Privacy Policy

Adbrick Medya Dijital Hizmet Teknoloji Anonim Şirketi (“Adbricks”, “we”, “our”, “us”) operates Adbricks, an agency-operated paid-media control plane available at https://adbrick.ai and the product application at https://dev.adbrick.ai.

This Privacy Policy explains what information Adbricks collects, including information received through Google, Meta, and TikTok authorizations; how we use, store, disclose, retain, and protect it; and how an authorized user can disconnect a platform or request deletion.

1. Who this policy covers

• Authorized operators and members invited to a tenant in Adbricks.
• People who connect advertising or measurement platforms to a tenant.
• Visitors to our public website pages (such as this Privacy Policy and Terms).

Adbricks is a business product. Access to tenant workspaces is invitation-based and authenticated. We do not offer open public self-signup for client advertising accounts.

2. Information we collect

2.1 Account and membership information

• Name, email address, role/membership, and organization/tenant identifiers.
• Authentication and access-control signals used to verify authorized operators.
• Support communications and operational contact details.

2.2 Client operating context

• Business and media-operating information entered in onboarding/settings (for example offer, markets, budget bands, naming rules, conversion definitions, and guardrails).

2.3 Platform connection and advertising data

• OAuth access and refresh credentials, granted permissions, connection status, and selected account or asset identifiers.
• Google Ads customer/account details, campaigns, ad groups, assets, keywords, search terms, recommendations, conversion settings, budgets, status, and performance metrics.
• GA4 account/property identifiers and names, the authorizing Google account email, access-binding information, and key-event or measurement configuration.
• Meta Business, ad account, Page, pixel, and catalog identifiers and names, advertising configuration, and performance data. We store a non-reversible operator-correlation value rather than a raw Meta user ID where applicable.
• TikTok Business Center connection metadata and OAuth credentials. The current TikTok integration is connection-only as described in Section 3.4.

2.4 Technical and security data

• IP address, device/browser information, timestamps, and request logs.
• Security, audit, and incident records for material actions and connection events.

2.5 Product, AI, and operational records

• Chat sessions and messages, prompts, model responses, read-only platform tool results, recommendations, and user feedback.
• Model selection, processing status, token-usage and cost metadata, error details, and redacted diagnostic traces.
• Plans, approvals, execution manifests, changes, rollback information, and audit records.
• Browser-stored preferences such as active tenant, locale, and model/depth selection.

We receive information directly from authorized users, their organization, connected platforms, authenticated identity services, and automatically from use of the service. Adbricks does not request Meta lead-retrieval permission and is not designed to ingest lead-form personal information.

3. Platform OAuth scopes and permissions we request

We request only permissions used by an operator-selected connection and the product capabilities described below. Google and Meta names are the exact values configured by Adbricks. TikTok API for Business uses provider-configured products rather than a fixed consumer-style scope list in our authorization request.

3.1 Google Ads

OAuth scope:

• https://www.googleapis.com/auth/adwords (Google Ads API / AdWords scope)

This allows Adbricks to:

• Read Google Ads account, campaign, ad group, asset, keyword, and performance data.
• Prepare recommendations and, only after human approval, execute permitted mutations such as status, budget, keyword, or campaign-structure changes on connected accounts.

3.2 Google Analytics 4 (GA4)

OAuth scopes:

• openid
• https://www.googleapis.com/auth/userinfo.email
• https://www.googleapis.com/auth/analytics.readonly

This allows Adbricks to:

• Identify the consenting Google account email.
• Discover and read GA4 accounts and properties the operator can access.
• Read key events on the selected property.

The Analytics Admin API lists accounts and properties, and reads the selected property’s settings (time zone and currency) and its key events. The Analytics Data API (runReport) reads aggregated reports on the selected property: sessions, engagement, revenue, event counts and values, and key events, broken down by date, campaign, channel group, source and medium, landing page, country, device, and event name. A connection saved before this scope was dropped can still list property access bindings; a new connection does not request that scope, and the setup check then says admin access was not checked. Browser consent banners and end-user consent collection remain the client’s responsibility; Adbricks cannot prove browser consent behavior through API reads alone.

3.3 Meta (Facebook Login / Marketing API)

Meta permissions are requested on the Facebook Login consent screen and granted there (including any Business Manager, ad account, Page, pixel, or catalog the operator selects). The default connection is a user access token. Login for Business is retained and is not the default.

A reporting-only workspace requests ads_read — read ad accounts and their campaign reporting. If a person granted broader Meta permissions to Adbricks earlier, a reporting-only workspace accepts that grant and still does not change ads. Every other workspace requests:

• ads_management — create and change ads after a person in Adbricks approves.
• business_management — read the Business Manager assets selected at login, including business-owned pixels and catalogs.
• catalog_management — read product catalogs and use them in catalog ads.
• pages_show_list — list the Facebook Pages this login can use.
• pages_read_engagement — read Page posts and lead-form names when an existing post or form is selected. Meta requires this permission to use ads management.
• pages_manage_ads — create ads that run from a Page, including a boost of an existing post.
• instagram_basic — read the Instagram account connected to a Page so an ad can name it.

We do not request leads_retrieval or instagram_content_publish. Lead form personal data is out of scope for Adbricks.

3.4 TikTok

Adbricks uses the TikTok API for Business authorization flow for its registered Business Center application. Our current implementation does not send a separate OAuth scope parameter. Authorized products or permissions are controlled by TikTok’s app configuration and may be returned by TikTok with the token response.

The current TikTok integration only:

• Registers the selected Business Center connection for a tenant.
• Stores the connection metadata and access/refresh credentials securely.
• Does not currently call TikTok Marketing API reporting or mutation endpoints.

If TikTok reading or mutation capabilities are enabled later, we will update this policy and the TikTok app review/configuration before using the connection for those purposes. Material mutations will remain subject to human approval.

Adbricks uses Supermetrics to retrieve reporting data and stores that data in its own data warehouse.

4. How we use information

We use information only as needed to:

• Authenticate and maintain the connection for the selected tenant.
• Show account health, readiness, and operating context to authorized operators.
• Analyze connected Google Ads and Meta data and generate user-requested recommendations inside Adbricks.
• Execute human-approved Google Ads or Meta media changes on connected accounts.
• Provide AI-assisted chat and analysis as described in Section 5.
• Keep audit, security, incident, and compliance records.
• Provide support and protect the service against abuse.
• Meet legal obligations and enforce our Terms.

Human approval: material spend-affecting or structural advertising mutations require an authorized human approval step before execution.

5. AI-assisted processing

When an authorized operator uses Adbricks’s Lab, chat, analysis, or recommendation features, relevant business context, the operator’s message, and selected read-only results from connected advertising platforms may be included in a prompt sent to the model provider selected for that session. This is done only to return the requested analysis or operate the user-facing feature.

Those calls go to Google Cloud Vertex AI, Anthropic, or OpenAI. The chat agent sends connected platform results to the provider of the model assigned for that request: a Google model is called through Vertex AI; an Anthropic model is called on Anthropic when an Anthropic API key is configured, and through Vertex AI when it is not; an OpenAI model is called on OpenAI when an OpenAI API key is configured, and is not called when that key is absent. Models from other vendors offered in Vertex AI Model Garden are called through Vertex AI. When the scheduled daily check uses a Claude model, it uploads that check’s input to Anthropic and runs the check in Anthropic’s code execution. A performance check’s input includes campaign and ad set rows with their budgets and daily spend, clicks, and conversions. A tracking check’s input includes those rows’ clicks and conversions, and GA4 data. When the scheduled check uses another model, that input is sent through the same routing. Session titles are requested from Anthropic and do not include platform reports. We do not use connected platform data to train general-purpose AI or machine-learning models. Material advertising actions proposed by AI require authorized human approval.

6. Google API Services User Data Policy — Limited Use

Adbricks’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide or improve user-facing features of Adbricks that are prominent in the application.
• We do not sell Google user data.
• We do not use or transfer Google user data for advertising, retargeting, data brokerage, credit-worthiness, or lending purposes.
• We transfer Google user data only to service providers acting on our behalf when necessary to provide a prominent user-facing feature, for security, or where required by law.
• We do not allow humans to read Google user data unless the user has affirmatively agreed to the specific access, it is necessary for security or legal compliance, or it is required for support requested by the user, and then only under appropriate access controls.
• We do not use Google user data to train general-purpose AI or machine-learning models.

7. Storage, security, and tenancy

• Platform OAuth and system-user credentials are stored in Google Cloud Secret Manager, not in public pages or browser bundles.
• Operational records are stored in access-controlled Google Cloud services, including Firestore and BigQuery.
• Data is tenant-scoped. Operators can access only tenants they are authorized for.
• We use HTTPS/TLS in transit, cloud encryption at rest, least-privilege service identities, authenticated product access, audit records, and server-side authorization checks.
• For Meta Graph API server calls, we use app-secret proofing and other server-side controls where applicable.

Our product workloads are currently configured primarily in Google Cloud European regions for operational storage and compute. Vertex AI may use a global endpoint. Cloudflare hosts and protects the public website.

8. Disclosure and service providers

We do not sell personal information or connected advertising-account data. We disclose information only to:

• Google Cloud Platform for hosting, storage, identity/security infrastructure, and Vertex AI inference.
• Cloudflare for public-site hosting, delivery, and security.
• Anthropic or OpenAI only when the corresponding model integration is enabled and selected for a user-facing AI feature.
• The platforms you connect (Google, Meta, TikTok, etc.), as needed to perform the authorized actions.
• Professional advisers or authorities when required by law or to protect rights, safety, and security.
• A successor entity in a corporate transaction, under continued confidentiality/privacy obligations.

We do not share connected platform data with other Adbricks tenants. Agency operators act only within authorized tenant memberships.

9. Retention

• Short-lived OAuth authorization state is designed to expire after approximately 10 minutes.
• Operational incident records are normally retained for 30 days; Meta privacy-request status records are normally retained for 90 days.
• Connection metadata and encrypted credentials are retained while a connection is active. Disconnecting marks the product connection revoked and prevents routine use, but does not by itself immediately erase every Secret Manager version or audit record.
• Chats, plans, approvals, execution and connection audits, and redacted telemetry are retained while needed to provide the service, preserve accountability for advertising actions, resolve disputes, maintain security, and meet legal obligations.

A verified deletion request starts our manual deletion process for active credentials and personal information. We delete or de-identify information unless retention is required for security, fraud prevention, legal claims, accounting, or another legal obligation. Provider-side data remains subject to the connected provider’s own retention practices.

10. Your choices, disconnect, and deletion

• Disconnect or revoke: depending on the platform and current product version, an authorized operator can disconnect in Adbricks settings, revoke access in Google Account permissions, Meta Business Integrations/app settings, or TikTok authorization settings, or contact us for assistance.
• Access / correction / deletion: depending on your location, you may request access, correction, deletion, or export of personal data.
• How to request: email privacy@adbrick.ai from an authorized address. Describe the tenant, connected platforms, and the request type.

Revoking access at a provider prevents future provider access but does not automatically delete Adbricks audit records. To request deletion of information held by Adbricks, follow our public Data Deletion Instructions. We verify the requestor’s authority before deleting tenant or platform-connection information and respond within applicable legal time limits.

11. Cookies, local storage, and public-site requests

The public adbrick.ai site does not currently use optional analytics cookies. Cloudflare may process IP address and request information to deliver and protect the site, and the site requests its web font from Google Fonts. The authenticated product uses browser local storage for functional preferences such as active tenant, locale, and model/depth selection. If optional analytics or advertising cookies are introduced, we will update this notice and obtain consent where required.

12. Legal bases and international transfers

Where applicable, we process information to perform our agreement, follow an operator’s authorization, pursue legitimate interests in operating and securing a B2B service, comply with law, or based on consent. Data may be processed in Turkey, the EU/EEA, the United States, or other locations where our providers operate. We use appropriate contractual, organizational, and technical safeguards for cross-border transfers where required.

13. Privacy rights

Depending on applicable law, including Turkey’s KVKK or the GDPR, an individual may have rights to request access, correction, deletion, restriction, objection, portability, or information about processing and transfers. Requests may be sent to privacy@adbrick.ai. We may ask for information needed to verify identity, authority, and tenant membership.

14. Children’s privacy

Adbricks is a B2B service and is not directed to children under 18. We do not knowingly collect children’s personal data.

15. Changes to this policy

If we change how we access, use, store, or share Google, Meta, TikTok, or other platform user data in a material way, we will update this Privacy Policy and, where required, obtain new consent before using the data for a new purpose.

16. Contact

Adbrick Medya Dijital Hizmet Teknoloji Anonim Şirketi
Esentepe Mah. Kore Şehitleri Cad. No:48-50 İç Kapı No:2
Şişli/İstanbul, Turkey
Privacy: privacy@adbrick.ai
Legal: legal@adbrick.ai

This page is publicly available at https://adbrick.ai/privacy and is linked from our homepage and Terms.