Skip to content
FR Request access

Privacy Policy

Last updated : 3 October 2026

Who we are

Ads Data Bridge is operated by Baptiste Lagae, sole trader registered in France under the micro-entreprise regime, SIREN 953749744, Lyon, France. Contact : privacy@adsdatabridge.com.

What data we access

With your explicit authorisation, the main connector reads, on your behalf :

  • Google Analytics 4 reporting data : sessions, landing pages, campaign attribution, conversions.
  • The configuration of your Google Tag Manager containers : tags, triggers, variables.
  • The list of GA4 properties and GTM containers your Google account can access.

The main connector performs read operations only. It requests only the read-only scopes analytics.readonly and tagmanager.readonly. It does not request your Google profile or email address : your access is identified by your access key, not by your Google identity.

Optional GTM repair connector

A second, separate connector that you add to your assistant yourself, only if you want it to fix your Google Tag Manager configuration. It additionally requests permission to edit your GTM containers. Its changes are strictly bounded :

  • they are made only in a dedicated GTM workspace whose name starts with “GTM | ” ;
  • every change is shown to you (before and after) and applied only after your explicit confirmation ;
  • the connector never publishes, never creates a version and never deletes a container : publishing stays in your hands, in GTM.

Without this second connector, no change is possible.

What we store

Never your advertising data, Google API responses, or your OAuth token. Your token is held by the AI assistant you use, transmitted with each request and never persisted on our servers.

To manage access to the service, a database hosted in the European Union (Paris) holds only:

  • your account: name, contact email (optional), status;
  • your access keys: the name you give them, their visible prefix (for example adb_k3x9…) and their creation, expiry and revocation dates. The key itself is never stored: only its irreversible cryptographic hash is;
  • your usage counters: the number of calls per key and per day, to enforce quotas;
  • an audit log of calls: for each call, the timestamp, account, key, tool called, the identifiers of the GA4 properties or GTM containers queried, the status and duration. It never contains the data itself or API responses.

Usage counters and the audit log are kept for 12 months, then deleted. Your account is kept while it is open; when it is closed, your keys are revoked and your email is erased, and the log remains linked only to a technical identifier that no longer designates you, until it is deleted.

We also keep technical logs — timestamp, request type, error codes — for 30 days, for reliability and abuse prevention. These logs contain no advertising data.

Legal basis

Your consent, given through the Google authorisation screen, for access to your advertising data; performance of our contract for managing your account, keys and quotas; and our legitimate interest in securing the service and being able to trace its use, for the audit log and technical logs.

Who processes data on our behalf

  • Google Cloud Platform (Cloud Run), European region, for hosting the connector.
  • Supabase Pte. Ltd., for hosting the database described above, Paris region (Amazon Web Services infrastructure eu-west-3).
  • Cloudflare, Inc., for website hosting, DNS and email routing.

Your advertising data does not leave the European Union : the connector runs in the europe-west1 region and does not retain it. The database is hosted in Paris; as Supabase (established in Singapore) and Cloudflare (in the United States) are established outside the Union, access from outside the Union remains possible for the operation of their services, covered by the European Commission’s standard contractual clauses.

No advertising data is shared with any other party, sold, or used to train any model.

Google API Services User Data Policy

Ads Data Bridge’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The only information received from Google APIs that we retain is the identifiers of the GA4 properties and GTM containers queried, recorded in the audit log. They are used solely for the security of the service and the traceability of access, and are never shared, sold or used for any other purpose.

Your rights

Under the GDPR you may request access to, correction of, or deletion of your personal data, including the extract of the audit log relating to your account, request the closure of your account, and object to its processing. Write to privacy@adsdatabridge.com. You may also revoke the connector’s access at any time from your Google account security settings, and lodge a complaint with the CNIL.

Changes

Material changes to this policy will be announced on this page before taking effect.

The version of 3 October 2026 replaces that of 22 September 2026, which described a service without a database. It introduces the retention of the account, access key hashes, usage counters and audit log described above. The OAuth token and advertising data are still never retained.