1. Who we are and the scope of this policy
NovaTech Ads Operations is operated by Nova Tech AI Limited, a company incorporated in Hong Kong SAR. The application is an internal advertising operations tool for authorized company administrators. This policy applies to the public application site, the Google OAuth authorization flow, and Google Ads data processed through the application.
2. Information we access
After an administrator grants permission, the application may access the Google Ads customer accounts available to that administrator and the minimum data needed for the selected functions:
- Google Ads customer identifiers, account names, manager-account relationships, currency, and time zone;
- campaign, ad group, ad, and asset identifiers and names;
- reporting dimensions and metrics such as date, cost, impressions, clicks, conversions, and app-install conversions;
- asset metadata required to identify or create a human-approved image, media bundle, or YouTube-linked asset in the selected account; and
- OAuth access and refresh credentials required to maintain the authorized connection.
We do not request the administrator's Google password. Google handles authentication directly.
3. How we use Google user data
We use Google user data solely to:
- display authorized advertising spend and performance in the company's operations portal;
- calculate and reconcile internal CPA, ROI, installation, and financial reports;
- let an administrator select the correct Google Ads customer account;
- synchronize a creative asset only after technical checks, rights confirmation, and human approval; and
- secure, maintain, troubleshoot, and audit the authorized integration.
The application does not automatically create or activate advertising campaigns, change budgets, set bids, or launch paid advertising.
4. Limited Use disclosure
NovaTech Ads Operations' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell Google user data, use it for personalized or unrelated advertising, transfer it to data brokers, or allow human access except when necessary to provide and secure the stated functions, comply with applicable law, or investigate abuse. We do not use Google APIs to generate, distribute, or facilitate non-consensual intimate imagery.
5. Storage and security
OAuth credentials and imported reporting records are stored on controlled production systems. Access is restricted to authorized services and administrators. We use HTTPS in transit, role-based administrative access, operational logging that excludes OAuth tokens, and reasonable technical and organizational safeguards appropriate to the data.
No internet service can guarantee absolute security. If we identify an incident that materially affects this data, we will respond and notify affected parties when required by applicable law.
6. Sharing and service providers
We do not sell Google user data. Data may be processed by infrastructure and database providers acting on our instructions to operate the application. We may also disclose information when required by law, to protect rights and security, or as part of a corporate transaction subject to appropriate protections. Service providers may not use the data for their own advertising purposes.
7. Retention
OAuth access and refresh credentials are retained until the connection is revoked, deleted, replaced, or no longer required. Imported Google Ads reporting records and derived business reports are retained while needed for advertising operations, reconciliation, auditing, and applicable financial record-keeping obligations. Records no longer needed for these purposes are deleted or de-identified according to our operational retention process.
8. Revocation and deletion
An administrator can revoke the application's access from the third-party connections page of their Google Account. Revocation prevents new API access but does not by itself erase records already imported for the purposes described above.
To request deletion of stored OAuth credentials and associated imported Google Ads data, email developer@novatechai.xyz from an address associated with the organization. We may verify the request to protect the account. We aim to complete verified deletion requests within 30 days unless retention is required by law or necessary to resolve security, fraud, or accounting matters; any retained exception will be limited to that purpose.
9. International processing
Data may be processed where Nova Tech AI Limited and its service providers operate. We apply safeguards appropriate to the processing and limit access to the purposes described in this policy.
10. Changes
We may update this policy when the application, requested permissions, or legal requirements change. We will publish the updated date on this page. Material changes to Google data practices will be reflected before the changed processing begins where required.
11. Contact
Questions, privacy requests, and deletion requests: developer@novatechai.xyz
Nova Tech AI Limited · Hong Kong SAR