Privacy Policy and Terms of Service

This Privacy Policy explains how Adrac collects, uses, stores, shares, and protects personal data when you visit our website, request onboarding, or use the Adrac agentic media platform. Adrac helps brands and agencies manage advertising workflows across connected platforms such as Google Ads, Meta Ads, Pinterest Ads, and similar advertising services. For GDPR purposes, Adrac acts as the controller for website, onboarding, account, billing, and customer relationship data. For campaign, brand, ad account, and workspace data that a customer uploads or connects for its own business purposes, Adrac may act as a processor or service provider under the customer's instructions.

If a separate written agreement, order form, data processing agreement, or enterprise contract applies, that agreement controls where it conflicts with this page.

Website and onboarding data: organization name, organization type, desired workspace slug, admin names and work email addresses, selected login method, billing or onboarding point-of-contact name, email address, phone number, country code, submission time, and messages you send us.

Account and workspace data: user name, work email address, Auth0 user identifier, invitation status, inviter, profile or logo URL if provided, tenant or workspace name, workspace slug, tenant type, subscription plan, service type, Auth0 organization identifier, user roles, brand assignments, brand names, brand descriptions, and timestamps for creation or updates.

Authentication and session data: access tokens issued by Auth0, authentication claims needed to authorize requests, organization and role claims, and local browser preferences such as theme, language, sidebar state, command palette recents, and temporary OAuth return state.

Ad platform connection data: provider name, connected Google Ads, Meta Ads, Pinterest Ads, or other advertising account IDs, account names, currency, time zone, connection status, connection method, link status, linked dates, sync dates, OAuth state, encrypted OAuth refresh or access tokens, token type, token expiry, granted scopes, external user ID or name where supplied by the provider, and connection health or error information.

Advertising workflow data: campaign, ad group, ad set, keyword, placement, audience, budget, bid, creative, performance, conversion, recommendation, approval, and audit data that you choose to sync, review, manage, or generate through Adrac.

Support, sales, and billing data: contact details, plan preferences, demo requests, support requests, operational email events, invoicing context, and other information needed to provide and administer the service.

Technical data: IP address, device and browser data, request metadata, log entries, security events, error data, and approximate location derived from network or browser information where available.

We collect data directly from you when you complete forms, create or manage a workspace, invite users, connect ad accounts, contact support, or otherwise use the service. We also receive data from authentication and advertising providers when you sign in or authorize a connection.

We generate some data automatically, including timestamps, logs, role assignments, connection status, OAuth state, and system events needed to secure and operate the platform.

We use personal data to create and manage Adrac workspaces, authenticate users, authorize roles and permissions, onboard customers, connect advertising accounts, sync campaign and account data, prepare advertising recommendations, support self-serve campaign management, send operational emails, provide support, prepare billing and commercial communications, maintain security, debug issues, improve product reliability, and comply with legal obligations.

We do not sell personal data. We do not use connected ad account tokens to access accounts except to provide the connected Adrac features, maintain the connection, sync account or campaign data, prepare recommendations or approved changes, troubleshoot, or comply with customer instructions and legal requirements.

If you connect a Google Ads account, Adrac may request access to Google account and Google Ads data through Google's OAuth and API services. Depending on the permissions you approve, this may include Google Ads customer IDs, account names, manager account relationships, campaign and ad group structure, budgets, bids, keywords, audiences, assets, creatives, recommendations, conversion and performance metrics, change history, and related metadata needed to operate the Adrac workspace.

Adrac uses Google data only to provide and improve user-facing advertising workflow features requested by the customer, including account linking, campaign visibility, reporting, optimization recommendations, agent-assisted planning, approved campaign changes, troubleshooting, security, and audit history. Adrac does not sell Google user data, does not use Google user data for unrelated advertising, and does not transfer Google user data except as necessary to provide or secure the service, comply with law, or follow your instructions.

Adrac's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google Ads from Adrac in the product where available or by contacting support@adracmedia.com. You can also revoke Adrac's access from your Google Account or Google Ads account. After disconnection, Adrac stops using the connection for new syncs and retains related records only as needed for security, audit, troubleshooting, legal, backup, or contractual purposes.

Where GDPR applies, we rely on the following legal bases: contract necessity to provide the service and administer accounts; legitimate interests to secure, maintain, improve, and market business-to-business services; consent where you authorize optional integrations or where consent is legally required; and legal obligation where we must retain records or respond to lawful requests.

You may withdraw consent for optional processing, including third-party ad platform connections, by disconnecting the integration or contacting us. Withdrawal does not affect processing that occurred before withdrawal.

We share personal data with service providers that help us run Adrac, including authentication, hosting, database, email delivery, support, logging, monitoring, analytics, billing, and security providers. Adrac uses Auth0 for authentication and user provisioning, Resend for operational email, and advertising platform APIs such as Google Ads, Meta Ads, and Pinterest Ads when customers connect advertising accounts.

We may also share data with professional advisers, regulators, law enforcement, or counterparties in a corporate transaction where legally permitted or required. We require service providers to protect personal data and process it only for the purposes we authorize.

Adrac uses browser storage and similar technologies to operate the service. The app may store UI preferences such as theme, language, sidebar state, command palette recents, selected tenant context, and temporary OAuth return information. Auth0 and other providers may set cookies or use storage to keep users signed in and protect sessions.

You can control cookies through your browser settings, but disabling required authentication or security storage may prevent parts of the service from working.

Adrac is built for customers in India and may use cloud, authentication, email, and advertising technology providers that process data in other countries. Where GDPR applies and personal data is transferred outside the European Economic Area, we use appropriate safeguards such as standard contractual clauses, data processing agreements, or other lawful transfer mechanisms.

We use technical and organizational controls designed to protect personal data, including access controls, role-based authorization, encrypted provider tokens, token expiry metadata, secure OAuth flows, HTTPS in production, audit-friendly timestamps, and separation of tenant and brand scoped records.

No system is perfectly secure. Customers are responsible for managing their own users, role assignments, connected advertising account permissions, endpoint security, and any credentials or tokens they control outside Adrac.

We keep personal data only as long as needed for the purposes described in this policy, including to provide the service, maintain business records, resolve disputes, secure the platform, comply with law, and enforce agreements. Workspace, user, role, brand, ad account, and connection records are generally retained for the life of the customer relationship unless deleted earlier under contract or law.

OAuth state records are short lived. Connected ad platform tokens are retained while the relevant connection is active. After disconnection or revocation, we stop using the token for new API syncs and delete or disable token material according to our operational process, subject to backup, audit, security, legal, or contractual retention needs. Synced account, campaign, performance, recommendation, and audit metadata may be retained for the customer workspace unless deleted under contract, product controls, or applicable law.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal data. You may also have the right to withdraw consent and lodge a complaint with a supervisory authority.

To exercise rights, contact support@adracmedia.com. We may need to verify your identity and may redirect requests about customer-controlled workspace data to the relevant customer administrator. We will respond within the time required by applicable law.

Adrac is a business-to-business service and is not intended for children. We do not knowingly collect personal data from children.

We may update this page from time to time. The latest version will be posted at /policy with the updated date. Material changes may be communicated through the website, app, email, or contractual notice where appropriate.