Privacy Policy

1. Who is responsible for your data

SelfAds (WeBooster AI Ads) is operated by ANDROLEX NETWORK S.R.L., tax ID RO46640466, contact address Aleea Mihail Sadoveanu 59F, space 17, Iași, Romania. Contact office@webooster.ro for questions, access, export or deletion. This policy covers selfads.ai and temporary access through ads.webooster.ro.

We are the controller for account, security and customer relationship data. Where we process your customers’ personal data solely on your instructions, processor responsibilities are governed by the applicable data processing agreement. Do not upload customer lists or sensitive data without the necessary rights and processing arrangements.

2. Data we process

Account data includes names, email addresses, user identifiers, profiles and authentication information. Passwords are handled by the authentication service; we do not ask for your Google, Meta or TikTok password.

Business and content data includes business names, websites, descriptions, brand preferences, messages, drafts, proposed budgets, logos, uploaded and generated media.

Usage data includes plan selections, credit balances and usage, notification preferences, actions and approvals. Hosting providers may process IP addresses, browser information, timestamps and technical logs for delivery and security. Public chat uses an IP-derived pseudonymous identifier for abuse prevention; this does not make use anonymous.

3. Google Sign-In and Google Ads

Login with Google is for authentication. We receive authorized basic profile information such as your Google identifier, name, email and profile image where provided. Signing in does not automatically connect Google Ads. These features do not request Gmail, Drive, contacts or calendar access.

Google Ads is authorized separately using https://www.googleapis.com/auth/adwords. Offline access lets us refresh the connection without asking you to sign in for every request. This integration’s tokens are encrypted on the server and associated with your user and business; the refresh token is not sent to the frontend.

We may read authorized accounts, manager–client relationships, account names and IDs, currency, time zone, campaign names and statuses, spend, impressions, clicks, conversions and cost per conversion. We use these for account selection, reporting and recommendations you request. When supported by the feature and API access level, submitted terms are used to request keyword suggestions.

For supported management actions, such as pausing, resuming or removing a campaign, we send Google the campaign identifier and the change you confirm. Connecting an account or chatting with AI does not authorize publication or advertising expenditure. You may create a Meta campaign structure with PAUSED status only after explicit confirmation. This flow does not create ad sets or ads and does not activate delivery.

4. Meta Pages and campaigns

With pages_show_list and pages_read_engagement we may list managed Pages, save the selected Page and display the ID, name, text, images, date and link of published posts. Page access tokens are used only on the server. Selecting a post may fill a local draft reference; it does not automatically promote it. With ads_read we read authorized accounts, campaigns and reports. With ads_management we perform only available actions explicitly confirmed by you, including creation of a PAUSED campaign structure. We retain account, request and campaign identifiers, approved settings, confirmation time and results for action history and duplicate prevention.

5. Limited use of Google data

SelfAds’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including applicable Limited Use requirements. We use this information for visible features requested by the user. We do not sell Google data or use it for our own advertising, unrelated profiling, creditworthiness assessments or training general-purpose AI models.

Sharing is restricted to providers necessary for requested and authorized features, security, legal obligations or other circumstances permitted by Google’s policy. Any corporate transaction transfer requiring consent will occur only after obtaining it. Human access to Google data is limited to permitted circumstances, such as explicit permission for support, security investigations or legal obligations.

6. AI and service providers

When you request an idea, text, image or analysis, the necessary instructions and context are sent to the AI provider. Chat uses Anthropic (Claude), with OpenAI as an available fallback; image generation and editing use OpenAI. Passwords and OAuth tokens are not included in prompts.

Campaign analysis context may include business details, recent drafts, connected platforms, identifiers, the selected campaign’s name and status and its performance metrics. Saved messages and responses may contain this information. Request analysis only for accounts you are authorized to manage.

Vercel hosts and delivers the application. Supabase provides authentication, database and media storage. Google, Meta and TikTok receive requests needed for the connections you authorize, subject to availability. Resend may process your email and recommendation content when email delivery is configured and you opt in. Providers process data under their contracts and policies. Announcing a future video feature does not itself send your data to a future video provider.

7. Purposes and legal bases

Providing the service and managing your account rely on performance of a contract or steps you request before entering a contract. Abuse prevention, account protection and error diagnosis rely on our legitimate interest in keeping the service secure, subject to your rights.

Optional processing requiring consent, including relevant communications, relies on your choice and can be withdrawn. OAuth authorization lets you choose external platform access; it does not replace all GDPR legal bases. Legally required records are processed to meet legal obligations. Without necessary sign-in data or Ads account access, we cannot provide the corresponding feature.

8. Storage, security and international transfers

We apply user and business access controls, HTTPS and server-side encryption of Ads integration credentials. Generated media is stored privately and accessed through temporary links. Sharing a temporary link may allow access until it expires. No system can guarantee complete freedom from risk.

Providers may process data in the EEA and other countries, including the United States. Relevant contractual and legal safeguards apply to international transfers, such as standard contractual clauses or an adequacy decision where applicable. Contact us to request information about safeguards for your data.

9. Retention and deletion

We keep profiles, business memory, conversations, drafts and saved media as needed for your account and service, until deletion or completion of a deletion request, subject to applicable legal exceptions. Operational and security records are kept as needed to prevent abuse, investigate incidents or defend legal claims; mandatory records follow statutory retention periods.

Request deletion of your account, Google data and associated content at office@webooster.ro, identifying the account and business. We verify identity proportionately and normally respond within one month; if a legal extension applies, we explain why. Removal from active systems and expiry of backups may occur at different stages. Records retained for legal reasons are restricted to that purpose.

Disconnecting Google Ads in Connections removes stored tokens for that connection and stops access through it. To revoke permission at Google as well, use your Google Account connections page linked below. Disconnecting does not automatically delete previous conversations, drafts or exports and does not pause campaigns in Google Ads.

10. Cookies, language and notifications

Cookies and browser storage support sessions, OAuth protection, language preferences and interface continuity. selfads_locale and selfads_content_locale preferences may persist for up to one year; public chat is stored in the tab session. Clearing browser data may remove sessions and preferences.

On your first visit we suggest a language using browser preferences and, when available, the approximate country supplied by hosting from your connection. We do not request GPS location. You choose the language. Optional notifications can be disabled in available settings or through an unsubscribe link. If we introduce non-essential technologies requiring consent, we will request it before activation.

11. Your rights and policy updates

Subject to GDPR conditions, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent without affecting previous lawful processing. You may complain to Romania’s ANSPDCP at www.dataprotection.ro or your competent local authority.

AI recommendations are assistive; we do not use them to make solely automated decisions with legal or similarly significant effects on individuals. The service is intended for users aged 18 or over. We update this page when practices change and communicate important changes through available channels. The version date appears above.

Useful links

• Manage / revoke Google connections
• Google API Services User Data Policy
• ANSPDCP