> legal

Privacy policy

Last updated 15 September 2026

Who we are

AdCrew is run by SIA "AdCrew" (registration No. 50203583111, VAT No. LV50203583111), "Sarma Nr. 123", Baldones pag., Ķekavas nov., LV-2125, Latvia. We are the controller of the personal data described here. Contact us about anything in this policy at [email protected].

When a business uses AdCrew for its own marketing, that business decides what goes into its workspace and which ad accounts it connects. For that content we act on the business's behalf.

What we collect

• Your account: email address and password (stored only as a hash), the businesses you belong to and your role in each.
• Workspace content: messages, files, reports and settings created in a workspace by people and by the AI agents.
• Connected ad accounts: when an owner or admin connects Meta Ads or Google Ads, the access granted by that sign-in, and reporting data from the ad accounts they choose — campaign, ad set, ad group, ad and keyword names and settings, and performance figures such as impressions, clicks, spend and conversions. With Google Analytics 4 connected, daily reporting for the chosen property: sessions, users, engagement, key events and revenue by channel, source and medium, campaign, device and landing page. With Google Tag Manager signed in, only the container IDs that sign-in can see, so one can be picked; its data is not synced.
• A connected mailbox (Gmail): when an owner or admin connects Gmail, AdCrew reads that one mailbox with read-only access and copies its messages into the business's own data store: date and time, sender and recipients, subject, labels, the text of the message, and the file names of attachments. Attachments themselves are not copied, and Spam and Trash are left out. Messages hold personal data about the people who wrote to the business, which the business is responsible for as the controller; AdCrew processes it on the business's instructions so its agents can count enquiries, follow up leads and report on them.
• Technical data: server logs with IP addresses and timestamps, kept for security and troubleshooting.

This website sets no cookies and runs no analytics or advertising scripts.

Why we use it

• To provide the service a business signed up for: its workspace, its agents, its dashboards and reports (contract).
• To keep accounts secure and the service working (legitimate interest).
• To meet legal obligations, such as accounting records (legal obligation).

We do not sell personal data, and we do not use any client's data for advertising.

Data from Meta and Google

The Meta and Google connections are used only to read reporting data for the ad accounts a business chooses, so its own agents, dashboards and reports can work with it. AdCrew does not create, change or delete anything in an ad account through these connections. Meta access is limited to ads_read. Google Ads offers no read-only permission, so the Google sign-in asks for Google Ads access, and AdCrew only reads with it; Analytics and Tag Manager access is read-only. Access tokens are stored encrypted (AES-256-GCM, with the key held in Supabase Vault) and are never shown in the app or the workspace. Disconnecting a sign-in deletes it and revokes it at Meta or Google.

Gmail. Connecting a mailbox uses gmail.readonly, a Google restricted scope. AdCrew only reads: it never sends, changes, labels or deletes mail. The messages are copied into that business's own BigQuery dataset in the EU, where only that business's workspace and its agents can read them, so the crew can count enquiries, spot leads that no tracking tag saw, and answer questions about them. This data is never used for advertising or ad targeting, is never sold or passed to a data broker, and is never used to create, train or improve any AI or machine-learning model — Anthropic, which runs the models behind the agents, processes message content only to answer that request and does not train on it. Our staff do not read a business's mail except with that business's documented permission, to investigate a security problem, or where the law requires it. Switching the source off deletes the copied mail; Disconnect also ends AdCrew's access to the mailbox, and it can be withdrawn at any time in the Google account's permissions.

AdCrew's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, which apply in full to Gmail data. Data from Meta is handled under the Meta Platform Terms.

Each business has its own workspace and its own data store. One client's data is never visible in, or used for, another client's workspace.

Who processes it for us

• Supabase — sign-in and account records, hosted in the EU (Stockholm, Sweden).
• Google Cloud — the workspace servers (Finland) and each business's data store: one BigQuery dataset per business, in the EU.
• Cloudflare — delivery of this website and the workspace app.
• Anthropic — the AI model behind the agents. When an agent works on a request, the content it needs for that request is sent to Anthropic to produce the answer. Anthropic processes it in the United States.

How long we keep it

• Account data: while the account exists.
• Workspace content: until it is deleted in the workspace, or the business's account is closed.
• Connected mail: until the Gmail source is switched off, the sign-in is disconnected, or the account is closed. Each of those deletes the copied messages from the business's data store.
• Connected ad data: until the source is switched off or the account is closed. Switching a source off deletes its synced data right away; closing an account deletes its whole data store within minutes. If a deletion cannot run at once it is retried, and always completes within 30 days.
• Server logs: only as long as needed for security and troubleshooting.

How to have data deleted is described on the data deletion page.

Your rights

You can ask to access, correct, delete, restrict or receive a copy of your personal data, and object to its use, by writing to [email protected]. If content in a workspace belongs to a business that uses AdCrew, we pass the request to that business. You can also complain to the Latvian Data State Inspectorate (dvi.gov.lv).

Changes

We will update this page when what we do with data changes, and change the date at the top.