Marketing AIgency
Menu

Privacy Notice

Last updated: September 18, 2026 · 2026-09-18.1

Google user data

This section describes, in one place, what we do with data we receive through Google APIs. It was written in response to Google’s API verification and forms part of this privacy notice.

What we access, and what we do not
When you connect a Google Ads account, we ask for one single authorisation scope: https://www.googleapis.com/auth/adwords. Through it we read the advertising data of the accounts you select after signing in: account names and customer IDs, campaigns, ad groups, ads and their creative text, budgets and bidding settings, and performance reports (impressions, clicks, cost, conversions, conversion value, and the regional breakdown of that spend). With the same scope we write back exactly three kinds of change, and only after you or a colleague approved them in the product: switching a campaign, ad group or ad on or off, and changing a daily budget. We request no other Google scope. We do not access Gmail, Google Drive, Google Contacts, Google Calendar, Google Photos, your Google account profile, your location history or any other Google service, and the authorisation we hold does not permit us to.
How we use it
Google Ads data is used for one purpose: running and improving the advertising of the account it came from. Concretely it is shown to you and your colleagues in your own workspace; it is fed into deterministic rules and into AI agents that produce written suggestions (pause this, raise that budget, this measurement looks broken), each of which names the numbers it came from; and, once approved, it is used to carry out the change on the account. We also keep daily totals per account so we can show history and measure afterwards whether an executed change actually helped. We do not use Google user data to build profiles of individuals, to target advertising of our own, to enrich any other dataset, or to develop, train, retrain or fine-tune any AI or machine-learning model — neither ours nor a third party’s.
Who receives it
Google user data is shared only with the service providers we need to operate the product, each of them bound by a data processing agreement and acting only on our instructions: Supabase (database and file storage, hosted in Frankfurt, Germany) stores it; Vercel (application hosting) processes it in transit while pages and jobs run; Anthropic receives the campaign figures and names that a specific analysis needs, in order to generate the written suggestion, under terms that exclude training on the data sent; GitHub runs the scheduled jobs that fetch and analyse it. Inside your own workspace, the data is visible to the members you invited and to nobody else — workspaces are separated at the database level. CBX Media staff in the United Arab Emirates can access it only for support, security and troubleshooting, on a need-to-know basis and under confidentiality obligations. Beyond that we disclose Google user data to no one. We do not sell it, we do not rent or trade it, we do not pass it to advertising networks, data brokers, credit agencies or information resellers, and we do not transfer it to any other customer or workspace. The only other circumstances in which it could leave us are a binding legal obligation or a lawful order from a competent authority, and a transfer of our business, in which case the recipient would be bound by this notice and you would be told beforehand.
Limited Use
Marketing AIgency’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How it is protected
Google user data is treated as sensitive throughout. The OAuth refresh token that gives us access is encrypted with AES-256-GCM before it is written to the database, with a key held only in the server environment and never in the database itself; it is never exposed to the browser and never leaves our servers. All traffic to Google, to our servers and to our database runs over TLS. Data at rest is additionally encrypted by the database provider. Every table carries row-level security, and the browser key has no rights on any table at all — reads and writes happen only server-side, scoped to your workspace, so one customer’s Google data is structurally unreachable from another’s session. Accounts can be protected with two-factor authentication using passkeys. Access by our staff is limited to the few people who operate the service, is used only for support you asked for, for investigating a security incident, or where the law requires it, and administrative access to the product is itself protected by a passkey and logged. Every change our system makes to a Google Ads account is recorded with who approved it, when, and what the values were before and after. We review these arrangements at least once a year and after any material change to the product.
How long we keep it and how you end it
You can disconnect a Google Ads account at any time under Accounts in the product. Doing so revokes our authorisation at Google and deletes the stored credentials immediately; you can also revoke it yourself at any time at myaccount.google.com/permissions, which stops our access at once. After disconnection we retain no ability to reach the account. Performance figures already fetched are kept as the account’s history — campaign and action logs for at most twelve months, routine operational logs for 30 days — and are deleted earlier on request. Deletion of everything, including that history, is described on our data deletion page and can be requested at any time at privacy@marketing-aigency.com; backups expire no later than 30 days after an active deletion.
The same applies to the other platforms
Advertising data we receive from Meta and from TikTok is handled under exactly the same rules as described above: same purpose, same recipients, same protection, same retention, no sale, no model training, and the same ability to disconnect and have the credentials deleted.

Version 2026-09-18.1 | 18 September 2026 | marketing-aigency.com and app.marketing-aigency.com

1. Controller and contact

CBX Media LLC, Shams Business Center, Sharjah Media City Free Zone, Sharjah, United Arab Emirates, licence 2537521, represented by Laura Eva Bozic, General Manager. Privacy: privacy@marketing-aigency.com. Support: hello@marketing-aigency.com.

EU representative for privacy enquiries and regulatory correspondence: DIS-CONNECT GmbH, Gerwigstraße 29, 76131 Karlsruhe, Germany, info@dis-connect.de. Christian Bozic and Georg of Dis-Connect jointly handle the privacy mailbox. Dis-Connect does not operate attribution or have general access to customer accounts or databases.

2. Our own processing and customer instructions

CBX is controller for its website, user accounts, contracts, billing and communication. For personal data from customer advertising accounts, attribution, surveys and content, we process on the business customer’s instructions under a DPA. Visitors to a customer website should contact its operator; we assist them. This notice does not replace the customer’s notice.

3. Accounts, contracts, support and security

We process names, business email, company, workspace role, login/security data, booked services, contract/payment information and support messages. Sources are you, authorised workspace members, connected platforms and payment services. Card details are handled by the payment provider; we receive payment status and billing references.

Where GDPR applies, bases are Article 6(1)(b) for contracts with the individual; Article 6(1)(f) for communication/contract administration with corporate contacts, secure operations, abuse prevention and legal defence; and Article 6(1)(c) for legal billing, retention and evidence duties. Necessary particulars are required for account/service delivery; additional optional fields remain voluntary.

Hosting services process necessary connection information such as IP address, time and requested resource for delivery, security and troubleshooting. Optional advertising/analytics events are separate. Any own aggregate reach measurement is limited to necessary page/referral and coarse device/country information without persistent visitor identifiers; its initial processing is not automatically anonymous. The basis is our legitimate interest in an operational website; device access requiring consent remains subject to your choice.

4. Providers and international processing

Vercel and Supabase provide hosting/database functions; booked AI uses Anthropic and optional transcription ElevenLabs. GitHub may operate automated jobs and encrypted backups. Addresses, functions and processing are set out in DPA Schedule C supplied with these documents. Technical providers are contractually bound as required.

Payments use Stripe Payments Europe, Limited (Ireland) and necessary payment/verification partners; see Stripe privacy. Email uses Google services. Our own bookkeeper is Buchhaltung International FZE, Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE. Professional advisers, authorities and courts receive information only on a necessary legal basis. Payment services and advisers may be independent controllers for their own statutory purposes.

Core infrastructure is in Frankfurt; necessary CBX access is from the UAE. International providers may also process in the USA, Singapore and countries in their provider chains. EU hosting does not exclude remote access or onward transfers. Where GDPR Chapter V requires safeguards, we use an effective basis appropriate to the flow and necessary supplementary measures, including suitable SCCs or an applicable adequacy decision. EU-US Data Privacy Framework certification covers only included recipients/operations, not CBX’s UAE processing. Request details and a copy of relevant safeguards at privacy@marketing-aigency.com. A transfer without its required basis does not start or is suspended.

5. Website analytics and advertising

Analytics and advertising are separately selectable. Optional tags/pixels and associated server-side events remain blocked before the relevant consent. Refusal does not affect contracted services. Bases are GDPR Article 6(1)(a) and, where device consent is required, section 25(1) German TDDDG. Change your choice at any time through “Privacy choices” or cookie settings in the website footer. Withdrawal applies to the future.

Google Analytics 4: With analytics consent, GA4 measures visited pages, sources and usage. It processes page/event data, a random identifier, device/browser details, coarse region and technically necessary IP information. Google states that GA4 does not log or store IP addresses. _ga and _ga_* cookies identify visits/sessions, by default for up to two years. Our property’s user/event retention is limited to 14 months. Recipients can include Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google privacy, data processing terms.

Planned advertising services: Google Ads, Meta/Facebook Ads including Meta Pixel, and TikTok Ads including TikTok Pixel are envisaged for conversion measurement and advertising optimisation. This does not mean all are already installed. A service remains inactive until its specific purposes, recipients and lifetimes are described in cookie settings and you permit it. Authorised processing particularly includes sanitised page/conversion events, click and online identifiers and device/browser information. Personalisation, audience matching and additional server-side conversions are explicitly described before use.

Google Ads may involve the Google entities above. Meta recipients particularly include Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and Meta Platforms, Inc., USA. TikTok entities depend on account, function and visitor region, particularly TikTok Pte. Ltd., Singapore, TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited, UK. The specific activated recipient and any joint-controllership information are explained in the service-specific notice before selection. Meta privacy, TikTok business privacy.

Other platforms may be added after we describe their actual processing and obtain any required new consent. Earlier consent does not generally cover unknown future recipients. Google Signals, User-ID, enhanced conversions, advanced matching, list uploads and remarketing do not automatically follow from analytics consent. Hashing does not replace a legal basis. Logged-in areas containing customer content are excluded from our own advertising tracking.

6. Consent records and necessary storage

Necessary storage supports login, language, workspace and your privacy choice. Consent records include the choice, time, text version, a random evidence identifier and, where applicable, coarse country/device information. They demonstrate and implement the choice, not advertising; randomness does not make an identifier anonymous. The basis is GDPR Article 6(1)(c) with Article 7(1), where applicable. Records are normally retained for three years, longer only for a specific legal need, separate from marketing data.

7. Customer modules

Attribution processes authorised source/click identifiers, time, sanitised URL and possibly transient plaintext email for hashing. Surveys process voluntary answers and expressly agreed order fields. Conversion feedback requires recorded customer instructions and appropriate visitor consent. AI functions receive necessary campaign context and user inputs; optional speech is transcribed. We do not use this instructed data for our own personal advertising or model training. Customer agreements/DPAs define particulars, recipients and periods.

8. Retention

Account data are needed during use; document 04 governs export/deletion after termination. Raw lead/attribution and survey data normally last at most 90 days, AI chat normally 90 days, campaign/action logs at most twelve months and routine operational logs 30 days. Tokens are promptly revoked/deleted on disconnect or authorisation expiry. Backups expire no later than 30 days after active deletion. Contract/consent evidence normally lasts three years after the relevant operation ends; legally required records follow the applicable statutory period. Specific disputes may require bounded, separate evidence preservation. Earlier valid deletion claims and loss of purpose remain relevant.

9. Your rights

Statutory rights include access, correction, deletion, restriction and portability. You may withdraw consent for the future at any time. You may object to GDPR Article 6(1)(f) processing on grounds relating to your situation, and to direct marketing at any time. Contact privacy@marketing-aigency.com or our EU representative. You may complain to a competent supervisory authority, particularly at your residence, workplace or the place of an alleged infringement. The relevant customer controls instructed customer data; we forward and assist with requests.

AI suggestions and campaign actions serve agreed advertising management. This does not describe a solely automated decision about an individual with legal or similarly significant effects. New functions with different purposes/effects are explained beforehand. Material notice changes are announced on the website and additionally where necessary; required new consent is obtained before new processing.

Website addendum (21 September 2026)

These points apply to marketing-aigency.com in addition to the notice above and will be folded into its next version.

Demo-call calendar (Cal.com)
The booking calendar on the start page is provided by Cal.com, Inc., San Francisco, USA. It loads only after you press “Load the calendar”; before that nothing is sent to Cal.com. When it loads, your browser transmits the usual connection data (IP address, browser, time) to Cal.com, and anything you enter to book a call goes to Cal.com and to us. Legal basis: Art. 6(1)(b) GDPR for the booking itself and Art. 6(1)(f) for showing the calendar you asked for. Cal.com participates in the EU-US Data Privacy Framework; its privacy notice is at cal.com/privacy.
Cookie-free page counting
Independently of your consent choice we count page views. For each view we store the day, the page path, the domain the visit came from (never the full address), the device type (phone, tablet, desktop) and the country, as a daily sum. No cookie is set, nothing is read from your device, no IP address and no identifier is stored, so two views cannot be linked to one person. Legal basis: Art. 6(1)(f) GDPR, our interest in knowing how many people visit which pages.
Record of your consent choice
When you decide in the consent dialog we store the time, your choice, the version of the dialog shown, your country, device type and browser string together with a random identifier that is also saved in your browser (local storage and a cookie named maig_consent, valid one year). This is our evidence under Art. 7(1) GDPR. Google Analytics only loads after this record has been written. Withdrawing consent switches Analytics off immediately in the running page and deletes its cookies.
Google Ads conversion measurement
Since 21 September 2026 the Google Ads tag (Google Ireland Limited, ID AW-18466423486) is contained in every page of this website, so that Google can verify that our measurement is set up correctly. Before you consent it runs in what Google calls redacted mode: all storage is set to denied, so no cookie is written or read, and the advertising identifiers are stripped out of its requests. We measured what this state actually does on 21 September 2026: the tag sends no measurement request at all before you consent. What does reach Google is the request that loads the tag file itself from googletagmanager.com, which necessarily transmits your IP address, your browser and the address of the page you are on. Legal basis for that state is Art. 6(1)(f) GDPR, our interest in a measurement that Google can verify as correctly configured. Only once you accept does the tag store the cookies _gcl_* on your device and record that a sign-up followed a click on one of our ads, so we can tell which of our ads are worth running; legal basis then is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. We use it for conversion measurement only: Google Signals, user IDs, remarketing lists and ad personalisation stay switched off (ad_personalization: denied) even after you accept. Withdrawing consent puts the tag back into redacted mode and deletes these cookies; because the tag is part of the page, it cannot be removed from a page already open. Google Analytics is not affected by this and is still only started after your explicit consent.
Conversion measurement inside the product
Again only if you accepted, the same Google Ads tag is used on app.marketing-aigency.com. There it is not loaded while you use the product; it loads only at one of three moments, and only to report that moment: you completed a sign-up, you submitted an order, you finished calibration. Because the tag reports its own load, Google also receives the address and title of the page on which that moment happened. Nothing else about your use of the product is measured — no other page views, no clicks, no behaviour, and no Google Analytics at all in the logged-in area. Each of the three moments is reported at most once per browser. We do not ask again on the subdomain: the choice you made on this website is stored in the cookie maig_consent for .marketing-aigency.com and applies there. If you chose “essential only”, no script loads inside the product and these moments are simply not measured.
Funnel events from our servers
If, and only if, you accepted Google Analytics on this website, our servers report five milestones of your account to Google Analytics (registration completed, order summary viewed, order submitted, ad account approved, calibration completed) under the same random identifier, without names, e-mail addresses or workspace identifiers. If you chose “essential only”, none of these events is sent.