Privacy Policy

1Who we are

bidwarden is operated by Zeenko (“we”, “us”). We are the controller of the personal information described here. Questions or requests go to privacy@bidwarden.app.

2What we collect

Your website and what you tell us about it

When you paste a website address, we fetch that public page, and store the address, the one-line goal you optionally give us, our summary of the business, and the corrections you make to that summary.

Your Google account, when you connect it

We request these permissions, and use each only for the purpose listed:

• Basic profile (openid, email) — your Google account ID and email address, to label the connection so you can tell which login it is.
• Google Ads (adwords) — the ad accounts you can reach, and their campaigns, ad groups, keywords, ads, budgets, bids and daily performance. With the same permission we make the changes you approve, or that your guardrail settings allow (see the Terms).
• Search Console, read-only (webmasters.readonly) — the search terms your site already ranks for, so we don’t recommend paying for clicks you already get for free.

We store the refresh token Google issues so we can keep your data up to date without asking you to sign in again.

Your Meta account, when you connect it

With the ads_read, ads_management and business_management permissions we read your ad accounts, campaigns, ad sets, ads and performance, and make changes on the same terms as for Google. We store the access token Meta issues.

What you create in bidwarden

Messages you send the assistant, your guardrail settings, the plans, ad copy and images we generate for you, recommendations, and an audit log of every change attempted on your accounts — including who or what made it and why.

Cookies and technical data

• locale — remembers the language you chose. Kept for one year.
• oauth_state — a short-lived, signed value that protects the Google or Meta sign-in from forgery. Deleted when the sign-in completes.

We don’t use analytics, advertising or tracking cookies. Our hosting provider records standard request data (such as IP address, browser and time) to run and secure the service.

3How we use it

Only to provide bidwarden to you:

• reading your website and researching your market;
• proposing campaigns, keywords, ads and budgets;
• keeping your account data in sync and showing you how it performs;
• recommending changes, and applying them only within the limits you set;
• keeping the audit log so you can see and reverse what changed;
• keeping the service secure, and meeting legal obligations.

We don’t sell your information, we don’t use it to show you ads, and we don’t share it for anyone else’s advertising.

4Google user data

bidwarden’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you see in bidwarden.
• We transfer it to others only as needed to provide those features (the processors listed below), to keep the service secure, to comply with the law, or as part of a merger or acquisition with notice to you.
• We never use it for advertising, and never sell it.
• No person at Zeenko reads it unless you ask us to, it’s needed for security or to comply with the law, or it has been aggregated and anonymised for internal operations.
• We don’t use it to develop, improve or train generalised AI or machine-learning models, and the AI providers that process it on our behalf may not use it for that either.

5How AI is used

bidwarden uses large language and image models to read your site, plan campaigns, write ads and draw ad images, and to analyse your account data and answer your questions. To do that, the relevant content — your site text, account structure and performance, and your messages — is sent to an AI provider for processing, and the answer comes back to us.

The assistant can’t change your ad accounts by itself. It can only propose a change; a separate, rule-based check decides whether that change may run, under settings you control.

6Who processes it for us

We share information with these service providers, only to run bidwarden:

• Vercel — hosting and request logs.
• Our database provider — stores the information described above.
• Google — the Google Ads and Search Console APIs you connect, and the Gemini API for text and image generation.
• Meta — the Marketing API, if you connect Meta.
• AI model providers — model inference for the assistant and for planning.
• Ahrefs — keyword and competitor research. We send it your domain and candidate search terms, never your account data.

The current list of providers is available on request at privacy@bidwarden.app. We may also disclose information when the law requires it.

7How long we keep it

We keep your information while you use bidwarden. When you disconnect a Google or Meta account in Settings, we revoke our access with Google or Meta and delete its stored token straight away. Data already synced from that account, and the audit log, stay until you ask us to delete them — the log is how you can prove what changed and when.

Email privacy@bidwarden.app to have everything deleted. We do it within 30 days, apart from anything we must keep by law.

8Your choices and rights

• Disconnect an account in Settings at any time.
• Revoke access directly at Google Account permissions or in Meta’s Business Integrations settings. Revoking there stops our access even before you disconnect here.
• Access, correct, export or delete your information by emailing privacy@bidwarden.app.

Depending on where you live — for example the EU, UK or California — the law may give you further rights, such as objecting to processing or complaining to a data-protection authority. We honour them, and we won’t treat you differently for using them.

9Security

Traffic to bidwarden is encrypted in transit. Account tokens are kept on our servers and never sent to your browser, and access to production data is restricted. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.

10International transfers

We and our providers process data in the United States and other countries. Where the law requires it, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses.

11Children

bidwarden is a tool for businesses and is not meant for anyone under 18. We don’t knowingly collect information from children.

12Changes to this policy

If we change this policy, we’ll update the date at the top. If a change materially affects how we use information we already hold, we’ll tell you before it takes effect.

13Contact

Zeenko, operator of bidwarden — privacy@bidwarden.app.