Privacy Policy

The controller for the processing described here is:

• PPC Magic, Esplanade de Meer 190, 1098 WP Amsterdam, The Netherlands
• KvK (Chamber of Commerce) number: 82460655
• VAT (BTW) number: NL003684638B12
• Privacy contact: accounts@ppcmagic.com

Where PPC Magic processes advertising data on behalf of a client, PPC Magic acts as processor for that client and this policy describes how the Service handles that data.

Authorised user data. Email address, password (stored only as a salted hash by our authentication provider), account creation and sign-in timestamps, and in-app preferences such as alert recipients and notification settings.

Google Ads data, read through the Google Ads API. Account names and customer IDs, currency and time zone, campaign and ad group names and IDs, budgets and bidding targets, performance metrics (impressions, clicks, cost, conversions, conversion value, impression share), search terms, ad approval and policy status, and change history entries. Change history entries include the email address of the Google Ads user who made a change, which is personal data relating to agency or client personnel.

Technical data. Server and application logs, error reports and request metadata needed to operate and secure the Service.

The Service does not process personal data about the end customers of advertisers. It does not process special category data, payment card data, or advertising or analytics cookies.

• To provide account management to clients — monitoring, alerting, checklist auditing and reporting. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) with the client, and our legitimate interest (Art. 6(1)(f)) in managing and auditing the accounts entrusted to us.
• To administer and secure access — authenticating users, preventing unauthorised access, keeping audit logs. Legal basis: legitimate interest and legal obligation.
• To send operational alerts and digests to named agency recipients. Legal basis: legitimate interest.

The Service is not used for marketing, profiling of individuals, or automated decision-making that has legal effects on a person.

Data obtained from the Google Ads API is used solely to display, monitor, audit and report on the advertising accounts that PPC Magic is authorised to manage, inside the Service, for authorised PPC Magic personnel.

Google user data is never:

• sold, rented or licensed to anyone;
• transferred to a third party for that party's own purposes;
• used for advertising, retargeting, credit assessment or lending;
• used to train, fine-tune or improve any machine learning or AI model;
• accessed by a human other than authorised PPC Magic personnel, except where required by law, needed to resolve a security incident, or with the account owner's explicit consent.

The Service performs read operations only. It does not modify any Google Ads account, and Google Ads API credentials are held as server-side secrets that are never sent to the browser.

To judge whether an optimisation checklist item was carried out, and to draft plain-language summaries, the Service sends a summarised extract of campaign and change-history information to a hosted large language model via our AI provider. The extract contains change types, counts, dates, campaign and ad group names and the checklist item wording.

No credentials, no user passwords and no end-customer personal data are sent. Our AI provider processes the request on our instructions and does not use it to train models. AI output is advisory; it never triggers a change to a Google Ads account.

• Google (Google Ads API) — source of the advertising data.
• Our application hosting and edge platform — running the Service.
• Our managed database and authentication provider — storing user accounts and application data.
• Our AI provider — generating checklist verdicts and written summaries.
• Our email delivery provider — sending alerts and digests to agency recipients.

Each acts under a data processing agreement and may process data only on our instructions. We do not disclose data to anyone else except where required by law.

Data is hosted on infrastructure located in the European Union where the provider offers it. Some providers may process data outside the EEA. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, together with appropriate technical safeguards.

• Authorised user accounts: for as long as access is required, then deleted.
• Performance snapshots and reporting data: up to 25 months, to allow year-over-year comparison.
• Change history entries: up to 13 months.
• Alerts and checklist results: up to 24 months.
• Technical logs: up to 90 days.

Data is deleted sooner on a valid request, or when our engagement with the relevant client ends and no legal retention obligation applies.

Data is encrypted in transit (TLS) and at rest. Access requires authentication, and database access rules restrict every record to the workspace that owns it. Google Ads and AI credentials are stored as server-side secrets, injected only into server-side code, and never exposed to the browser or to client-side JavaScript. There is no client-facing login and no public sign-up. Access is reviewed when someone joins or leaves the team.

The Service uses strictly necessary storage only: a session token that keeps a signed-in user authenticated. There are no analytics, advertising or tracking cookies, and no third-party trackers on this site.

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. To exercise a right, email accounts@ppcmagic.com. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

If your data reached the Service because you are a user of a client's Google Ads account, you may also contact that client, who is the controller for that advertising data.

We may update this policy. The version published on this page, with the date shown above, is the version in force. Material changes are announced by email or in the Service before taking effect.