Effective date: October 29, 2026

Privacy Policy

This policy explains, in detail, what data VSCommission Ads Analytics ("we", "us") collects when you use the application, how we collect it, exactly how we use it, with whom it is shared, how long we keep it, and how you can have it deleted. It applies to the VSCommission Ads Analytics application operated by GrowthNova Limited, Hong Kong, at https://www.vscommission.com/ads/.

Data summary

Data	Examples	Purpose	Retention
Google account basic information	Name, email address, profile picture, Google user ID	Sign you in and remember your linked accounts	While your account is connected; deleted within 7 business days after you disconnect or request deletion
Google Ads account information	Customer ID, account name, currency, time zone, account status	Show which accounts you linked	Same as above
Google Ads performance data	Spend, account balance and budget, impressions, clicks, CTR, conversions, cost per conversion, campaign names and statuses	Display metrics in your dashboard	Cached for no longer than 30 days
Authorization tokens	Encrypted Google refresh token	Keep your connection working	Stored encrypted until you disconnect or revoke; then deleted within 7 business days
Technical data	Session identifier cookie, request logs	Keep you signed in and keep the service secure	Session cookie: 30 days. Logs: up to 30 days

1. Who we are

VSCommission Ads Analytics is a web application that helps advertisers monitor their own Google Ads accounts with read-only access. It is operated by GrowthNova Limited, a company registered in Hong Kong, as part of the VSCommission platform. Questions about this policy or your data can be sent at any time to info@vscommission.com; we respond within 1-2 business days.

2. Data we collect

We collect only the data listed below, and only after you explicitly authorize it:

• Google account basic information. If you sign in with Google, we receive your name, email address, and profile picture. This is requested through the openid, email, and profile OAuth scopes, which Google shows to you on the consent screen before you approve.
• Google Ads account information. For each Google Ads account you choose to link, we read the 10-digit customer ID, the account name, its currency, time zone, and status (for example ENABLED or CANCELED).
• Google Ads performance data. Through the Google Ads API we read reporting data for the accounts you linked: spend and cost data, account balance and budget information, and campaign metrics such as impressions, clicks, click-through rate, conversions, and cost per conversion, together with campaign names, statuses, and date ranges.
• Authorization tokens. When you authorize the application, Google issues tokens that let us keep the connection working. The refresh token is encrypted (see Section 6) before storage.
• Technical data. A session identifier cookie needed to keep you signed in, and short-lived server request logs used to keep the service available and secure.

All Google Ads data access is read-only. We never create, modify, or delete campaigns, ads, keywords, or budgets in your Google Ads account, and we never make charges.

3. How we collect data

We collect data only through two channels: (a) Google's OAuth 2.0 consent flow, where Google itself shows you every permission before you approve or deny it; and (b) authenticated, read-only calls to the official Google Ads API for accounts you explicitly linked. We do not buy data from data brokers, we do not use tracking or advertising pixels, and we do not collect data from sources other than your own authorization.

4. How we use your data

Your data is used for one purpose only: to operate VSCommission Ads Analytics for you.

• Sign you in and keep you signed in securely
• Remember which Google Ads accounts you linked
• Fetch and display your spend, balance, and campaign metrics
• Keep your connection to the Google Ads API working
• Keep the service secure, available, and abuse-free

We explicitly do not:

• sell, rent, or trade your data
• use your data to serve or target advertisements
• use your data to build advertising profiles or segments
• use your data to develop or train general artificial intelligence or machine learning models (see Section 8)
• use your data for any product or purpose unrelated to the dashboard you authorized
• contact you for marketing unless you ask us to

5. Data sharing and subprocessors

We do not sell your data, we do not use it for advertising, and we do not transfer it to third parties for their own purposes. The only exception is disclosure when we are required to do so by applicable law, regulation, or valid legal process — only to the extent required.

To operate the service we rely on a small number of infrastructure providers who process data strictly on our instructions:

Provider	Service	What they process
Vercel, Inc.	Hosting and serverless functions	Request handling, session identifiers, short-lived logs
Upstash (Dragonfly Computing Ltd.)	Managed Redis storage	Encrypted authorization tokens and linked-account records
Google LLC	Google Sign-In and Google Ads API	Authorization flow and your Google Ads data, under Google's own terms

6. Storage and security

• Encrypted transport. All traffic between your browser, the application, and Google is sent over HTTPS (TLS).
• Encrypted token storage. Google refresh tokens are encrypted at rest with AES-256-GCM before being written to storage. They are never stored in plaintext and never exposed to the browser.
• Access control. Encryption keys and OAuth client credentials are stored as platform secrets, separated from our code repository, and accessible only to the production system and its maintainers under the principle of least privilege.
• Data minimization. We request only the scopes needed (Google Ads read-only plus sign-in), store only the fields listed in this policy, and cache metric data only as needed to render your dashboard.

7. Data retention and deletion

We keep your data only while your account is connected. When you disconnect, revoke access, or request deletion:

• Your stored refresh token is revoked at Google and deleted
• Your session, linked-account records, and profile data are deleted
• Cached metrics expire within at most 30 days
• Remaining server logs expire within at most 30 days

To request deletion at any time, email info@vscommission.com from your Google account email. We process deletion requests within 7 business days and confirm completion by email. You can also delete everything yourself instantly using the disconnect option or the Google revocation page described in Section 10.

8. No AI or machine learning training

We do not use, and will not use, Google user data received through Google APIs to train general artificial intelligence or machine learning models, whether our own or anyone else's.

9. Google API Limited Use disclosure

VSCommission Ads Analytics's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Your rights and choices

• Review your linked accounts and permissions at any time inside the application.
• Revoke access at Google. You can disconnect the application at any time from your Google Account's Third-party apps with account access page. Revocation is effective immediately at Google; we delete the remaining stored data within 7 business days as described in Section 7.
• Access, correct, or delete your data. Email info@vscommission.com and we will respond within 1-2 business days and complete requests within 7 business days, with email confirmation.
• Complaints. If you believe we mishandle your data, email us first so we can investigate; you may also complain to your local data protection authority.

11. Children

The application is a business tool and is not directed to children. We do not knowingly collect data from anyone under 16. If you believe a minor has authorized access, contact us and we will delete the data.

12. International data transfer

Our infrastructure providers may process data in data centers outside your country. Where that happens, transfers are protected by the security measures described in Section 6 and by the providers' standard contractual safeguards.

13. Changes to this policy

If we change this policy, we will post the updated version on this page with a new effective date and a revision note. The current version always lives at https://www.vscommission.com/privacy.

14. Contact us

Privacy questions or data requests: info@vscommission.com · GrowthNova Limited, Hong Kong. We respond within 1-2 business days.