PromoGoat Privacy Policy

Effective date: 02 October 2025

Last updated: 06 September 2026

PROMOGOAT LIMITED ("PromoGoat", "we", "us", "our"), a company registered in Cyprus (Registration Number ΗΕ 485227), provides AI-assisted campaign planning services at promogoat.ai and related sites, products, and services (collectively, the "Services"). This Privacy Policy explains what personal data we collect, how we use and share it, and the choices you have. It applies to anyone who visits our sites, interacts with us, or uses the Services.

---

Summary (at a glance)

• What we collect: account details (e.g., name, email), usage data (device, IP, analytics), content you provide, and—only if you connect them—data from your Google Ads and Google Analytics accounts.
• Why: to deliver the Services, secure our platform, improve features, provide support, comply with law, and—with consent where required—send product updates.
• Google data: if you connect Google Ads or Google Analytics, we access only what is needed to plan, run, and report on your campaigns, and we comply with the Google API Services User Data Policy, including its Limited Use requirements. See Section 4.
• Sharing: with service providers (processors), affiliates, and when required by law. We don't sell personal information for money. If we "share" data for cross-context behavioral advertising, you can opt out at any time, including via Global Privacy Control (GPC).
• Your rights: access, deletion, correction, portability, opt-out (ads/sale/share), objection/consent withdrawal, and more depending on where you live.
• How to contact us: [email protected] (preferred). See "Contact Us" below.

---

1) Information We Collect

1.1 Information you provide

• Account and profile: name, email, password, company, role, phone (optional), preferences.
• Billing: address and tax details; payment card data is handled by our payment processor (we do not store full card numbers).
• Content and communications: brief/campaign inputs, support requests, survey responses, feedback, and files you upload.

1.2 Information we collect automatically

• Usage and device data: IP address, device/browser type, operating system, pages viewed, time on page, referring/exit pages, crash logs, and similar diagnostics.
• Cookies and similar tech: pixels, SDKs, web beacons for core functionality, analytics, and (where applicable) marketing/ads. See Cookies and Online Tracking. (EU/UK users receive a consent prompt for non-essential cookies.)

1.3 Information from third parties

• Single sign-on or identity providers (if used), CRM/lead sources, and service providers (e.g., analytics, support). We receive only what is necessary to provide or improve the Services.

1.4 Information from connected Google accounts

If you choose to connect a Google Ads account or a Google Analytics property to PromoGoat, we receive data from those accounts through Google's APIs, using OAuth access you grant on Google's consent screen. Exactly what we receive, how we use it, and how to disconnect is set out in Section 4 (Google User Data).

---

2) How We Use Personal Information (Purposes and Legal Bases)

We process personal data to:

• Provide and operate the Services (create/manage accounts, generate plans, personalize experiences).
  • Legal bases (EU/UK): contract necessity; legitimate interests to run and improve the Services.
• Operate Google Ads and Google Analytics integrations you enable (deploy and report on campaigns, read Analytics reports — see Section 4).
  • Legal bases: contract necessity; consent (given on Google's consent screen and revocable at any time).
• Customer support and service communications (respond to tickets, notify about changes/outages).
  • Legal bases: contract; legitimate interests.
• Security, fraud prevention, and abuse detection (monitoring, investigating, enforcing terms).
  • Legal bases: legitimate interests; legal obligations.
• Analytics and product improvement (measure performance, A/B tests).
  • Legal bases: legitimate interests; consent where required (e.g., non-essential cookies).
• Marketing (product updates, feature announcements).
  • Legal bases: consent where required; legitimate interests otherwise. You can unsubscribe anytime.
• Compliance and legal (tax, accounting, responding to lawful requests).
  • Legal bases: legal obligations; legitimate interests.

---

3) How We Share Information

We may share personal information with:

• Service providers or processors (e.g., cloud hosting, analytics, support desk, payment processing) under contracts that limit their use to our instructions.
• Affiliates for operations consistent with this Policy.
• Professional advisors (lawyers, accountants) under confidentiality.
• Legal and safety authorities when required by law or to protect rights, security, and integrity.
• Business transfer parties in connection with a merger, acquisition, or asset sale (we will notify you where required).

"Sell" or "Share" for ads (CPRA): We do not sell personal information for money. If we "share" personal information for cross-context behavioral advertising, you can opt out at any time, including via GPC signals, which we honor.

---

4) Google User Data (Google Ads and Google Analytics)

This section applies when you connect a Google account to PromoGoat. It describes our access to, and use, storage, and sharing of, data obtained through Google APIs.

4.1 What we request and why

We also receive the basic Google account identifier (email address) that Google returns with the authorisation, which we use to label the connection in your PromoGoat account.

4.2 What data we access

• Google Ads: account and campaign structure (campaigns, ad groups, ads, keywords, negative keywords, budgets, bidding settings) and performance metrics (impressions, clicks, cost, conversions, conversion value, and similar) for the accounts you connect or that are linked to our manager account with your consent.
• Google Analytics: aggregated reporting data for the properties you connect. We do not collect individual end-user identifiers from Google Analytics.
• OAuth tokens: the access and refresh tokens Google issues so PromoGoat can act on your behalf.

4.3 How we use it

We use Google user data only to provide the features you have asked for:

• producing performance reports and dashboards for your campaigns;
• deploying and updating campaigns from media plans you have approved in PromoGoat;
• managing budgets and pausing/enabling campaigns according to thresholds you set;
• keyword research and forecasting during media planning;
• measuring campaign results against website behaviour reported by Google Analytics.

We do not:

• sell Google user data;
• use it to serve advertisements, or transfer it to advertising platforms, data brokers, or information resellers;
• use it to develop, improve, or train generalised or non-personalised artificial intelligence or machine-learning models;
• allow humans to read it, except (a) with your explicit consent for a specific request, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) on aggregated and anonymised data for internal operations.

Limited Use disclosure: PromoGoat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.4 How we store and protect it

• OAuth tokens are stored encrypted at rest on our infrastructure (Microsoft Azure, EU and US regions) and are transmitted only over TLS.
• Google Ads and Google Analytics data is stored in our database and object storage, encrypted at rest and in transit, with access restricted to the systems that provide the features above and to staff who need it to support you.
• We do not store Google user data on end-user devices beyond ordinary browser caching of the PromoGoat interface.

4.5 Sharing

Google user data is shared only with the sub-processors that host and operate the Services (cloud hosting, database, and AI model providers acting under contract and on our instructions) and only as needed to deliver the features above. Where a feature sends campaign data to an AI model provider to generate a plan or report, that data is sent for that request only and is not used by the provider to train its models. We never share Google user data with third parties for their own purposes.

4.6 Retention and deletion

• We retain Google user data for as long as the Google connection is active and as needed to show you historical reporting in your account.
• When you disconnect a Google account, we delete the related OAuth tokens immediately and delete or anonymise the associated Google Ads and Google Analytics data within 30 days, unless a longer period is required by law.
• Deleting your PromoGoat account deletes all connected Google data on the same schedule.

4.7 Your controls

• Disconnect at any time from within PromoGoat, or revoke PromoGoat's access from your Google Account permissions page. Revoking on Google's side stops all further access immediately.
• Request deletion of Google user data we hold by emailing [email protected]; we will confirm completion.

---

5) Cookies and Online Tracking

We use:

• Strictly necessary cookies (security, session, load balancing),
• Analytics cookies (traffic/usage insights), and
• Marketing/advertising cookies (only where applicable and lawfully consented).

Your choices:

• Manage preferences via our Cookie Settings link (footer).
• Set browser controls to block cookies.
• Use Global Privacy Control (GPC); we treat a valid GPC as a request to opt out of sale/share where applicable.

---

6) International Data Transfers

If you access the Services from the EEA/UK, your data may be processed in countries outside your jurisdiction (e.g., the United States). Where we transfer data internationally, we implement appropriate safeguards, including the European Commission Standard Contractual Clauses (SCCs) and the UK IDTA/Addendum, plus Transfer Impact Assessments as needed.

---

7) Data Retention

We retain personal information only as long as necessary for the purposes described above (for example, account data for the life of the account, billing records per tax/audit laws), then delete or anonymize it unless longer retention is required by law.

---

8) Security

We employ administrative, technical, and physical safeguards proportional to the sensitivity of the data (e.g., encryption in transit, access controls, least-privilege access, monitoring). No system is 100% secure; we encourage you to use strong passwords and enable available security settings.

---

9) Your Privacy Rights and Choices

Your rights depend on where you live. Requests may be submitted via [email protected]. We may need to verify your identity before acting on a request.

EEA/UK residents (GDPR)

You can request access, rectification, erasure, restriction, portability, and objection to certain processing (including profiling/marketing), and you may withdraw consent at any time without affecting prior processing. You also have a right to lodge a complaint with your local supervisory authority.

---

U.S. residents (state laws, including California)

Depending on your state, you may have the right to know/access, correct, delete, portability, and opt out of sale, sharing for cross-context behavioral advertising, and targeted advertising. You can also limit the use/disclosure of sensitive personal information and appeal our decision on a request. We will not discriminate against you for exercising your rights.

• Opt out of sale/share/targeted ads: Use our "Do Not Sell or Share My Personal Information" link or send a GPC signal; we will treat it as an opt out to the extent required.

Nevada residents

You may opt out of the sale of certain covered information by contacting [email protected] (subject to applicability).

---

10) Automated Decision-Making and Profiling

PromoGoat uses algorithms to generate campaign and budget allocation recommendations. These outputs support, but do not by themselves finalize, your advertising decisions. Where required by law, you may object to profiling or request human review. We also provide explanations of our rationale inside the product to enhance transparency.

---

11) Children's Privacy

Our Services are not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has provided personal data, contact us so we can delete it.

---

12) Changes to This Policy

We may update this Policy from time to time. We will post the new date at the top and, if changes are material, provide additional notice (e.g., email or prominent in-product message).

---

13) Contact Us

• Company: PROMOGOAT LIMITED (Registration Number ΗΕ 485227)
• Email: [email protected]
• Mailing address: Perikleous 62, Strovolos 2021, Cyprus
• EU/UK inquiries: You may contact your data protection authority.

---

14) California "Notice at Collection" (CPRA)

We provide the following disclosures at or before the point of collection:

You can opt out of any "share" for cross-context behavioral advertising via our Do Not Sell/Share link or by sending a GPC signal.