Privacy Policy

Effective: October 5, 2026 (supersedes the September 1, 2026 policy)

1. Introduction

Ads Arsenal by BattleBridge ("we", "us", "our") operates the Ads Arsenal platform, a campaign analytics and recommendation dashboard for digital advertising. This Privacy Policy describes how we collect, use, and protect information when you use our platform or connect your advertising accounts.

2. Information We Access

When you connect your advertising accounts (including Meta/Facebook, Google, and TikTok), we access the following data from those platforms:

• Ad account identifiers and account names
• Campaign, ad set, and ad performance metrics (impressions, clicks, spend, conversions)
• Audience and targeting configuration data
• Creative asset metadata (ad copy, image/video references)
• Budget information associated with ad accounts

If you configure a conversion source, we also receive the conversion events your own systems send to your source's webhook: event type, timestamp, value and currency, click identifiers and UTM parameters, and the raw event payload as your systems submit it. The contents of that payload are controlled by you; do not include personal data of your customers beyond what you intend us to store.

We do not collect data about the end users who see or interact with your advertisements from the advertising platforms themselves.

3. How We Use Your Data

All data accessed through connected advertising accounts is used solely for:

• Displaying campaign performance analytics within the Ads Arsenal dashboard
• Generating evidence-backed insights and recommendations about your campaigns
• Producing performance reports
• Monitoring budget pacing and surfacing anomalies
• Attributing the conversion events you send to the campaigns that drove them

4. Data Sharing

We do not sell or rent your advertising account data, and we do not share it with third parties for their own use. Your data is used exclusively to provide the Ads Arsenal platform for the purposes described above.

We use a small number of service providers that process data on our behalf to run the platform: infrastructure hosting, email delivery, and an AI model provider that helps generate the insights and report summaries you see. They may use the data only to provide their service to us, under confidentiality obligations, and not for their own purposes. We may also disclose data when required by law.

5. Google User Data (Limited Use)

When you connect a Google Ads account, Ads Arsenal requests one Google permission: access to your Google Ads accounts (the Google Ads API scope). This section describes how the data received through it is handled.

• Data accessed. The Google Ads accounts your Google sign-in can reach and their names; campaign, ad group, ad, keyword and search term settings and performance metrics; conversion actions and conversion metrics; budgets; and Google's own recommendations for those accounts. We do not access Gmail, Drive, Calendar, contacts or any other Google data.
• How it is used. Only to provide the user-facing features of Ads Arsenal to you: reporting dashboards and scheduled reports, diagnostic insights and recommendations, and applying the campaign changes you have reviewed and approved in the app. Each applied change is recorded in an audit log.
• How it is stored. On infrastructure we control, scoped to your organization. The Google access and refresh tokens are encrypted at rest. Data is kept while your account is active and connected, and deleted on a verified request (section 7).
• How it is shared. We do not sell Google user data and do not transfer it to others, except to the service providers described in section 4 as necessary to provide or improve these user-facing features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
• What we never do with it. We do not use Google user data for serving advertisements, including retargeting or personalized or interest-based advertising; we do not use it to develop, improve or train generalized artificial intelligence or machine learning models; and we do not use it to determine creditworthiness or for lending purposes.
• Human access. Our personnel read Google user data only with your agreement (for example when you ask us for support on your account), when necessary for security purposes such as investigating abuse, to comply with applicable law, or for internal operations where the data has been aggregated and anonymized.

Ads Arsenal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Ads Arsenal's access at any time under Third-party apps & services in your Google Account.

6. Data Storage and Security

Your data is stored on infrastructure we control with the following safeguards:

• All data is transmitted over encrypted connections (TLS/HTTPS)
• Advertising platform access tokens are encrypted at rest (AES-256-GCM) and handled by a dedicated token broker — raw tokens are never cached in plaintext
• All data access is scoped to your organization at the query level
• Login sessions use server-side records with hashed tokens and expiration
• Access to stored data is restricted to authorized personnel only

7. Data Retention

We retain your advertising performance data for as long as your account is active and connected. You may request deletion of your data at any time (see our Data Deletion page). Upon a verified deletion request, your data will be removed within 30 days.

8. Your Rights

You have the right to:

• Request access to the data we hold about your advertising accounts
• Request correction of inaccurate data
• Request deletion of your data
• Revoke our access to your advertising accounts at any time, either by asking us to disconnect them or by removing Ads Arsenal's access in the advertising platform's own settings
• Withdraw consent for data access

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

10. Contact

For questions about this Privacy Policy or to exercise your rights, contact us at:

bishop@battlebridge.com