while you sign in and connect platforms (see Cookies).
• A bot check when you send the sign-up, sign-in, verification code, password reset or contact form. A script from our host, Vercel, served through adako.ai, reads technical signals about your browser and connection to tell people from automated traffic, and Vercel tells us only whether the request passed. We use it for nothing else.

Connected ad platforms

• For each platform login: the platform’s user ID (on TikTok, the first advertiser account you granted), a display name (your Google account email, your Meta profile name, your LinkedIn email address or name, or the ChatGPT Ads account name), the permissions granted, the connection status and the last error the platform returned.
• The access and refresh tokens Google, Meta, TikTok and LinkedIn issue, or what you paste: a Meta access token (with its app secret, if your app requires one) or a ChatGPT Ads advertiser key. These are encrypted (see Security).
• For each ad account the login can reach: account ID, name, currency, time zone, manager relationship, and which account you made active or primary.
• A record of each time a stored token is decrypted: the purpose, the request and the time. It never contains the token.

Ad account data read on request

When a tool runs, Adako fetches what it needs from the platform and returns it to the AI assistant that asked. That can be campaigns, ad groups and ad sets, ads, keywords, search terms, audience names and sizes, budgets, bids, conversion actions, performance metrics, and lead forms and their submissions (see Lead form submissions). Apart from the synced history described next, we do not keep a copy of your ad accounts. Some responses are cached to avoid repeat calls: most for a few minutes, and reference details that do not change, such as the place a targeting location ID stands for, for up to a day. Parts of the data are kept in the tool-call and proposal records described below.

Adako’s tools do not read or upload the members of customer lists. Audience tools see only names, types, IDs and approximate sizes.

Lead form submissions

When you or your assistant read the submissions of a Meta lead form, Adako fetches them from Meta and returns them to that assistant: when each lead arrived, the ad and campaign it came from, and the answers given, which usually include a name, an email address and a phone number. The text summary shown in chat leaves the answers out. Adako does not store submissions: they are not kept in tool-call records, caches or the synced history. For this data you, the advertiser, decide what is collected and why, and Adako acts as your processor (see Lead form data).

Synced history

Adako also keeps a rolling history of each ad account you have made active, so monitors, briefs and the analysis tools can answer from stored numbers instead of reading the platform again. It holds daily performance metrics (impressions, clicks, cost, conversions and similar figures) for each campaign, ad group or ad set and, on Meta, each ad, together with a record of those objects: their IDs, names, status, budget and when they were first and last seen. On paid plans it is refreshed once a day and covers the last 90 days. On the Free plan it is a single 90-day snapshot taken when you connect. It never includes customer lists, search terms, lead submissions or anything about the people your ads reach.

Monitors, briefs and reports

If you create a monitor, we store its rule (the account, the metric, the threshold and the action you chose), its state and a record of each time it fired. If you schedule a brief or generate a report, we store the schedule, the report itself (a summary built from the synced history) and when it was sent. Alerts, briefs and reports are emailed to the address on your account. Those emails contain the account name and the figures that triggered them, and an action a monitor suggests becomes a proposal for you to approve; it is never carried out on its own.

Tool calls

Every tool call is recorded: the tool name, time, duration, status and error code, the ad account, the AI client or API key that made it, a hash of the arguments, and the arguments themselves with tokens, secrets and email addresses removed. Arguments can include campaign names, budgets, keywords, URLs and ad copy.

Proposals

Every change is stored as a proposal: the full request, the preview (what changes, before and after), the decision (approved or rejected, when, where, and any reason you gave), the result the platform returned, and a read-back of the object afterwards.

AI clients and API keys

• AI clients you authorise: the client’s registration details (its name, redirect addresses and the metadata it publishes), the scopes you approve on the consent screen, and the access and refresh tokens issued to it.
• API keys: the name you give, the first characters, a hash of the key, its permissions, expiry and revocation time. The full key is shown to you once and never stored.

Billing and usage

• Your plan, subscription status and billing period, the Creem customer and subscription IDs, and task counts for each period.
• Payments run through Creem, our reseller (see Creem). Your payment details and billing address go to Creem directly. Adako never sees or stores card numbers.

Images and videos you supply

When you ask for an ad built from an image or video URL, Adako either downloads the file, checks it and uploads it to the ad platform, or, on TikTok, gives TikTok the URL to fetch the file itself. We do not keep the file after the request.

Logs and support

• Our hosting provider records requests to the Service: IP address, time, URL and user agent. Our application logs record events with tokens and secrets redacted.
• When part of Adako fails, an error report goes to our error-reporting provider: the error and where in our code it happened, the page or API path without its query string, the tool that was running, the type of client that made the request and an internal request ID. Tokens, API keys, cookies and email addresses are removed before it is sent, and IP addresses are not stored.
• Messages you send us, and our replies.

Site analytics

We use Google Analytics to count visits to adako.ai and see which pages people use. When it runs (see Cookies for when it does), your browser sends Google:

• the pages you open, with each address cut to its path and campaign tags (utm_ parameters and Google Ads click IDs), and the page title;
• the site you came from, cut to its domain;
• your browser, operating system, device type, screen size and language;
• scrolling, clicks on links that leave the site, file downloads, and when a form is started or sent, never what you type into it;
• a random ID kept in a cookie, so that repeat visits can be told apart.

Google works out an approximate location (country and city) from your IP address and does not store the address. Analytics never receives your name, email address, Adako user ID or anything from your ad accounts, and it does not run on the checkout, AI client authorisation, password reset and email verification pages. Google signals and ad personalisation are switched off, and we do not use analytics data for advertising.

What we do not collect

No advertising trackers, and no fingerprinting to recognise or follow you. The bot check on our forms reads browser signals only to stop automated abuse. The fonts on this site are served from adako.ai. Apart from Google Analytics when it runs and the bot check, which our host runs through adako.ai, loading a page sends nothing to a third party. Paying takes you to our reseller’s own site (see Cookies). If a page fails in your browser, it sends the error report described above to our error-reporting provider.

3. How we use it

We use personal data only for the purposes below. The legal basis applies where the GDPR or UK GDPR applies to you.

We do not:

• sell or rent personal data, or share it for cross-context behavioural advertising;
• use your data or your ad account data to advertise to you or anyone else;
• use your data or your ad account data to train or improve AI or machine-learning models;
• make decisions about you by automated means that have legal or similarly significant effects;
• look at your ad account data ourselves, except with your permission (for example in a support request), to investigate security incidents or abuse, or where the law requires.

4. Your AI assistant

You use Adako through an AI assistant you choose: Claude, ChatGPT, Cursor, Claude Code or another MCP client. When the assistant calls a tool, the result goes back to it. That includes campaign names, metrics, search terms, ad copy and anything else the tool returns. From that point the assistant’s provider processes the data under its own terms and privacy policy, including whether conversations are stored or used for training.

If you approve the identity scopes on the consent screen, the assistant also receives your Adako user ID, name and email address.

You decide which assistants to connect and what they may do. To cut one off, remove Adako from the assistant’s connector settings, revoke its authorisation under Settings → Connected apps, revoke its API key on the Keys page, or ask us at support@adako.ai. Platform tokens are never sent to an assistant.

5. Data from ad platforms

Adako connects to an ad platform only when you connect it, and uses what it receives only to provide the features you use in Adako.

Google Ads

When you connect Google Ads, Adako asks for the Google Ads API scope (https://www.googleapis.com/auth/adwords) and your basic identity (openid, email). With them Adako:

• reads the Google Ads accounts your login can reach, and their campaigns, ad groups, ads, keywords, search terms, audiences, budgets, bids, conversion actions and performance metrics;
• creates and changes those objects only when you approve a proposal. New campaigns are always created paused;
• reads your Google account ID and email address to label the connection.

Google user data is stored and shared only as this policy describes: tokens encrypted on our servers, account details in our database, and tool results returned to the AI assistant you connected. We transfer it to others only as needed to provide the Service, for security, to comply with the law, or as part of a merger or acquisition with your prior consent. We do not sell it, use it for advertising, use it to determine credit-worthiness or for lending, or use it to train AI models. We read it ourselves only with your permission, for security, to comply with the law, or in aggregated form for internal operations.

Adako’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Adako’s access at any time on the Accounts page, or in your Google Account at myaccount.google.com/connections.

Meta

When you connect Meta through Facebook Login for Business, Adako asks for the ads_read, ads_management, business_management, pages_show_list, pages_read_engagement, pages_manage_ads and leads_retrieval permissions. With them, or with a token from your own Meta app (below), Adako:

• reads your Meta user ID and name, the businesses, ad accounts and Pages you grant, and their campaigns, ad sets, ads, creatives, audience names and sizes, and insights;
• reads the lead forms on those Pages and, when you ask, the submissions in them (see Lead form data);
• creates and changes those objects, and uploads ad images, only when you approve a proposal. New campaigns are always created paused.

Instead of signing in through Adako’s app, you can paste an access token from your own Meta app, such as a system user token. Adako then uses that token, with the permissions you gave it, for the same reads and for the changes you approve, as your service provider under our Terms. We store the token, and your app’s secret if your app requires one to sign requests, encrypted. We never send either to an AI assistant, and we erase both at once when you disconnect Meta. Before a token with an expiry date runs out, we email you a reminder to paste a new one. Adako cannot revoke a token you created: revoke it in the Meta Business settings where you made it.

We do not sell, license or purchase Meta Platform Data. We delete it on request as described in Deleting your data. You can remove Adako at any time on the Accounts page, or, if you signed in through Facebook, in Facebook under Settings and privacy → Settings → Business integrations.

TikTok Ads

When you connect TikTok Ads, you choose on TikTok for Business which advertiser accounts Adako may use, and TikTok grants the permissions approved for Adako’s app. With them Adako:

• reads the details of the advertiser accounts you grant, and their campaigns, ad groups, ads, videos and images, identities (the TikTok accounts ads can run as), pixels, instant pages and lead forms, targeting options, aggregated audience insights and performance reports;
• creates and changes those objects, and adds ad images and videos from the links you give, only when you approve a proposal. New campaigns are always created paused.

TikTok issues one long-lived access token and no refresh token, and we store it encrypted. When you disconnect, Adako erases our copy and asks TikTok to revoke the token. If TikTok does not confirm, withdraw the grant yourself by removing Adako from your TikTok for Business account.

LinkedIn Ads

When you connect LinkedIn Ads, Adako asks for the r_ads, r_ads_reporting, rw_ads, r_organization_admin and w_organization_social permissions and your basic identity (openid, email). With them Adako:

• reads your LinkedIn member ID and email address to label the connection;
• reads the ad accounts your login can reach, the Company Pages they advertise for, and their campaign groups, campaigns, creatives, conversions, targeting options, audience size estimates, aggregated audience insights and performance analytics;
• creates and changes those objects only when you approve a proposal. New campaigns are always created paused. Sponsored image, video and carousel ads need a post to show, so Adako creates one as the Company Page you choose and keeps it out of the Page’s feed.

LinkedIn offers apps no documented way to revoke a member’s token. Disconnecting in Adako erases the stored tokens; to remove the grant at LinkedIn as well, go to LinkedIn Settings → Data privacy → Permitted services.

ChatGPT Ads

ChatGPT Ads connects with an advertiser API key that you create and paste into Adako. We store it encrypted and use it to read the account, its campaigns, ads and performance, and to make the changes you approve. Removing the key from Adako does not revoke it at the platform. Delete or rotate it in ChatGPT Ads Manager to retire it everywhere.

Lead form data

People who fill in a lead form on your ads give their details to you, the advertiser, not to Adako. For that data you are the controller and Adako is your processor: we fetch submissions only when you or your assistant ask for them, pass them to that assistant, and do not keep them, contact the people in them or use them for anything else. Meta deletes lead data after 90 days. If someone asks us about details they gave in a lead form, we refer them to the advertiser whose form it was.

Adako is independent. It is not affiliated with, endorsed or sponsored by Google, Meta, TikTok, LinkedIn or OpenAI.

6. Who we share it with

We share personal data only in the cases below, or otherwise with your permission.

Service providers

These companies process data on our behalf, under contracts that limit them to providing their service to us.

We update this list before a new provider starts processing personal data.

Creem, our reseller

Paid plans are sold by Creem (Armitage Labs OÜ), our reseller and Merchant of Record. When you upgrade, we send Creem the email address on your account and your Adako user ID, so the payment is matched to your account. Creem collects your payment details, billing address and tax information, and handles payments, invoices, tax and refunds as a controller under the Creem Privacy Notice. Creem tells us your subscription status, billing period and its customer and subscription IDs.

Platforms and assistants you connect

We send Google, Meta, TikTok, LinkedIn and OpenAI the requests you make through Adako, including the changes you approve and the images and videos you supply, and we return results to the AI assistants you connect. They handle that data under their own terms.

Legal and safety

We disclose data when the law requires it, or when it is necessary to protect the rights, property or safety of our users, the public or Adako, for example to stop fraud or abuse. Where the law allows, we tell you first.

Business transfers

If Adako moves to a company set up to run it, or is sold, data may transfer to the new operator under this policy. We will tell you before that happens. Google user data transfers only with your prior consent.

7. Cookies

Adako sets the cookies it needs to work and, when analytics runs, Google Analytics cookies. There are no advertising cookies.

If your browser is set to a time zone in the EEA, the UK or Switzerland, Adako asks before Google Analytics runs, and it stays off unless you accept. Google also keeps analytics cookies off by default for visitors whose IP address is in those places. Everywhere else it runs by default. Wherever you are, Cookie settings in the site footer changes your choice at any time, and declining deletes the Google Analytics cookies on adako.ai. Your choice is kept in your browser’s local storage, so we do not ask on every visit.

Paying takes you to Creem’s own checkout page, and Creem hosts the billing portal. No Adako page loads any Creem script. There, Creem may set its own cookies and collect device information, for example to prevent fraud, under the Creem Privacy Notice.

8. Security

• Traffic to and from Adako is encrypted with TLS.
• Platform tokens and advertiser keys are encrypted with AES-256-GCM under a separate data key for each connection, which is itself encrypted with a master key. A token is decrypted only for the call that needs it, each decryption is recorded, and tokens are never sent to AI clients or written to logs.
• Passwords and API keys are stored as hashes.
• Only the operator and the services that need it can access production systems and data.
• Every change is a proposal you approve, and new campaigns are created paused.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires. Report vulnerabilities to support@adako.ai, as our security policy describes.

9. How long we keep it

When you delete your account in Settings, we delete your personal data at once; when you ask by email, within 30 days. The exceptions are billing records we must keep, the Free plan record described in Deleting your data, and data we need for an open security investigation or legal claim. Deleted data can remain in encrypted database backups until the normal backup cycle overwrites it.

10. Your rights

Wherever you live, you can ask us to:

• give you a copy of your personal data in a portable format;
• correct data that is wrong;
• delete your data (see Deleting your data);
• stop processing it for a purpose you object to.

You can also disconnect a platform on the Accounts page, revoke API keys on the Keys page, and change your write policy or delete your account in Settings at any time.

EEA, UK and Switzerland

Under the GDPR and UK GDPR you also have the right to restrict processing, to object to processing based on legitimate interests, to withdraw consent where we rely on it, and to lodge a complaint with your local data protection authority. We would welcome the chance to resolve your concern first.

California and other US states

California residents have the right to know what personal information we collect, use and disclose; to delete and correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Residents of other US states with privacy laws have similar rights.

In the past 12 months we collected these categories of personal information, for the purposes in How we use it, and disclosed them for business purposes to the service providers in Who we share it with: identifiers (name, email address, IP address, account IDs); commercial information (plan and payment history); internet or other electronic network activity (tool calls, session and request logs, site analytics); and sensitive personal information limited to account login credentials, used only to sign you in. We do not sell or share personal information, and have not done so in the past 12 months. Lead form submissions we pass to advertisers are handled as their service provider and are not part of these categories.

How to make a request

Email support@adako.ai from the address on your Adako account. We may ask you to confirm your identity. We answer within one month, or 45 days for California requests, and tell you if we need longer. An authorised agent can make a request for you with your signed permission.

11. Deleting your data

You can remove Adako’s access to a platform, or delete everything Adako holds about you.

Disconnect a platform

1. Sign in and open Accounts.
2. Choose Disconnect next to Google Ads, Meta, TikTok Ads, LinkedIn Ads or ChatGPT Ads.

Adako erases the stored tokens at once, deactivates the ad accounts, stops syncing their history and asks Google, TikTok, and Meta when you signed in through Facebook, to revoke its access. If TikTok does not confirm the revocation, remove Adako in your TikTok for Business account. The rest have to be removed on the platform side: remove Adako under LinkedIn Settings → Data privacy → Permitted services, revoke a Meta token from your own app in your Meta Business settings, and delete or rotate a ChatGPT Ads key in ChatGPT Ads Manager.

You can also remove Adako from the platform side: in your Google Account at myaccount.google.com/connections, in Facebook under Settings and privacy → Settings → Business integrations, or in LinkedIn under Settings → Data privacy → Permitted services.

Delete your account

1. Sign in and open Settings.
2. Under Delete account, type the email address of your account and choose Delete account.

Adako cancels any paid subscription at once, with no further charges, asks Google, and Meta when you signed in through Facebook, to revoke its access, and deletes your account, connections, tokens, ad account records, synced history, proposals, tool-call records, monitors, reports, API keys and AI client authorisations. You are signed out and we email you to confirm, listing any platform where you still need to remove Adako yourself.

If you cannot sign in, email support@adako.ai from the address on your Adako account, with the subject “Delete my account”. We confirm the request, delete the same data within 30 days and email you when it is done. If you also want a copy of your data, ask before you delete: once the account is gone, there is nothing left to export.

One thing stays for a short time. If you were on the Free plan, we keep a one-way keyed hash of your email address with the number of Free tasks you used that month, until the end of that calendar month. A new account created with the same address in that month continues from that count instead of starting a new Free allowance. The hash cannot be turned back into your address, and nothing else about the deleted account is kept with it.

Deleting your Adako data does not change your ad accounts: campaigns and ads Adako created stay exactly as they are, paused or live. Creem keeps the invoices for your payments as tax law requires (see Creem).

To delete only the data Adako received from Meta, say so in your email. We delete it as soon as reasonably possible and confirm when it is done.

12. International transfers

Adako’s servers and database are in the United States (Virginia), and our email, key management, error reporting and analytics providers process data in the United States.Creem processes payment data in the countries its Privacy Notice lists. When personal data leaves the EEA, the UK or Switzerland, we rely on an adequacy decision, such as the EU–US Data Privacy Framework for certified recipients, or on the European Commission’s Standard Contractual Clauses and the UK Addendum.

13. Children

Adako is a business tool for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to support@adako.ai and we will delete it.

14. Changes to this policy

We update this policy when our practices change. The date at the top shows the current version. If a change materially affects how we use your data, we email you before it takes effect.

15. Contact

Adako is run by Ruslan Balzhyk. For privacy questions and requests, security reports and everything else, write to support@adako.ai.