Privacy policy

1. Who is responsible

Francesco Cifardi, operating under the name MediaLauncher, Friedrichstraße 155, 10117 Berlin, Germany, operates MediaLauncher. Contact Francesco Cifardi at francesco@medialauncher.io about privacy or your data.

This policy explains processing for our website, accounts and Google Ads workspace. Where we process client advertising data on behalf of a business customer, the customer determines the purposes of that processing; the applicable data processing agreement governs our role as processor.

2. Information we process

• Account and support information: email address, account identifiers, authentication information and messages you send us.
• Google connection information: Google account identifier and email, granted permissions, encrypted access and refresh tokens, and connection status. Our current OAuth request also includes basic profile permission.
• Google Ads information: accessible advertiser and manager accounts, account names and IDs, currencies and time zones, selected campaigns, ad groups, ads, keywords, budgets, settings and performance reports such as impressions, clicks, cost and conversions.
• Workspace content: uploaded campaign files, brand profiles, product and audience information, AI prompts and generated results, and changes you prepare or publish.
• Technical information needed to operate the service: request and error logs, authentication events and usage records used for reliability, security and usage limits.

3. Why we use it

We use this information to authenticate you, connect the Google Ads accounts you authorize, import and display campaigns and reports, prepare changes, execute publishing actions you request, provide AI assistance, answer support requests and protect the service. Offline Google access enables token refresh and background reporting while you are away.

Where we act as controller, processing necessary to provide your account and requested services is based on performance of a contract or steps requested before entering one (GDPR Article 6(1)(b)). Security, abuse prevention and service diagnostics are based on our legitimate interests in operating a reliable service (Article 6(1)(f)). Where we ask for consent, that processing is based on Article 6(1)(a); legal obligations may require processing under Article 6(1)(c). Granting Google permissions is optional, but connected Google Ads features require the relevant permissions.

4. Who receives your Google user data

MediaLauncher shares, transfers or discloses Google user data to the providers identified below as needed to operate the features described in this policy. Google user data includes information received through Google authorization and the Google Ads API, such as your Google account identifier and email, OAuth credentials, advertising account details, campaign content and performance data. Processing by our hosting and storage providers is included in this disclosure, even when it occurs within infrastructure we manage.

• Supabase — authentication and database storage. We store Google connection identifiers and email addresses, granted permissions, encrypted access and refresh tokens, and imported Google Ads account and campaign information in our Supabase database. Workspace records and AI conversation history may also contain Google Ads data. Supabase processes these records to persist your connections, workspace and requested features.
• Vercel — application hosting and processing. Our website and backend run on Vercel. Google account information, OAuth credentials and Google Ads data pass through this infrastructure when we connect accounts, retrieve and display information, refresh access, and publish changes you request. When the AI sandbox functionality is enabled, Vercel also hosts the sandbox environment used for AI sessions and their associated workspace context. Technical request information is processed to deliver and operate the service.
• Google Cloud — background reporting and reporting storage. Our Google Cloud workers process advertising account identifiers and OAuth credentials to retrieve authorized Google Ads reports. Google Cloud, including BigQuery, processes and stores reporting records such as account and campaign identifiers, dates, impressions, clicks, costs and conversions so we can provide background synchronization and performance reporting.
• OpenAI — user-requested AI assistance. When you use the AI assistant, we send your prompt and relevant workspace context, which can include Google Ads campaign, ad group, ad, keyword and other account information included in the request, to OpenAI. OpenAI processes this information to generate the analysis, responses or proposed changes you request. This is a transfer of Google Ads data to an AI service provider, not just processing within Google. Review the information you include in prompts and review generated output before using or publishing it.
• Google Ads and Google OAuth services — connecting and managing your accounts. We send authorization credentials and account identifiers to Google to obtain or refresh authorized access and retrieve data. When you request publishing, we send the changes you approve to Google Ads so they can be applied to the advertising account.

Other providers support distinct features: Resend receives the recipient email address, first name when supplied, and service-email content for delivery. This can include a Google email address if it is used as your MediaLauncher contact address; our welcome-email feature does not send Google Ads campaign reports or OAuth credentials to Resend. Perplexity receives website URLs, website content and brand information for user-requested brand, product and persona autofill. These autofill features do not automatically retrieve your connected Google Ads reports or OAuth credentials for Perplexity; information you place in the brand fields or source content may be included in the request.

We do not sell or rent Google user data, disclose it to data brokers, or share it with third parties for their own marketing or advertising. Google user data is not used to train generalized AI models. Provider processing of Google user data is limited to the disclosed service purposes and the Limited Use requirements below.

Outside these service functions, Google user data may be disclosed to competent authorities where required by applicable law, to parties assisting with necessary security or abuse investigations, or to an acquirer in a merger, acquisition or sale of assets only with the prior consent required by Google policy. Any such disclosure is limited to the data needed for that purpose. Restrictions on human access are described in section 5.

5. Google user data and Limited Use

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used for the account management, reporting and AI assistance features described here. It is not sold or used for unrelated advertising, credit decisions or training generalized AI models.

Transfers are limited to those necessary for the disclosed features with your consent, security, legal obligations, or a business transfer with the consent required by Google policy. Human access is limited to your affirmative agreement, necessary security investigations, legal obligations or permitted aggregated internal operations.

6. Storage, security and international transfers

We use authentication, user access controls and encryption of stored Google OAuth tokens to protect connected accounts. Access is limited to the purposes described in this policy. No system can guarantee absolute security.

Some providers may process data outside the European Economic Area. The applicable protections depend on the provider and destination, including adequacy decisions or contractual safeguards where applicable. Contact us for information about the providers, processing locations and safeguards relevant to your use of the service.

7. Retention, disconnection and deletion

Account and workspace information is kept for the service relationship and for as long as needed to resolve support requests, meet legal obligations or handle legal claims. Retention is assessed according to the purpose of the records, whether the account or connection remains active, and any applicable legal requirement. Technical logs are used for troubleshooting and security; records relevant to an incident may need to be kept until it is resolved. Backup copies follow the relevant provider’s backup lifecycle. We have not yet implemented a uniform automatic deletion schedule across these systems.

You can remove Google access from your Google Account connections. Revoking access stops future authorized access; it does not itself delete data previously imported into MediaLauncher. To request deletion of your MediaLauncher account, imported data or stored credentials, email us. Deletion requests are handled manually. We will explain any information that must be retained and the reason; disconnecting a Google account is not a substitute for requesting deletion.

8. Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent at any time without affecting earlier lawful processing. Contact us to exercise these rights. You may also complain to a data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information.

9. Cookies and updates

The app uses cookies for authentication and browser storage for preferences such as your theme. The service is intended for professional advertising work, not children. We will update this policy when our processing changes and obtain new consent where required before using Google data for a new purpose.