Privacy Policy
Last updated 14 October 2026
ppctor.com ("ppctor", "we", "us") is operated by Iberstar SRL, a company registered in Romania (EU) at N. Balcescu, Bl. Camelia, Buzau, Romania. Iberstar SRL is the controller for the account and website data described in this policy. We process connected advertising and analytics data to provide the features you choose.
1. Data we access
- Google sign-in: your name, email address, profile image and Google account identifier. Google authenticates you; ppctor does not receive your Google password.
- Google Ads: the customer IDs, account names and hierarchy you can access; campaign, ad group, keyword, ad, asset, settings, policy and performance data. We request the Google Ads scope because the app reads this data and, only after a supported user approval, can apply an audit fix or publish an approved campaign draft to Google Ads.
- Merchant Center: if you link it, Merchant account identifiers, products, product statuses, feed and policy issues, and related catalogue data. Google's permission label is broad, but ppctor's current Merchant Center tools read and report this data; they do not edit your products or feeds.
- Google Analytics 4: if you link a property, its identifier and name and read-only aggregated reporting data, including traffic, engagement, events and revenue. We use these data in supported monitoring, reports and the M.E.R. dashboard. ppctor does not change your Analytics property.
- Slack: if you install the app, workspace, channel and user identifiers, selected account-to-channel links, commands, questions, relevant thread context and bot responses. A channel's members can see messages delivered there.
- Material you provide: monitoring and reporting settings, business figures entered into the M.E.R. dashboard, draft instructions, uploaded assets, and messages sent to us.
- Website and security data: session and consent choices, IP address, browser and request information, and operational errors. With your cookie choice, site measurement tags may also collect information described in section 8.
2. How we use it
We use connected data to show account connections, answer questions, run audits, display products and performance, evaluate Alerts, Anomalies and Pacer, prepare Reporting and M.E.R. output, create and review Draft Studio material, and send results to the Slack channel selected for that account. Approved Google Ads actions are sent to Google only when a user invokes the relevant apply or publish control. A published draft is initially paused; enabling it is a separate action. We also use limited records to secure the Service, diagnose failures and prevent duplicate delivery.
The main legal basis for account and integration processing is providing the Service you request (GDPR Article 6(1)(b)). Security and fault diagnosis rely on our legitimate interests (Article 6(1)(f)); we balance those interests against your rights. We use non-essential website measurement only after consent (Article 6(1)(a)), where consent is required. We may process information to meet a legal obligation (Article 6(1)(c)). We do not sell personal data.
3. Google user data and Limited Use
ppctor's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only for the user-facing purposes described here, not to serve advertisements, assess creditworthiness or support lending. We do not use Google user data to train a general-purpose AI model.
We do not transfer Google user data except to provide or improve the features you request, with your consent where required, to comply with law, or as otherwise permitted by Google's policy. Humans do not read your Google user data except with your permission, when necessary to investigate abuse or a security issue, when required by law, or when it is aggregated and anonymised for internal operations. Revoking Google authorization stops new API access but does not itself delete saved drafts, settings or prior results; contact us to request deletion.
4. Where data goes
4.1 Infrastructure
Cloudflare, Inc. hosts ppctor and its storage, processes requests and delivers operational email. We use encrypted Google OAuth credentials to make authorized API calls. Google receives requests when ppctor reads connected accounts or sends an approved change.
4.2 Slack and site measurement
Slack Technologies receives messages, files and account-specific results that you ask ppctor to post to a selected channel or person. Channel membership is managed in Slack; choose a destination whose members may see the information. With applicable consent, Google Tag Manager loads site measurement tags. Google may receive page and device information from those tags; this is separate from the Google Ads, Merchant Center and GA4 account data you connect.
4.3 AI sub-processors
When an AI feature is used, we may send the question that was asked, relevant messages from that conversation, and the minimum connected account data needed for the answer or draft. We never send your Google credentials, OAuth tokens or passwords. The model has no ability to change anything in your Google account by itself; account changes use the separate reviewed actions described above.
The configured AI provider can be OpenAI, L.L.C. or Anthropic, PBC, both based in the United States. The administrator chooses the provider for each AI function; which model is used may change as models improve. A provider receives data only when its related AI function is invoked. Requests are sent for inference, not submitted as training datasets. If we add another AI provider, we will name it here before any of your data is sent to it.
4.4 Legal requests and business changes
We may disclose information if law requires it, or transfer it as part of a business sale or reorganization subject to applicable law and notice where required.
5. International processing
Some service providers are outside the EEA. The AI sub-processors named in section 4.3 may process data in different jurisdictions. International transfers of personal data are subject to applicable data-protection law. Contact us for information about the safeguards relevant to a specific provider.
6. Storage and retention
| Record | Typical retention |
|---|---|
| Slack conversation context | 7 days |
| Slack channel links after Slack is disconnected | 7 days, to restore them if you reconnect the same workspace |
| Sign-in session | Up to 7 days; a new sign-in can create a new session |
| Questions, AI answers, submitted answer feedback, tool-run and operational error logs | Normally 90 days |
| Deleted Asset Library files | 30-day recovery period, then scheduled permanent removal |
| Draft instructions and retrieved page facts | Raw text expires after 90 days; structured drafts, revisions, review and publication records remain until removed or your account is deleted |
| Connections, saved monitoring and report settings, saved audits and other user-created records | Until removed, your account is deleted, or a stated feature-specific retention applies |
Some Google Ads, Merchant Center and Analytics observations and results are stored so that history, scheduled checks and reports work. Temporary provider responses also use bounded caches. We do not represent those saved records as merely a short-lived cache. Delivery or incident records may remain longer while an unresolved failure needs reconciliation; legal obligations may require a longer period in individual cases.
7. Security and control
Traffic uses HTTPS. OAuth refresh tokens and other provider secrets are encrypted before storage, and access to stored records is restricted by account and role. No system can promise absolute security. You may disconnect a linked Slack workspace or Analytics property in ppctor and revoke Google's grant at Google Account permissions. A disconnected integration stops future use of that connection; historical records are handled under section 6 and deletion requests.
8. Cookies and site analytics
Essential session and security storage keeps sign-in and the Service working. Non-essential measurement tags are controlled by the cookie choice shown where required. ppctor uses Google Tag Manager for site measurement; the specific tags in that container may use cookies or similar technology to measure page visits. You can accept, decline or change your choice through Cookie preferences in the site footer. Declining measurement does not prevent you from using core ppctor features.
9. Your rights and requests
Subject to applicable law, you may request access to, correction or deletion of your personal data, restriction or portability, and object to processing based on legitimate interests. You can withdraw consent without affecting earlier lawful processing. To exercise a right or request account deletion, contact privacy@ppctor.com. We will respond within one month, subject to lawful extensions. We may need to verify your identity before releasing or deleting account data.
EEA users can complain to the Romanian supervisory authority, ANSPDCP, dataprotection.ro, or their local data-protection authority. California residents may request information about, or deletion of, their personal information. We do not sell connected account data.
10. Children, changes and contact
ppctor is for business use and is not directed at children under 16. We will update this page when our data practices materially change and give notice or seek new consent where required.
Iberstar SRL
N. Balcescu, Bl. Camelia, Buzau, Romania
Developer and support contact: contact@ppctor.com
Privacy: privacy@ppctor.com
General: info@ppctor.com