Privacy Policy
Last updated: October 22, 2026
This Privacy Policy explains how Whitead Audit (hereinafter the "Service", "we", "us"), operated by FOP Mazurenko Danyil Oleksandrovych, collects, uses, stores, and protects your personal data when you use our SaaS tool for Google Ads auditing. We comply with the General Data Protection Regulation (GDPR) and applicable data protection legislation.
By using Whitead Audit, you confirm that you have read this Policy and agree to the data processing practices described herein.
1. What data we collect
We only collect data necessary to provide the Google Ads audit service:
- Account data: email, name, username, expertise level — provided by you during registration.
- Google Ads data: campaign metrics, ad settings, spending history. Your Google Ads data is accessed through the official Google Ads API. We only read your data — we never create, edit, pause, or delete anything in your account. The Google Ads API does not offer a separate read-only permission, so Google's authorization screen shows full access; our application performs read-only operations only, and this is enforced by automated tests.
- Audit data: audit reports, action plans, AI-generated recommendations — created by our Service based on your advertising data.
- Report data: weekly and monthly Google Ads account reports (on the Monitor and Pro plans) — a snapshot of campaign metrics, the account's change history (what changed, when, and who made the change: a person, Google or another tool — without people's email addresses) and AI-generated text.
- Technical data: IP address, browser type — stored in server logs only.
- Payment data: amount, currency, status and date of a payment, and the payment and subscription identifiers at the payment provider. You enter your card details on the Creem page — we never receive or store them (for a subscription we see only the last 4 digits, if the provider passes them on).
- Interface usage: which steps you completed and where errors happened — only with your consent to analytics cookies (section 3). Your ad account data is not part of this.
2. Purpose and legal basis
We process your data on the following legal bases under the GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the service: conducting Google Ads audit, generating recommendations | Performance of a contract, Art. 6(1)(b) GDPR |
| Account management: registration, authentication | Performance of a contract, Art. 6(1)(b) GDPR |
| Service improvement: analyzing audit quality | Legitimate interest, Art. 6(1)(f) GDPR |
| Payments: processing purchases and subscriptions, accounting and tax records | Performance of a contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) GDPR |
3. Cookies and local storage
Strictly necessary cookies and local storage data, without which the Service does not work:
- Language preference (cookie) — stores your selected interface language.
- JWT authentication token (localStorage) — enables login to your account.
- Theme preference (localStorage) — stores your selected theme (light or dark).
We also use analytics cookies — Google Analytics 4 and PostHog (product analytics, EU servers) — to see which steps people use and where they stop. For users in the EU/EEA/UK they are not set until you consent in the cookie banner: before your decision PostHog sends and stores nothing, and GA4 runs in Consent Mode without analytics cookies. Outside those regions analytics may load by default. You can decline at any time — the Service works the same.
Analytics sees steps and errors, not your ad account data: campaign names, account identifiers and amounts are not sent. We do not record your screen (session replay). We do not use advertising cookies.
4. Data sharing with third parties
We only share data with partners necessary for the Service to operate:
| Partner | Purpose |
|---|---|
| Vercel | Frontend hosting |
| Application server (EU, Germany) | Backend hosting |
| Ads API, OAuth authentication | |
| OpenAI | To generate the written analysis of audits (and, as a fallback, the text of weekly and monthly reports), we send your advertising data — including campaign, ad group, keyword and search-term text, ad text, final URLs and performance metrics — to OpenAI. It is processed solely to produce your report and is not used to train OpenAI's models, per OpenAI's API data-usage terms. |
| Anthropic PBC | For audits on the Monitor and Pro plans, the explanations of the issues, the links between them, the summary and the action plan are generated with Anthropic's models (with OpenAI's models if Anthropic's are unavailable). The text of weekly and monthly account reports on these plans is generated the same way. To do this we send your advertising data — including campaign, ad group, keyword and search-term text, ad text, final URLs and performance metrics — together with the audit findings to Anthropic. It is processed solely to produce your report and is not used to train Anthropic's models, per Anthropic's commercial API terms. |
| Creem (Merchant of Record) | Payment processing. Creem is the reseller of our services: it processes the order, issues the invoice, calculates taxes and handles refunds. It receives your email, name, country, payment details (entered on the Creem page) and a technical identifier of your Whitead account to link the payment to it. As the seller, Creem also processes this data as an independent controller, under its own privacy policy. |
| Google Analytics 4 | Visit statistics — only with your consent. |
| PostHog (EU) | Product analytics — only with your consent. Your ad account data is not sent. |
| Redis (managed queue & cache, EU) | Runs background audit processing. |
| Email delivery (SMTP relay) | Sends transactional emails such as login and account notices. |
We do not sell your data to third parties and never will.
5. Data retention
We keep your account and audit data for as long as your account is active. The change history of a Google Ads account that weekly and monthly reports draw on is kept for no longer than 62 days and is deleted 31 days after reports are turned off or paused for that account. When you delete your account (Settings → Profile → Delete Account), we immediately erase your email address, name, password and the stored Google Ads access tokens (you can also revoke the app's access in your Google Account settings), delete the stored change history of your Google Ads accounts and the change logs in audits, remove from reports any email addresses of the people who made changes, turn off reports and cancel your subscription. Audits, weekly and monthly reports and the records linked to them (notifications, report settings, your feedback) are not deleted automatically: they remain in our database without your email address or name, but with the advertising account data they contain — account and campaign names and IDs, metrics, findings. Nobody can view them in the app any more, and public links to them stop working. We keep these records only as part of the account history to which the audit debits and payment records are linked, do not use them for any other purpose, and will delete them completely if you ask us at support@whitead.digital. The log of emails sent to you is kept without the address or subject. Payment records (amount, date, status) are kept for as long as accounting and tax law requires — including after account deletion, but without your email or name.
6. Your rights (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
- Right of access: obtain a copy of the personal data we process about you.
- Right to rectification: correct inaccurate or incomplete data.
- Right to erasure: request deletion of your personal data.
- Right to restrict processing: restrict the processing of your data under certain conditions.
- Right to data portability: receive your data in a structured, commonly used format.
- Right to object: object to the processing of your data based on legitimate interest.
- Right to lodge a complaint: file a complaint with a data protection supervisory authority.
Account deletion: you can delete your account under Settings → Profile → Delete Account. Section 5 describes what is erased at once and what remains without your email address or name; we delete audits and reports completely on request.
To exercise any of these rights, contact us at support@whitead.digital. We will respond within 30 days.
7. Data security
We implement appropriate technical and organizational measures to protect your data:
- TLS encryption for all connections between your browser and our servers.
- OAuth tokens encrypted using the Fernet algorithm.
- Role-based access control.
- Daily database backups.
- We only read your Google Ads data — we never create, edit, pause, or delete anything in your account, and this is enforced by automated tests.
8. International data transfers
Application servers are hosted in the EU (Germany). Our frontend and CDN run on Vercel (EU/US). The database and cache are managed services hosted in the EU. The written analysis of an audit and the text of weekly and monthly reports are generated by US-based providers — OpenAI (every audit and, as a fallback, report text) and Anthropic PBC (audits and reports on the Monitor and Pro plans) — so your advertising data may be processed in the United States. For data transfers outside the European Economic Area, including to these providers, we use Standard Contractual Clauses (SCC) under the GDPR (for OpenAI and Anthropic, those incorporated in their data processing agreements, DPAs) to ensure an adequate level of protection for your data.
9. Changes to this Policy
We may update this Privacy Policy from time to time. The updated version will be published on this page with a new "Last updated" date. In the event of significant changes, we will notify you by email to the address associated with your account.
10. Contact information
Data Controller: FOP Mazurenko Danyil Oleksandrovych
- Email: support@whitead.digital