AdSparky

Privacy Policy

Last updated: August 31, 2026

1. Who We Are

AdSparky is a software tool that helps advertising agencies and freelancers manage Google Ads and Meta Ads accounts. AdSparky is operated by Spectrum Herbs Sp. z o.o., ul. Aleja Komisji Edukacji Narodowej 36/112B, 02-797 Warszawa, Poland, NIP: 9512627480, KRS: 0001188046 ("we", "us", "our").

2. What Data We Collect

When you use AdSparky, we collect:

  • Account information: email address, password (hashed), agency name.
  • OAuth tokens: Google and Meta access/refresh tokens, stored encrypted in our database. Used exclusively to read and manage your advertising accounts on your behalf.
  • Advertising account data: campaign structures, metrics (spend, conversions, clicks), keywords, search terms, ad copy. Retrieved from Google Ads API and Meta Marketing API when you use our tools.
  • Usage data: which tools you use, audit reports, mutation history (what changes were made, by whom, when).

3. How We Use Your Data

  • To provide the AdSparky service: audits, reports, alerts, recommendations.
  • To execute changes you approve on your advertising accounts (pause/enable campaigns, add keywords, etc.).
  • To maintain an audit trail of all changes (who did what, when, with rollback capability).
  • To send you daily check alerts and reports you requested.

4. What We Do NOT Do

  • We do not sell your data to third parties.
  • We do not send your advertising data to AI models for training.
  • We do not share your account data with other AdSparky users.
  • We do not make changes to your accounts without your explicit approval.
  • We do not store credit card numbers (payments processed by Stripe).

5. Google API Services

AdSparky uses Google API Services (Google Ads API, Google Analytics Data API, Google Tag Manager API, Google Merchant Center Content API). Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only request access to the data necessary to provide our service.
  • We do not use Google user data for serving advertisements.
  • We do not allow humans to read your data except with your affirmative consent, for security purposes, to comply with law, or for our internal operations where data is aggregated and anonymized.
  • We do not transfer data to third parties except as necessary to provide or improve our service, with your consent, or as required by law.

6. Meta Platform Data

AdSparky accesses Meta (Facebook/Instagram) advertising data through the Meta Marketing API. We use this data solely to provide analytics, reports, and campaign management features. We comply with Meta's Platform Terms and Developer Policies.

7. Data Storage and Security

  • Data is stored in Supabase (PostgreSQL) with row-level security.
  • OAuth tokens are encrypted at rest.
  • All connections use HTTPS/TLS encryption.
  • Each agency's data is isolated — one agency cannot access another's data.
  • We do not log API secrets or tokens in application logs.

8. Third-Party Services

We use the following third-party services to operate AdSparky:

  • Supabase (database and authentication) — stores your account data and OAuth tokens (encrypted).
  • Vercel (hosting) — serves the dashboard application.
  • Stripe (payments, when applicable) — processes payments. We never see or store your card number.
  • Google APIs (Google Ads, GA4, GTM, Merchant Center) — accessed with your OAuth consent.
  • Meta Marketing API — accessed with your OAuth consent.

We do not share your advertising data with any other third parties.

9. Cookies and Tracking

AdSparky uses essential cookies for authentication (session management). We do not use advertising cookies, tracking pixels, or third-party analytics on the dashboard. No data is collected for profiling or ad targeting.

10. Data Retention

We retain your data for as long as your account is active. Audit reports and mutation logs are kept for accountability purposes. When you delete your account, we delete your personal data and OAuth tokens within 30 days. Anonymized, aggregated data (without personal identifiers) may be retained for service improvement.

11. International Data Transfers

Your data may be processed in the European Union (Supabase EU region) and the United States (Vercel, Google, Meta infrastructure). By using AdSparky, you consent to this transfer. We rely on standard contractual clauses and the data processing agreements of our service providers for cross-border transfers.

12. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

  • Access — request a copy of your data.
  • Rectification — correct inaccurate data.
  • Erasure — delete your account and data.
  • Portability — export your data in a machine-readable format.
  • Restriction — limit how we process your data.
  • Objection — object to processing based on legitimate interest.
  • Withdraw consent — revoke OAuth access at any time via Google/Meta account settings.

To exercise these rights, contact us at kontakt@spectrumherbs.com. We will respond within 30 days.

13. Contact

Data controller: Spectrum Herbs Sp. z o.o.
ul. Aleja Komisji Edukacji Narodowej 36/112B, 02-797 Warszawa
NIP: 9512627480, KRS: 0001188046
Email: kontakt@spectrumherbs.com