Data Access Policy
Understanding what data Crumbless accesses and how we use it
Last updated: February 2025 | Google Ads API Compliant
1. Overview
This Data Access Policy explains what data Crumbless accesses when you connect your accounts, why we need this access, and how your data is protected. This document is provided in compliance with Google's API Services User Data Policy and to ensure transparency about our data practices.
Key Principle: We only request the minimum permissions necessary to provide our services, and we never access more data than required for the features you use.
2. Google Account Access
2.1 Google Sign-In (Authentication)
2.2 Google Ads API Access
3. Detailed Google Ads Data Access
The following tables detail exactly what data we read from and write to your Google Ads account:
3.1 Account-Level Data (Read-Only)
| Data Field | Description | Purpose |
|---|---|---|
customer.id |
Your Google Ads Customer ID | Identify and link your account |
customer.descriptive_name |
Your account name | Display in our interface |
customer.currency_code |
Account currency (e.g., GBP, USD) | Display costs in correct currency |
customer.manager |
Whether account is a manager account | Handle account hierarchy correctly |
3.2 Campaign Data (Read and Write)
| Data Field | Read | Write | Purpose |
|---|---|---|---|
| Campaign ID, Name, Status | Yes | Yes | Campaign identification and management |
| Start/End Dates | Yes | Yes | Campaign scheduling |
| Budget Settings | Yes | Yes | Budget management |
| Bidding Strategy | Yes | Yes | Bid optimization |
| Target CPA/ROAS | Yes | Yes | Performance targeting |
3.3 Performance Metrics (Read-Only)
| Metric | Description | Purpose |
|---|---|---|
impressions |
Number of times ads were shown | Performance reporting |
clicks |
Number of ad clicks | Performance and billing tracking |
cost_micros |
Total spend in micro-units | Budget tracking and reporting |
conversions |
Conversion actions completed | Performance optimization |
ctr |
Click-through rate | Performance analysis |
average_cpc |
Average cost per click | Cost analysis |
| Impression Share Metrics | Search impression share data | Competitive analysis |
3.4 Ad Group and Ad Data (Read and Write)
| Data Type | Read | Write | Purpose |
|---|---|---|---|
| Ad Group structure | Yes | Yes | Campaign organization |
| Ad Headlines (up to 15) | Yes | Yes | Ad content management |
| Ad Descriptions (up to 4) | Yes | Yes | Ad content management |
| Final URLs | Yes | Yes | Ad destination management |
| Keywords | Yes | Yes | Targeting management |
| Negative Keywords | Yes | Yes | Exclusion management |
3.5 Keyword Planning Data (Read-Only)
We access Google's Keyword Planner API to provide keyword research features:
- Keyword ideas and suggestions
- Search volume estimates
- Competition metrics
- Bid estimates and forecasts
4. AI Services Data Access
4.1 Google Vertex AI (Gemini Models)
4.2 Google Imagen (Image Generation)
4.3 OpenAI (Optional)
If configured to use OpenAI as the AI provider:
- Prompts and product information sent to OpenAI's API
- Subject to OpenAI's API data usage policies
- Data is not used to train OpenAI models when using the API
5. Payment Data (Stripe)
6. Data We Do NOT Access
To be clear, Crumbless does NOT access:
- Your Gmail emails or contacts
- Your Google Drive files
- Your Google Calendar
- Your Google Photos
- Your YouTube account
- Your Google Search history
- Any Google service other than Google Ads and basic profile
- Google Ads accounts you haven't explicitly connected
- Personal payment card numbers (handled by Stripe)
7. Data Synchronization
7.1 How Sync Works
When you connect your Google Ads account:
- Initial Sync: We pull your existing campaigns, ad groups, and ads to display in Crumbless
- Ongoing Sync: Changes you make in Crumbless are pushed to Google Ads, and changes made directly in Google Ads are pulled into Crumbless
- Performance Data: Metrics are refreshed periodically to show current performance
7.2 Sync Frequency
| Data Type | Sync Direction | Frequency |
|---|---|---|
| Campaign Structure | Bidirectional | On-demand and periodic |
| Ad Content | Bidirectional | On-demand |
| Performance Metrics | Google Ads → Crumbless | Daily aggregates, real-time on request |
| Click Data (for billing) | Google Ads → Crumbless | Daily |
8. Revoking Access
8.1 Disconnect Google Ads
You can disconnect your Google Ads account at any time:
- Go to your Crumbless account settings
- Click "Disconnect Google Ads"
- Confirm the disconnection
This immediately revokes our access to your Google Ads data. Historical data synced to Crumbless will be retained according to our data retention policy unless you request deletion.
8.2 Revoke via Google
You can also revoke access directly through Google:
- Go to Google Account Permissions
- Find "Crumbless" in the list of connected apps
- Click "Remove Access"
8.3 Delete Account
To delete your Crumbless account entirely and all associated data, contact office@crumbless.ai with the subject "Account Deletion Request".
9. Data Security for Connected Accounts
9.1 OAuth Token Security
- Encryption: OAuth tokens are encrypted at rest using AES-256 encryption
- Access Control: Tokens are only accessed by automated systems when performing sync operations
- Refresh: We use refresh tokens to maintain access without storing long-lived credentials
- Expiration: Access tokens expire and are automatically refreshed as needed
9.2 API Security
- All API calls use HTTPS/TLS encryption
- We use Google's recommended authentication methods
- API access is logged for security monitoring
- We follow the principle of least privilege for all API access
10. Third-Party Data Sharing
Your Google Ads data is shared with the following third parties for service provision:
| Third Party | Data Shared | Purpose |
|---|---|---|
| Google Vertex AI | Product info, prompts (not raw Google Ads data) | AI content generation |
| Google Cloud Storage | Generated images, uploaded assets | File storage |
| Stripe | Usage metrics (click counts) | Metered billing |
We never share your Google Ads data with other advertisers, competitors, or data brokers.
11. Compliance
11.1 Google API Services User Data Policy
Crumbless complies with the Google API Services User Data Policy, including:
- Only requesting scopes necessary for our services
- Clearly disclosing what data we access and why
- Not using data for purposes beyond providing our services
- Allowing users to revoke access at any time
- Securely handling and storing user data
11.2 Google Ads API Terms
We comply with the Google Ads API Terms of Service.
11.3 Data Protection
See our Privacy Policy for details on how we comply with UK GDPR and the Data Protection Act 2018.
12. Changes to This Policy
If we need to access additional data or use existing data for new purposes, we will:
- Update this Data Access Policy
- Notify you via email before the changes take effect
- Request additional consent where required
13. Contact Us
For questions about data access or to exercise your rights:
CRUMBLX AI LTD
Data Protection Officer
4 Bunnsfield, Welwyn Garden City
England, AL7 2DZ
United Kingdom
Email: office@crumbless.ai
This Data Access Policy is provided to ensure transparency about our data practices and compliance with Google API Services User Data Policy. By connecting your Google Ads account, you acknowledge that you have read and understood this policy.