Privacy Policy

Last updated: September 21, 2026

1. Who We Are

AdsMachine is operated by Cash Flow Crescendo Inc., a company registered in Canada. We provide advertising management software that connects to your advertising and seller accounts to help you view, analyse and optimise your campaigns.

Depending on which integrations you choose to connect, AdsMachine may access:

• Amazon Advertising API — Sponsored Products, Sponsored Brands and Sponsored Display campaigns, ad groups, keywords, targets, placements and performance reports.
• Amazon Selling Partner API (SP-API) — a separate authorisation from the Advertising API, used for product costs and fees, inventory levels, listing health, sales and traffic reports, and Brand Analytics search-term data.
• Meta (Facebook) Marketing API — campaigns, ad sets, ads, creatives and insights.
• Google Ads API — campaigns, keywords and performance data.
• Pinterest Ads API — ad accounts, campaigns and analytics.

Every connection is made by you, through that platform's own OAuth flow. You can disconnect any of them at any time from within AdsMachine, which revokes our stored authorisation for it.

2. Information We Collect

We collect the following types of information:

• Account information: Your email address when you register.
• Advertising data: Campaign, ad group, keyword, target, placement and performance data from the advertising accounts you connect, accessed via each platform's official API using OAuth 2.0. We store this data so the service can show history and measure the results of changes over time.
• Seller account data (Amazon SP-API, optional): Where you authorise it, product costs and fees, inventory levels and cover days, listing health, sales and traffic reports, and Brand Analytics search-term data. This is used to compute true profitability and to stop the optimiser from spending on products that are out of stock or unbuyable.
• Changes we make on your behalf: A record of every bid, budget and state change applied through AdsMachine — the previous value, the new value, who or what initiated it, and when. This is kept so changes can be reviewed and undone.
• API keys you create: If you create an API key to connect an external client (see Section 12), we store only a SHA-256 hash of it, never the key itself.
• Usage data: Basic server logs including IP addresses, pages visited, and timestamps.
• Analytics data: Page views, session duration, click patterns, and interaction data collected via Google Analytics and Microsoft Clarity (see Section 5).

3. How We Use Your Information

• To provide and operate the AdsMachine service.
• To display your advertising performance data within the app.
• To run analysis — deterministic and AI-assisted — that produces suggested changes to bids, budgets and targeting for your review (see Section 8).
• To apply changes to your advertising accounts that you approve, and to keep a record so they can be reviewed and undone.
• To measure, after the fact, whether applied changes improved results — which is why historical data is retained.
• To send you service-related email: sign-in codes, alerts you enable, and periodic digests.
• To secure the service, diagnose failures, and prevent abuse.

We do not use your data for advertising to you, and we do not build profiles of you or your customers.

4. Google Ads API Data

AdsMachine uses the Google Ads API to access your campaign data. We access only the minimum data necessary to provide the service. We do not sell, share, or use your Google Ads data for any purpose other than operating AdsMachine. Our use of Google Ads API data complies with the Google Ads API Terms and Conditions.

5. Amazon Advertising API Data

AdsMachine uses the Amazon Advertising API to read your campaign data and, where you approve a change, to write bids, budgets, keyword and campaign states, negative keywords and placement adjustments back to your account.

• We access only the data necessary to operate the service for you.
• We do not sell, licence, or share your Amazon Advertising data with third parties, and we do not use it to benefit any other advertiser.
• We do not combine your Amazon Advertising data with that of other customers to produce benchmarks or any other product.
• Your Amazon authorisation tokens are encrypted at rest and are never exposed through our interface, our API, or to any third-party client you connect.
• Disconnecting your Amazon account from AdsMachine deletes the stored authorisation immediately.

Our use of Amazon Advertising API data is governed by the Amazon Advertising API License Agreement and Amazon's acceptable use policies.

6. Amazon Selling Partner API (SP-API) Data

The Selling Partner API is a separate authorisation from the Advertising API and is entirely optional — AdsMachine works without it. Where you grant it, we read:

• Product costs, referral and fulfilment fees, used to calculate contribution margin and a true break-even ACOS.
• Inventory levels and days of cover, used to stop the optimiser scaling spend into products that are about to go out of stock.
• Listing health and buyability, used to pause advertising on listings that cannot be purchased.
• Sales and traffic reports and Brand Analytics search-term data, used for total-account (TACOS) reporting and search-term analysis.

We do not access customer-identifying order information, buyer names, shipping addresses, or any personally identifiable information about your customers. SP-API data is used solely to operate AdsMachine for you and is never shared or sold.

7. Meta, Google and Pinterest Data

Where you connect these platforms, we read campaign structure, creative and performance data through their official APIs and, where you approve a change, write budget and state changes back. The same rules apply as for Amazon: minimum necessary access, no selling or sharing, tokens encrypted at rest, and immediate deletion of the stored authorisation when you disconnect.

For Meta specifically, you may request deletion of the data associated with your Facebook login at any time via our data deletion page, in line with Meta's Platform Terms.

8. Artificial Intelligence Processing

Parts of AdsMachine send your advertising data to third-party AI providers for analysis. What is sent is campaign, keyword, search-term and performance data together with your configured targets. No personal information, customer data, payment information, or account credentials are ever sent to an AI provider.

• Google (Gemini API): keyword-level performance analysis.
• OpenRouter Inc., which routes requests to DeepSeek models: the nightly Machine AI strategist analysis and search-term classification.

These providers act as processors for the request and we do not authorise them to train models on your data. Their own terms apply to the processing: Google Gemini API Terms and OpenRouter's Privacy Policy.

9. Analytics & Tracking

We use third-party analytics tools to understand how visitors use AdsMachine so we can improve the product. These tools may use cookies and collect data such as your IP address, browser type, pages visited, and time spent on each page.

• Google Analytics (Google LLC): Collects aggregated usage statistics. Data is processed by Google under their Privacy Policy. You can opt out via Google's opt-out browser add-on.
• Microsoft Clarity (Microsoft Corporation): Records anonymized session replays and heatmaps to help us understand user interactions. Clarity does not collect personally identifiable information. Data is processed by Microsoft under their Privacy Statement. You can opt out at clarity.microsoft.com/optout.

By using AdsMachine, you consent to data collection by these services. You may disable cookies in your browser settings, though some features of the site may not function as intended.

10. Data Sharing and Sub-processors

We do not sell your personal information and we do not share your advertising data with other advertisers. The following sub-processors are used to operate the service:

• Hetzner Online GmbH (Germany; servers located in the United States) — hosting and compute. Your data is stored here.
• Cloudflare, Inc. — network routing and TLS termination for adsmachine.io, and Cloudflare R2 object storage, which holds continuous encrypted replicas of our database for disaster recovery.
• Google LLC (Gemini API) — AI analysis of keyword performance data, as described in Section 8.
• OpenRouter, Inc. (routing to DeepSeek models) — AI analysis for the nightly strategist, as described in Section 8.
• Resend — transactional email (login codes, alerts, digests). Receives your email address and the message content.
• Functional Software, Inc. (Sentry) — error monitoring. Receives technical diagnostics when something fails, which may incidentally include identifiers such as a user id or campaign id.
• Stripe, Inc. — subscription billing. Stripe receives your payment details directly; we never see or store card numbers.
• Google Analytics and Microsoft Clarity — website analytics, as described in Section 9.

We may also disclose data where required by law, or to protect our rights or the safety of others.

11. Data Retention

We retain your account data, advertising history and change log for as long as your account is active, because the service depends on history to measure whether past changes worked.

You may request deletion of your account and all associated data at any time by emailing [email protected]. On deletion we remove your account, stored platform authorisations, advertising history and change log. Encrypted database backups held in Cloudflare R2 roll off within 30 days. Aggregate, non-identifying operational metrics may be retained.

Disconnecting a platform (rather than deleting your account) deletes that platform's stored authorisation immediately; the historical performance data already imported is retained until you delete your account.

12. API Keys and Third-Party Clients

AdsMachine offers an API so you can use it from an external client — for example an AI chat assistant connected through the Model Context Protocol (MCP). This is optional and off unless you create a key.

• You create the key in your account settings and choose what it may do: read only, act on the Machine AI suggestion queue, or additionally make direct bid, budget and pause changes.
• We store only a SHA-256 hash of the key. The key itself is shown once, at creation, and cannot be recovered afterwards.
• A key carries your own access and no more. It cannot see or do anything you could not see or do yourself in the app, and team-member permissions apply identically.
• Your platform credentials are never shared with the client. Amazon, Meta, Google and Pinterest authorisation tokens are never returned by the API. The connected client asks AdsMachine; AdsMachine uses the authorisation you already granted.
• Every change made through a key is recorded in your change log, marked as originating from a connector and tagged with the key that made it.
• You can revoke a key at any time from your account settings; revocation takes effect immediately.

If you connect a third-party client, that client's own privacy policy governs what it does with the data it receives from us. We are not responsible for the practices of clients you choose to connect.

13. Security

We use industry-standard security practices, including:

• Encrypted connections (HTTPS/TLS) for all traffic.
• OAuth 2.0 for every platform connection; we never ask for or store your Amazon, Meta, Google or Pinterest passwords.
• Platform authorisation tokens encrypted at rest with application-level encryption, separately from the database file.
• API keys stored only as irreversible hashes.
• Passwordless email one-time-code sign-in; we do not store reusable passwords.
• Encrypted, access-controlled database replicas for disaster recovery.

No method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security.

14. Your Rights

You may request access to, correction of, export of, or deletion of your personal data at any time by contacting us at [email protected]. We respond within 30 days.

Depending on where you live you may also have the right to object to or restrict processing, and to lodge a complaint with your local data protection authority. Users who signed in with Facebook may additionally use our data deletion page.

AdsMachine is not directed at children and we do not knowingly collect data from anyone under 16.

15. Changes to This Policy

We may update this policy as the service changes. The "last updated" date at the top always reflects the current version, and material changes will be communicated by email to account holders.

16. Contact

For privacy-related questions, contact:

Cash Flow Crescendo Inc.
Email: [email protected]
Canada