Privacy Policy

Last Updated: July 2026

1. Introduction

AdPeak Ltd (“AdPeak,” “we,” “our,” or “us”) is a company registered at Companies House under company number 17261264, with its registered office at M-SPARC, Menai Science Park, Gaerwen, Gwynedd, LL60 6AG, United Kingdom. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use our website, products, services, or applications (collectively, the “Services”).

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

This Privacy Policy should be read together with our Terms of Service, our Data Processing Addendum, and our Sub-Processor list.

2. Our Role: Controller and Processor

AdPeak acts in two different capacities depending on the data concerned:

  • As a controller. For the personal data we collect to operate our business and provide the Services to you — including account and contact details, authentication credentials, billing information, website usage data, and support communications — AdPeak determines the purposes and means of processing and is the data controller.
  • As a processor. When you connect your Google Ads and Google Merchant Center accounts, we access and process the data in those accounts on your behalf and on your documented instructions in order to provide the Services. For that data, you (or your organisation) are the controller and AdPeak is the processor. This processing is governed by our Data Processing Addendum, which forms part of your agreement with us.

We do not process end-consumer personal data. The product catalogue and advertising-performance data we process on your behalf originates from your own Google Ads and Merchant Center accounts and, in the ordinary course, contains no personal data about your customers or end-consumers. If your connected-account data does contain personal data, you are responsible for ensuring you have a lawful basis to share it with us, and we process it only as a processor under the Data Processing Addendum.

3. Information We Collect

3.1 Personal Information (AdPeak as controller)

We collect personal information that you voluntarily provide to us when you:

  • Register for an account
  • Subscribe to our Services
  • Request customer support
  • Participate in surveys or promotions
  • Communicate with us

This information may include:

  • Name
  • Email address
  • Phone number
  • Company name
  • Billing information (processed by our payment provider — see Section 7)
  • Account credentials and authentication identifiers (including Google account identifiers used for sign-in)

3.2 Google Ads Account Data (AdPeak as processor)

When you connect your Google Ads account to our Services, we read information from your Google Ads account in order to analyse performance and generate reports, insights, and product-labelling outputs, including but not limited to:

  • Campaign and ad-group data
  • Ad performance metrics (such as clicks, impressions, cost, and conversions)
  • Product-level performance data
  • Historical campaign information

We use Google Ads data to report and analyse. AdPeak does not create, edit, pause, or otherwise mutate your Google Ads entities, except where you have expressly enabled the plan-and-apply feature and explicitly approved a specific plan. Any changes to your Google Ads campaigns — such as bid adjustments or budget changes — are otherwise made by you. See Section 14 and our Terms of Service for details on the plan-and-apply model and our decision-support role.

3.3 Google Merchant Center Account Data (AdPeak as processor)

When you connect your Google Merchant Center account to our Services, we read information from your Merchant Center account, including but not limited to:

  • Product catalogue data (titles, descriptions, prices, and other attributes)
  • Data-source information (feed schedules, statuses, and file information)

Based on this data, we generate a product-labelling output feed that we make available to you at a stable URL. You choose whether to connect that feed to your Merchant Center account as a supplemental feed. When you do, your Merchant Center fetches the labels from the feed. AdPeak does not write to your Merchant Center account through Google’s API on your behalf.

3.4 Google API Services — Limited Use

AdPeak’s use and transfer of information received from Google APIs (including the Google Ads API and Google Merchant Center / Content API) adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We access Google user data only to provide and improve the user-facing features of the Services described in this Privacy Policy.
  • We do not transfer or sell Google user data for advertising, or for any purpose other than providing or improving those features, except as necessary to comply with applicable law or as part of a merger or acquisition.
  • We do not use Google user data for serving advertisements.
  • We do not allow humans to read Google user data unless: we have your consent for specific data; it is necessary for security purposes (such as investigating abuse); it is required to comply with applicable law; or the data has been aggregated and anonymised.
  • We do not use Google user data to train, fine-tune, or otherwise develop generalised or foundation AI/ML models, and, under the applicable providers’ data-processing terms and the account settings we configure, our AI model providers do not do so either (see Section 6.2).

3.5 Usage and Analytics Data (AdPeak as controller)

When you access our Services, we automatically collect certain information about your device and usage patterns, including:

  • IP address
  • Browser type and version
  • Device type and model
  • Operating system
  • Access times and dates
  • Pages viewed and time spent on pages
  • Features used and actions taken
  • Referring websites
  • Error logs and performance data

3.6 Conversation and Assistant Data

When you interact with our AI assistant, agent features, or MCP-connected tools, we collect:

  • Messages sent to and received from the AI assistant
  • Agent interaction logs, including tool invocations and their results
  • Plan-and-apply approval records (your decisions to approve, reject, or modify proposed actions)
  • Conversation metadata such as timestamps, session identifiers, and feature context

This data is used to provide our AI-powered features and to maintain audit records of actions taken on your behalf. Conversation content may include connected-account data, which we process as a processor under the Data Processing Addendum.

3.7 Account Security and Network Information

To secure the Services and protect against account sharing, credential compromise, and account takeover, we collect and process information about how your account is accessed, including:

  • IP addresses, which we may retain in pseudonymised or hashed form rather than as raw addresses where this is sufficient for the purpose
  • Device, browser, and operating-system characteristics associated with sign-in
  • Authentication events, session identifiers, and access timestamps, including approximate location derived at a coarse level from IP address
  • Indicators of concurrent or anomalous access used to detect sharing or unauthorised use

We use this information to verify legitimate access, detect and investigate suspicious activity, enforce our Terms (including the account-sharing restrictions in Section 7 of the Terms), and protect our customers and our Services. The legal basis for this processing is our legitimate interests in maintaining the security and integrity of the Services and, where applicable, compliance with legal obligations (see Section 5).

3.8 Free Report and Lead Data

When you request a free report or use a similar promotional tool by signing in with your Google account, we collect:

  • Your name and business email address, and other basic profile information you approve at the Google consent screen
  • Identifiers for your connected Google Ads and/or Merchant Center accounts
  • Summary advertising data used to produce the report, such as spend, clicks, impressions, conversions, and related performance metrics, accessed on a read-only basis

We use this information to generate and deliver your report, to respond to your enquiry, to maintain records of leads in our CRM and sales systems, and — where permitted by applicable law — to send you marketing communications about AdPeak (see Section 4.1). The legal bases for this processing are the steps taken at your request, our legitimate interests in business-to-business marketing, and, where required, your consent (see Section 5).

3.9 Model Improvement Data

To maintain and improve the quality of our optimisation methods, we may analyse anonymised and aggregated data derived from usage of the Services (for example, aggregate performance patterns across accounts). This data does not identify you or any individual. We do not use your identifiable data, conversation content, or connected-account data to train third-party or general-purpose AI models, and, under the applicable providers’ data-processing terms and the account settings we configure, our AI model providers do not train their models on your data (see Section 6.2).

4. How We Use Your Information

Where AdPeak is the controller, we use the information we collect to:

  • Provide, maintain, and improve our Services
  • Process transactions and send related information
  • Analyse and report on your ad campaigns and product catalogue using AI technology
  • Power the AI assistant, agent features, and MCP-connected tools
  • Respond to your comments, questions, and requests
  • Send you technical notices, updates, security alerts, and support messages
  • Monitor and analyse trends, usage, and activities in connection with our Services
  • Detect, prevent, and address technical issues, fraud, and security risks
  • Verify account access and detect, investigate, and prevent account sharing, credential compromise, and account takeover
  • Generate and deliver free reports and other resources you request
  • Send marketing communications about our products and services, where permitted by law, and manage your communication preferences
  • Develop new products, services, features, and functionality
  • Improve our optimisation methods using anonymised and aggregated data only
  • Comply with legal obligations

Where AdPeak is a processor, we process connected-account data only to provide the Services and only on your documented instructions, as set out in the Data Processing Addendum.

4.1 Marketing Communications and Your Choices

Where permitted by applicable law, we may use the contact details you provide — including business email addresses captured when you request a free report or other resource — to send you marketing communications about AdPeak’s products and services. For business-to-business marketing we generally rely on our legitimate interests or on the “soft opt-in” available under applicable electronic-marketing rules; in other cases we rely on your consent.

We do not bundle marketing consent into your acceptance of our Terms, and you are never required to agree to marketing in order to use the Services or to receive a free report. You can opt out of marketing at any time by using the unsubscribe link in any message or by contacting privacy@adpeak.ai, and we will honour your request. Opting out of marketing does not stop service, security, or transactional messages that are necessary to provide the Services.

Where AdPeak is the controller and you are located in the European Union or United Kingdom, we process your personal information based on one or more of the following legal grounds:

  • Performance of a contract: Processing necessary to provide the Services under our contract with you (for example, account, authentication, and billing data)
  • Legitimate interests: Processing necessary for our legitimate interests, provided those interests are not overridden by your rights. We rely on legitimate interests for purposes including: securing, maintaining, and improving the Services; detecting and preventing fraud, account sharing, and account takeover (including by processing IP addresses, which we may hash or pseudonymise, and related access data described in Section 3.7); analysing anonymised usage; maintaining audit records of actions taken on your behalf; and direct marketing of our business-to-business services to relevant contacts. Where we rely on legitimate interests, we carry out a balancing assessment, and you may object at any time (see Section 10)
  • Consent: Processing based on your specific consent (for example, non-essential cookies and certain notifications)
  • Legal obligation: Processing necessary to comply with legal obligations

You can withdraw consent at any time by contacting us, though this will not affect the lawfulness of processing carried out before withdrawal.

Where AdPeak is a processor of connected-account data, the controller (you or your organisation) is responsible for establishing the legal basis for that processing.

6. Sharing Your Information

We may share your information in the following circumstances:

6.1 Service Providers

We share your information with third-party vendors, service providers, and contractors who perform services for us or on our behalf, including:

  • Cloud hosting and infrastructure providers
  • Payment processors
  • Analytics providers
  • Customer support services
  • Notification and communication platforms
  • Marketing and communication platforms
  • Customer relationship management (CRM) and sales tools, in which we store lead and free-report data and manage communications with you

These service providers are bound by written agreements to process personal data only on our instructions and in accordance with this Privacy Policy and the Data Processing Addendum. Our current sub-processors are listed at /sub-processors.

6.2 AI Model Providers

To power the AI assistant, agent features, and analysis capabilities within our Services, certain categories of your data may be processed by third-party AI model providers. The data shared with these providers may include:

  • Product catalogue data and performance metrics included in a request
  • Conversation content (messages you send to the AI assistant and responses generated)
  • Tool invocation parameters and results necessary to fulfil your requests

We route AI inference to a primary provider — Google Cloud Vertex AI, processed in the United Kingdom / European Union — and, only where necessary for availability or capacity, to a fallback provider, OpenRouter. Our controls require that:

  • No training on your data. Under the applicable providers’ data-processing terms, and the account and routing settings we configure, your data is not used to train their foundation or general-purpose models.
  • Zero data retention on the fallback path. When the fallback (OpenRouter) is used, our configuration pins routing to a fixed allow-list of vetted upstream providers, with no automatic fallback to others; we select those providers on a zero-data-retention basis so that prompts and responses are not stored beyond what is needed to return a result.
  • Location controls. Fallback routing is restricted to upstream model providers located in the United Kingdom, European Union, or United States.

The providers we use are listed on our Sub-Processor list, which we maintain as a living document; the current allow-list of OpenRouter upstream providers is available on request. We commit to providing at least 30 days’ notice before adding any new AI model sub-processor.

6.3 Business Transfers

If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or use of your personal information.

We may disclose your information if required to do so by law or in response to valid requests by public authorities (for example, a court or government agency). We may also disclose your information to:

  • Enforce our Terms of Service
  • Protect and defend our rights or property
  • Prevent or investigate possible wrongdoing in connection with the Services
  • Protect the personal safety of users of the Services or the public

We may share your information with third parties when we have your explicit consent to do so.

7. Sub-Processors

We maintain a list of sub-processors (third-party service providers that process personal data on our behalf) at /sub-processors. This list includes AI model providers, cloud infrastructure providers, and other services integral to delivering our platform.

We will update the sub-processor list when we engage new sub-processors and will provide at least 30 days’ advance notice before any new sub-processor begins processing your data, as set out in the Data Processing Addendum. If you have concerns about a new sub-processor, you may contact us at privacy@adpeak.ai.

8. Data Security

We have implemented appropriate technical and organisational measures designed to protect the security of personal data we process. These measures include:

  • Encryption of personal data in transit and at rest
  • Access controls, least-privilege authorisation, and authentication requirements
  • Revocation and nullification of stored third-party credentials (such as Google OAuth tokens) on account deletion
  • Logging and audit trails for actions taken within the Services
  • Regular security assessments of our systems
  • Staff awareness of data-protection responsibilities
  • Incident response procedures, including breach notification as described in the Data Processing Addendum

A summary of our technical and organisational measures is set out in the Data Processing Addendum. No security measures are perfect or impenetrable, and we cannot guarantee the absolute security of your data. We recommend that you also take steps to protect your data, such as using strong passwords and keeping your devices and credentials secure.

9. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Privacy Policy, and to comply with our legal obligations, resolve disputes, and enforce our agreements.

Specifically:

  • Account and connected-account data is retained for as long as your account remains active.
  • Account deletion — grace period. When you request deletion of your account, we apply an immediate soft delete: you can no longer sign in, stored third-party credentials (including Google OAuth tokens) are revoked and nullified, notification settings are cleared, and conversation content is scrubbed. Your account remains recoverable on request for a 30-day grace period, after which a scheduled purge job permanently deletes remaining data across our databases, analytics store, file storage, and authentication provider.
  • Individual resources (such as product-labelling profiles and reports) can be deleted by you at any time, and follow the same soft-delete then hard-delete lifecycle.
  • Audit logs recording actions taken within the Services are retained under legitimate interest for security, billing reconciliation, and compliance purposes: for up to 90 days in our operational database, and in anonymised form (with user identifiers replaced by an irreversible pseudonym on account deletion) in our analytics store.
  • Deletion records (a record of who requested a deletion, when, and what was deleted) are retained for up to 3 years as proof of compliance with data-protection law.
  • Security and access logs, including IP-derived data held in hashed or pseudonymised form where practicable, are retained for up to 12 months for security, account-protection, and abuse-detection purposes, and longer where required to investigate a specific incident or to comply with a legal obligation.
  • Free report, lead, and CRM records (including business contact details and the marketing preferences associated with them) are retained for up to 24 months from your most recent engagement with us, or until you ask us to delete them or to stop marketing, whichever is sooner, except that we may retain a minimal suppression record in order to honour your opt-out.

Some data may be retained for longer where required to comply with a legal obligation or to establish, exercise, or defend legal claims.

10. Your Data Protection Rights

Depending on your location, you may have certain rights regarding your personal information. Where AdPeak is a processor of connected-account data, we will refer requests to the relevant controller or assist that controller in responding, as required by law.

10.1 For EU/UK Residents (UK GDPR and EU GDPR)

You have the right to:

  • Access: Request copies of your personal data
  • Rectification: Request correction of inaccurate or incomplete personal data
  • Erasure: Request deletion of your personal data in certain circumstances
  • Restriction: Request restriction of processing in certain circumstances
  • Objection: Object to processing based on legitimate interests
  • Data Portability: Receive your personal data in a machine-readable format to transfer to another controller
  • Automated Decision-Making: Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see Section 14.3)

10.2 For California Residents (CCPA/CPRA)

You have the right to:

  • Know/Access: Know what personal information is collected, used, shared, or sold
  • Deletion: Request deletion of your personal information
  • Opt-out: Opt out of the “sale” or “sharing” of your personal information (we do not sell your personal information)
  • Non-Discrimination: Not face discrimination for exercising your rights
  • Correction: Request correction of inaccurate personal information
  • Limit Use: Limit the use and disclosure of sensitive personal information

10.3 For Other Jurisdictions

Many other jurisdictions provide similar rights. We will honour requests from all users to exercise their data-protection rights in accordance with applicable laws.

10.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@adpeak.ai. We may need to verify your identity before responding. We will respond to all legitimate requests within the timeframes required by applicable law (generally within one month for UK/EU GDPR requests and 45 days for CCPA requests).

11. International Data Transfers

AdPeak is based in the United Kingdom and hosts platform data on Google Cloud Platform. Your information may be transferred to, stored in, or processed in countries outside your own, including the United States, where data-protection laws may differ from those in your jurisdiction.

In particular, our primary AI inference (Google Cloud Vertex AI) is processed in the UK / EU. Where the fallback provider (OpenRouter) is used, routing is restricted to a fixed allow-list of upstream model providers located in the UK, EU, or US that we select on a zero-data-retention basis (see Section 6.2).

For transfers of personal data from the UK, EEA, or Switzerland to countries not covered by an adequacy decision, we implement appropriate safeguards, which may include:

  • The European Commission’s Standard Contractual Clauses (SCCs)
  • The UK International Data Transfer Agreement or the UK Addendum to the SCCs
  • Reliance on an adequacy decision (such as the UK–US Data Bridge / EU–US Data Privacy Framework where the recipient is certified)
  • Derogations such as your explicit consent or contractual necessity, where applicable

Further detail on transfer mechanisms is set out in our Data Processing Addendum.

12. Cookies and Tracking Technologies

12.1 Types of Cookies We Use

We use cookies and similar tracking technologies to operate our website and understand how it is used. We use the following types of cookies:

  • Essential cookies: Necessary for the functioning of our website
  • Preference cookies: Remember your preferences and settings
  • Analytics cookies: Help us understand how visitors interact with our website
  • Marketing cookies: Used to track visitors across websites for advertising purposes

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Services. For EU/UK users, we obtain consent for non-essential cookies in accordance with the Privacy and Electronic Communications Regulations and the ePrivacy Directive.

13. Children’s Privacy

Our Services are intended for business use and are not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will promptly take steps to delete it.

14. AI and Automated Processing

14.1 AI Processing

AdPeak uses artificial intelligence and machine learning technologies to provide our Services. This includes:

  • Analysing your Google Ads and Merchant Center data to generate reports, insights, and optimisation recommendations
  • Grouping products into performance tiers and generating product-labelling output feeds
  • Powering the AI assistant for conversational support and analysis
  • Powering agent workflows that help you query data and prepare proposed changes for your review

AdPeak is a decision-support tool. Our AI outputs are recommendations and analysis; they do not automatically change your Google Ads campaigns. You decide whether and how to act on them.

14.2 MCP and Agent Data Processing

Our Services include agent and tool-use capabilities that may be accessed through MCP (Model Context Protocol) clients such as Claude Desktop or other compatible applications. When you use these features:

  • You initiate the connection. MCP sessions are started by you from your MCP client application. AdPeak exposes tools that your MCP client can invoke on your behalf.
  • Conversation content is processed by your MCP client’s AI provider. When you connect a third-party MCP client to AdPeak, the conversation content (including any data returned by AdPeak tools) is sent to and processed by the AI model provider powering that client. That processing is governed by your agreement with that provider, not by AdPeak.
  • AdPeak processes tool requests. When your MCP client invokes an AdPeak tool, we process the request parameters and return results. This may include querying your Google Ads data, Merchant Center data, or preparing a plan of proposed changes for your approval.
  • We log tool invocations. For security and audit purposes, we record which tools were invoked, the parameters provided, and the results returned. These logs are retained in accordance with Section 9.

You are responsible for reviewing and accepting the privacy practices of any MCP client and its underlying AI provider before connecting it to your AdPeak account.

14.3 Automated Decision-Making

AdPeak does not make decisions that produce legal or similarly significant effects on individuals based solely on automated processing. Our optimisation features are designed with a human in the loop:

  • Recommendations, analysis, and reports are provided for your review.
  • Product-labelling outputs are made available as a feed that you choose whether to connect to your Merchant Center.
  • Where a plan-and-apply feature is available, proposed changes are presented as a reviewable plan that you must explicitly approve before anything is applied.

You remain in control of, and responsible for, the changes you choose to make to your accounts. You can contact us at privacy@adpeak.ai to request human review of any aspect of the Services.

Our Services may contain links to third-party websites or services that are not operated by us. These third parties have their own privacy policies, and we have no responsibility or liability for their content, activities, or privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:

  • Posting the new Privacy Policy on this page
  • Updating the “Last Updated” date at the top of this Privacy Policy
  • Sending an email to users where appropriate

Changes are effective when posted on this page. You are advised to review this Privacy Policy periodically.

17. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: privacy@adpeak.ai Data protection enquiries: privacy@adpeak.ai Post: AdPeak Ltd, M-SPARC, Menai Science Park, Gaerwen, Gwynedd, LL60 6AG, United Kingdom Company number: 17261264

For EU/UK Data Subjects

If you have concerns about our processing of your personal data, you have the right to lodge a complaint with a supervisory authority in the country where you reside or work. For UK residents, this is the Information Commissioner’s Office (ICO), ico.org.uk. For EU residents, you can find your national data-protection authority on the European Data Protection Board website.