Legal

Data Access Policy

Understanding what data Crumbless accesses and how we use it

Last updated: February 2025 | Google Ads API Compliant

1. Overview

This Data Access Policy explains what data Crumbless accesses when you connect your accounts, why we need this access, and how your data is protected. This document is provided in compliance with Google's API Services User Data Policy and to ensure transparency about our data practices.

Key Principle: We only request the minimum permissions necessary to provide our services, and we never access more data than required for the features you use.

2. Google Account Access

2.1 Google Sign-In (Authentication)

Scope: profile

What we access:

Your Google account email address
Your name (as displayed on your Google account)
Your profile picture URL

Why we need it: To create your Crumbless account and identify you when you sign in.

We do NOT access: Your Gmail, Google Drive, Calendar, or any other Google services through this permission.

2.2 Google Ads API Access

Scope: https://www.googleapis.com/auth/adwords

This permission allows us to:

Read your Google Ads account structure (accounts, campaigns, ad groups, ads)
Read campaign performance data (impressions, clicks, conversions, costs)
Create new campaigns, ad groups, and ads on your behalf
Update existing campaign settings and ad content
Access keyword planning data for research purposes

3. Detailed Google Ads Data Access

The following tables detail exactly what data we read from and write to your Google Ads account:

3.1 Account-Level Data (Read-Only)

Data Field	Description	Purpose
`customer.id`	Your Google Ads Customer ID	Identify and link your account
`customer.descriptive_name`	Your account name	Display in our interface
`customer.currency_code`	Account currency (e.g., GBP, USD)	Display costs in correct currency
`customer.manager`	Whether account is a manager account	Handle account hierarchy correctly

3.2 Campaign Data (Read and Write)

Data Field	Read	Write	Purpose
Campaign ID, Name, Status	Yes	Yes	Campaign identification and management
Start/End Dates	Yes	Yes	Campaign scheduling
Budget Settings	Yes	Yes	Budget management
Bidding Strategy	Yes	Yes	Bid optimization
Target CPA/ROAS	Yes	Yes	Performance targeting

3.3 Performance Metrics (Read-Only)

Metric	Description	Purpose
`impressions`	Number of times ads were shown	Performance reporting
`clicks`	Number of ad clicks	Performance and billing tracking
`cost_micros`	Total spend in micro-units	Budget tracking and reporting
`conversions`	Conversion actions completed	Performance optimization
`ctr`	Click-through rate	Performance analysis
`average_cpc`	Average cost per click	Cost analysis
Impression Share Metrics	Search impression share data	Competitive analysis

3.4 Ad Group and Ad Data (Read and Write)

Data Type	Read	Write	Purpose
Ad Group structure	Yes	Yes	Campaign organization
Ad Headlines (up to 15)	Yes	Yes	Ad content management
Ad Descriptions (up to 4)	Yes	Yes	Ad content management
Final URLs	Yes	Yes	Ad destination management
Keywords	Yes	Yes	Targeting management
Negative Keywords	Yes	Yes	Exclusion management

3.5 Keyword Planning Data (Read-Only)

We access Google's Keyword Planner API to provide keyword research features:

Keyword ideas and suggestions
Search volume estimates
Competition metrics
Bid estimates and forecasts

4. AI Services Data Access

4.1 Google Vertex AI (Gemini Models)

Scope: https://www.googleapis.com/auth/cloud-platform

Data sent to Vertex AI:

Prompts and instructions for content generation
Product information (name, description, features) for ad copy generation
Conversation history for contextual responses
Brand guidelines for tone matching

Data received: AI-generated text content (headlines, descriptions, suggestions)

Data retention by Google: Subject to Google's Vertex AI data governance policies. We use settings that minimize data retention.

4.2 Google Imagen (Image Generation)

Service: Imagen via Vertex AI

Data sent to Imagen:

Text prompts describing desired images
Product images you upload (used as reference for style/appearance)
Style preferences and aspect ratio settings

Data received: AI-generated product images in PNG/JPEG format

Important: When you provide a product image, it is sent to Google's Imagen service to generate new images that preserve the product's appearance while changing the background/environment.

4.3 OpenAI (Optional)

If configured to use OpenAI as the AI provider:

Prompts and product information sent to OpenAI's API
Subject to OpenAI's API data usage policies
Data is not used to train OpenAI models when using the API

5. Payment Data (Stripe)

Payment Processor: Stripe

What Stripe handles:

Credit/debit card information (we never see or store full card numbers)
Billing address
Payment history and invoices

What we store:

Stripe Customer ID (reference only)
Subscription status and plan details
Usage metrics for metered billing (click counts)

PCI Compliance: We are PCI-compliant through Stripe's integration. Card data is processed entirely by Stripe and never touches our servers.

6. Data We Do NOT Access

To be clear, Crumbless does NOT access:

Your Gmail emails or contacts
Your Google Drive files
Your Google Calendar
Your Google Photos
Your YouTube account
Your Google Search history
Any Google service other than Google Ads and basic profile
Google Ads accounts you haven't explicitly connected
Personal payment card numbers (handled by Stripe)

7. Data Synchronization

7.1 How Sync Works

When you connect your Google Ads account:

Initial Sync: We pull your existing campaigns, ad groups, and ads to display in Crumbless
Ongoing Sync: Changes you make in Crumbless are pushed to Google Ads, and changes made directly in Google Ads are pulled into Crumbless
Performance Data: Metrics are refreshed periodically to show current performance

7.2 Sync Frequency

Data Type	Sync Direction	Frequency
Campaign Structure	Bidirectional	On-demand and periodic
Ad Content	Bidirectional	On-demand
Performance Metrics	Google Ads → Crumbless	Daily aggregates, real-time on request
Click Data (for billing)	Google Ads → Crumbless	Daily

8. Revoking Access

8.1 Disconnect Google Ads

You can disconnect your Google Ads account at any time:

Go to your Crumbless account settings
Click "Disconnect Google Ads"
Confirm the disconnection

This immediately revokes our access to your Google Ads data. Historical data synced to Crumbless will be retained according to our data retention policy unless you request deletion.

8.2 Revoke via Google

You can also revoke access directly through Google:

Go to Google Account Permissions
Find "Crumbless" in the list of connected apps
Click "Remove Access"

8.3 Delete Account

To delete your Crumbless account entirely and all associated data, contact office@crumbless.ai with the subject "Account Deletion Request".

9. Data Security for Connected Accounts

9.1 OAuth Token Security

Encryption: OAuth tokens are encrypted at rest using AES-256 encryption
Access Control: Tokens are only accessed by automated systems when performing sync operations
Refresh: We use refresh tokens to maintain access without storing long-lived credentials
Expiration: Access tokens expire and are automatically refreshed as needed

9.2 API Security

All API calls use HTTPS/TLS encryption
We use Google's recommended authentication methods
API access is logged for security monitoring
We follow the principle of least privilege for all API access

10. Third-Party Data Sharing

Your Google Ads data is shared with the following third parties for service provision:

Third Party	Data Shared	Purpose
Google Vertex AI	Product info, prompts (not raw Google Ads data)	AI content generation
Google Cloud Storage	Generated images, uploaded assets	File storage
Stripe	Usage metrics (click counts)	Metered billing

We never share your Google Ads data with other advertisers, competitors, or data brokers.

11. Compliance

11.1 Google API Services User Data Policy

Crumbless complies with the Google API Services User Data Policy, including:

Only requesting scopes necessary for our services
Clearly disclosing what data we access and why
Not using data for purposes beyond providing our services
Allowing users to revoke access at any time
Securely handling and storing user data

11.2 Google Ads API Terms

We comply with the Google Ads API Terms of Service.

11.3 Data Protection

See our Privacy Policy for details on how we comply with UK GDPR and the Data Protection Act 2018.

12. Changes to This Policy

If we need to access additional data or use existing data for new purposes, we will:

Update this Data Access Policy
Notify you via email before the changes take effect
Request additional consent where required

13. Contact Us

For questions about data access or to exercise your rights:

CRUMBLX AI LTD
Data Protection Officer
4 Bunnsfield, Welwyn Garden City
England, AL7 2DZ
United Kingdom
Email: office@crumbless.ai

This Data Access Policy is provided to ensure transparency about our data practices and compliance with Google API Services User Data Policy. By connecting your Google Ads account, you acknowledge that you have read and understood this policy.