Privacy Policy

1. Controller

Daniel Klose, Talstraße 62, 55218 Ingelheim, Germany
Phone: +49 171 1656423 · Email: daniel@getadloop.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2. Hosting

AdLoop Cloud runs on European infrastructure: the MCP service on servers operated by Hetzner Online GmbH (Germany), the dashboard and database on Laravel Cloud in the AWS Frankfurt region (Germany). When you visit the website, IP addresses, meta and communication data, and website access data may be processed.

Fonts are served locally from our own servers. We do not embed any external font service (such as Google Fonts), so loading them creates no connection to a third party and transmits no IP address to one.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure, efficient provision of the service (Art. 6(1)(f) GDPR).

3. Your rights

You have the right at any time to obtain information about your stored data, rectification of inaccurate data, erasure (unless retention obligations apply), restriction of processing, data portability, and withdrawal of any consent you have given. Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object on grounds relating to your particular situation. You may also lodge a complaint with the competent supervisory authority.

4. Cookies

Cookies are small data packets stored on your device. We use the following categories:

• Necessary cookies: required for operation (session, CSRF protection). Always active.
• Analytics cookies: for website analytics (Google Analytics). Only with your consent.
• Marketing cookies: for advertising and remarketing (Google Ads, Reddit Ads). Only with your consent.

Google Consent Mode v2: We use Google Consent Mode v2. The analytics and marketing scripts are technically loaded but respect your cookie settings: without your consent, no cookies are set and no personal data is collected. In that case only anonymized, cookieless signals are transmitted that do not allow conclusions about individual users.

Open cookie settings

5. Registration

When you register, we store your name, email address, and password (encrypted) to provide the platform. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

5a. Transactional emails (Resend)

We use the service Resend to deliver account-related emails (e.g. email address verification, password resets, security and account notifications). Emails you send to addresses on our domain (e.g. support requests) are also received via Resend and forwarded to our mailbox. We do not send newsletters or marketing emails.

• Provider: Plus Five Five, Inc. (d/b/a "Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA.
• Data processed: name, email address, the content of the respective message, and technical delivery data (e.g. time and delivery status).
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for security notifications and the forwarding of inbound email additionally our legitimate interest in secure operation and reachable support (Art. 6(1)(f) GDPR).
• Data transfers: processing takes place on servers in the USA. Resend is certified under the EU-US Data Privacy Framework; in addition, a data processing agreement including the EU Standard Contractual Clauses is in place.
• More information: resend.com/legal/privacy-policy

5b. Payment processing (Link / Stripe)

For paid plans we process payments through Link, a Stripe service. Link acts towards you as merchant of record and processes your payment data under its own responsibility, not on our behalf. Card details are collected there only; we never receive or store them.

• Provider: transactions are settled by Stripe Payments Company (USA) or by Stripe Technology Europe, Limited (Ireland).
• Data processed: name, email address, billing address, payment method and transaction data, and a VAT ID where provided.
• What we store ourselves: only a customer identifier, the subscription status and the plan booked. No payment method data.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for fraud prevention also legitimate interest (Art. 6(1)(f) GDPR).
• Transfers: processing in the USA may take place. Stripe is certified under the EU-US Data Privacy Framework; EU standard contractual clauses apply in addition.
• Invoices and support: receipts, invoices and refund notices are sent to you directly by Link. At link.com you can manage your subscriptions, payment methods and billing address, and request deletion of your payment data.
• More information: stripe.com/privacy and link.com/privacy

6. Your Google account connection

The core of the service is connecting your Google accounts (Google Ads, Google Analytics, Google Tag Manager, Google Search Console, Google Merchant Center) to AI tools of your choice.

• Stored data: one OAuth refresh token (encrypted; the key is held outside the database), your Google email address, the permissions you granted, and the account IDs you selected (Google Ads customer ID, GA4 property, GTM container, Search Console property, Merchant Center account), plus a check value (SHA-256 hash) of your Google email address as a record that you consented.
• No storage of campaign or analytics data: AdLoop Cloud operates as a pass-through. Advertising and analytics data are fetched from Google at your AI tool's request and forwarded directly, without being stored by us.
• Change log: write changes to your advertising and Analytics accounts are logged for accountability (type of change, time, affected account) and kept for 24 months (see section 10).
• Disconnect anytime: disconnecting in the dashboard revokes the access at Google and deletes the stored token.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Google API Services — Limited Use: AdLoop Cloud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

With whom we share, transfer, or disclose Google user data:

• The AI assistant you connect (e.g. Claude, ChatGPT, Cursor, Gemini): data you request is transmitted into your AI session at your instruction. Your AI provider processes it under its own terms — connect only tools you trust.
• Our hosting processors (Hetzner Online GmbH, Germany; Laravel Cloud, AWS Frankfurt region): technical infrastructure through which the data transits and on which the encrypted token is stored (see section 8).
• No one else. We do not sell Google user data, do not share it with advertisers or data brokers, do not use it for our own advertising, and do not disclose it to any other third party unless legally required.

No AI/ML training: We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

How we protect Google user data (sensitive data):

• All data transfers are encrypted in transit (TLS).
• The OAuth refresh token is stored with authenticated encryption (libsodium XSalsa20-Poly1305) at rest; the encryption key is held outside the database, so a database leak alone cannot expose tokens.
• Access to your Google data requires your personal API key or an OAuth grant; keys can be revoked at any time and restricted to individual client accounts.
• Campaign and analytics data are never stored on our servers (pass-through only); write changes are recorded in an audit log.
• Hosting is located in the EU (Germany); access to production systems is restricted to the controller.
• Disconnecting your Google account revokes the grant at Google and deletes the stored token immediately.

6a. Your Reddit Ads connection

Optionally, you can also connect your Reddit advertising account (Reddit Ads) to AdLoop Cloud. The connection runs through Reddit's own OAuth dialog; AdLoop never sees your Reddit password.

• Stored data: one OAuth refresh token (encrypted like the Google token; the key is held outside the database), your Reddit username, the permissions you granted (read and edit advertising data), and the ad account ID you selected together with its name, currency and time zone.
• No storage of campaign data: here too AdLoop Cloud operates as a pass-through. Campaign, ad and performance data are fetched from Reddit at your AI tool's request and forwarded directly, without being stored by us.
• Change log and usage counter: write changes to your Reddit ad account are logged like Google changes; the number of Reddit calls per day is counted because it forms part of your plan's operations. Both are kept for 24 months (see section 10).
• Disconnect anytime: disconnecting in the dashboard revokes the access at Reddit and deletes the stored token. You can also withdraw access at any time at reddit.com/prefs/apps.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Recipients and third-country transfer: requests are made at your instruction to Reddit, Inc. (USA) through the Reddit Ads API; use is governed by Reddit's Ads API terms. Reddit is your own contractual partner as an advertiser, not a processor of AdLoop. Transfers to the USA rely on EU standard contractual clauses. Section 6 applies accordingly to sharing with your AI assistant, hosting and data protection; Reddit advertising data is never sold, used for our own advertising, or used to train AI models.

7. Google Analytics

We use Google Analytics 4 (GA4) to analyze website usage. We employ Google Consent Mode v2: the analytics scripts are technically loaded but set no cookies and store no personal data without your consent. Personalized tracking only takes place after your explicit consent.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Data collected: page views, session duration, devices and browsers, approximate location (country/region). IP addresses are automatically anonymized by GA4.
• Legal basis: consent (Art. 6(1)(a) GDPR), revocable at any time via the cookie settings.
• Data transfers: transfers to the USA are possible. Google is certified under the EU-US Data Privacy Framework.
• More information: policies.google.com/privacy

7b. Reddit Ads

We use the Reddit pixel for conversion tracking of our advertising campaigns on Reddit. Reddit has no equivalent of Google Consent Mode — so a stricter rule applies here: without your consent the Reddit pixel is not loaded at all and no data whatsoever is transmitted to Reddit, not even anonymized signals.

• Provider: Reddit Netherlands B.V., Strawinskylaan 4117, 1077 ZX Amsterdam, Netherlands (for users in the EEA).
• Data collected: page visits on getadloop.com and app.getadloop.com, registrations (as an event, without your account details), the Reddit click ID from the ad URL, and device and browser information (incl. IP address and user agent).
• Deliberately switched off: Reddit's optional "auto-advanced matching" (automatic collection of email addresses and phone numbers from the page) and "enhanced metadata sharing" (transmission of page content such as titles, categories and product data) are disabled on our pixel. Only the events listed above are sent, no page content and no contact details.
• Purpose: measuring the effectiveness of our Reddit campaigns and optimizing ad delivery.
• Legal basis: consent (Art. 6(1)(a) GDPR), revocable at any time via the cookie settings.
• Data transfers: transfers to the USA (Reddit, Inc.) are possible, based on EU standard contractual clauses.
• More information: reddit.com/policies/privacy-policy

8. Processors

• Hetzner Online GmbH (Germany) – hosting of the MCP service
• Laravel Cloud (USA, data processing in the AWS Frankfurt region) – dashboard and database
• Plus Five Five, Inc. (Resend) (USA) – delivery of transactional emails and receipt of emails to our domain (see section 5a)
• Google Ireland Limited (Ireland) – Google Ads / Google Analytics APIs (at your instruction) and website analytics (only with consent)
• Reddit, Inc. (USA) – Reddit Ads API, only if you connect your Reddit ad account and only at your instruction (see section 6a; Reddit is your own contractual partner)
• Mintlify, Inc. (USA) – hosting of the documentation site (docs.getadloop.com). No account or campaign data is processed there; only standard server access data occurs, and no cookies are set.
• Reddit Netherlands B.V. (Netherlands) – conversion tracking for Reddit advertising campaigns (only with consent)

All processors were selected carefully and meet the requirements of the GDPR.

If you use AdLoop Cloud as a processor for data you are responsible for yourself (e.g. as an agency managing client accounts), our data processing agreement under Art. 28 GDPR applies. It is concluded electronically (Art. 28(9) GDPR) and takes effect upon registration and use — no signature required. You can view it at any time and save it as a PDF.

9. SSL encryption

This site uses SSL/TLS encryption to protect data transmission. You can recognize an encrypted connection by the "https://" in the address bar and the lock icon.

10. Retention periods

We keep personal data only for as long as the respective purpose requires. In detail:

• Account data (name, email address, password hash): until you delete your account.
• Google and Reddit connections (encrypted OAuth token, Google email address or Reddit username, granted permissions, selected account IDs): until you disconnect them or delete your account. In both cases the access is also revoked at Google or Reddit, unless the same Google or Reddit account is still connected in another AdLoop workspace; then only this workspace's token is deleted, because revoking would also cut off the other connection.
• API keys: a key works until you revoke it. Its record (the key in encrypted form and as a hash, its name and dates) is kept, also after revocation, until your account is deleted.
• AI app connections (OAuth): access tokens are not stored and expire after 8 hours; refresh tokens are stored only as a hash, are valid for 30 days and are replaced on every renewal. Records of revoked or expired connections are deleted automatically 30 days later. Registrations of AI apps without a connection are deleted once they are 30 days old.
• Change log: 24 months, then deleted automatically.
• Usage counters (number of operations and calls per day, no content): 24 months, then deleted automatically.
• Change previews that were not applied: deleted automatically after 7 days.
• Campaign and analytics data: not stored (pass-through, see sections 6 and 6a).
• Billing: we store the customer identifier and the subscription status until your account is deleted. Payment and invoice records are kept by Link / Stripe as merchant of record under their own statutory retention obligations (see section 5b).
• Emails via Resend: delivery data is kept by Resend according to its own retention periods (see section 5a and resend.com/legal/privacy-policy).

Deleting your account: you can delete your account in the settings at any time. All data listed above is then deleted, as is the check value (a SHA-256 hash) of your Google email address that we keep as a record of your Google consent, and the access at Google and Reddit is revoked (with the exception above for accounts still connected in another workspace); billing records required by law are kept only by Link / Stripe. An active subscription has to be cancelled first (Settings → Billing); a subscription that has already been cancelled does not stand in the way. In a team workspace, the workspace's data (connections, API keys, change log, usage counters) remains when a member deletes their account, and the API keys that member created are revoked; it is deleted when the last member deletes their account. As the owner of a team workspace, you first transfer ownership or remove the other members.