ClearSpend Privacy Policy

This Privacy Policy explains how ClearSpend ("ClearSpend," "we," "us," or "our") collects, uses, and protects information when you use our website and audit tool (the "Service"), located at https://clearspend.dev/.

This is a draft prepared for planning purposes. It is not legal advice, and we recommend having it reviewed by a licensed attorney before publishing, particularly given the live Google Ads account connection described below.

1. Who We Are

ClearSpend is an advertising audit tool that helps businesses identify wasted ad spend, quality issues, and potential advertising-policy risk across Google Ads, Meta Ads, and TikTok Ads accounts. ClearSpend offers two ways to run an audit: uploading a CSV export yourself, or connecting your Google Ads account directly so we can pull fresh data on your request.

2. What Information We Collect

2.1 Ad performance data you upload (CSV audits)

When you upload a CSV export from Google Ads, Meta Ads, or TikTok Ads, that file is processed entirely in your browser. We do not upload, transmit, or store the contents of your CSV file, your campaign data, or any ad account information on our servers. Once you close or refresh the page, that data is gone unless you've downloaded a copy yourself. This applies regardless of whether you're signed in.

2.2 Account information (sign-in)

If you choose to sign in, we use email-based "magic link" authentication: you provide your email address, and we send you a one-time sign-in link. We do not collect or store a password. Your email address and account identifier are stored by our authentication provider (Supabase Auth) to maintain your session and let you return to your saved audit history.

2.3 Google Ads account connection (live audits)

If you choose to connect your Google Ads account instead of uploading a CSV, here is exactly what happens and what we store:

• Authorization. You'll be sent to Google's own sign-in and consent screen, where you choose which Google account to use and see exactly what access you're granting. We never see or handle your Google password.
• What we request. We request read-only access to your Google Ads account performance data (the adwords scope), and access to see the basic list of ad accounts you can access. We do not request access to your Gmail, Google Drive, or any other Google product, and we do not request the ability to modify your campaigns, bids, or budgets.
• What we store. After you authorize the connection, we securely store a refresh token — a credential that lets us request fresh performance data on your behalf without you re-authorizing every time — on our servers. This token is never sent to your browser and is not visible to us in plain, readable form during normal operation of the Service. We also store which specific Google Ads account (customer ID) you selected to audit.
• What we don't store. We do not permanently store your raw, line-by-line campaign or keyword data pulled from your Google Ads account. That data is retrieved, analyzed, and discarded in the course of generating your audit result.
• What we do store from an audit. If you're signed in, we save the results of each audit you run — the summary statistics and flagged findings (e.g., total spend, wasted spend, which keywords were flagged and why) — to your account, so you can view it again later in "My Audits." This is a summary of the analysis, not a full export of your Google Ads account.
• Disconnecting. You can disconnect your Google Ads account at any time from your account settings, which deletes the stored refresh token immediately. Disconnecting does not delete previously saved audit results unless you separately request deletion of those.

2.4 Information you provide voluntarily (report delivery)

If you choose to download a PDF audit report — whether from a CSV upload or a connected account — we ask for your name, email address, and business name if we don't already have them from your account. We store the summary results of that specific audit alongside your contact information, so we can send you your report and, where relevant, follow up about the findings.

2.5 Aggregate, non-identifying statistics

We track a running total of how many audits have been run and how much wasted spend has been flagged across all users of the Service. This data is aggregate only and is never linked back to any individual person, business, or ad account.

2.6 Technical and log data

Like most websites, our hosting provider automatically logs standard technical information (IP address, browser type, device type, pages visited, timestamps) for security, performance, and abuse-prevention purposes.

2.7 Our commitments under Google's API policies

Our use of Google user data obtained through the Google Ads API adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We only request the minimum scope of access needed to perform the audit functions described in this policy.
• We do not use Google user data for serving advertisements of any kind.
• We do not allow humans to read Google user data unless: we have your affirmative agreement for specific messages, it's necessary for security purposes, it's needed to comply with a legal obligation, or the data has been aggregated and anonymized (as with the statistics described in Section 2.5).
• We do not sell Google user data.
• We do not transfer Google user data to third parties except as needed to provide the Service (e.g., our hosting/database provider), as required by law, or as part of a merger or acquisition, and any such transfer will remain subject to this Privacy Policy's commitments.

2.8 Advertising measurement (Google Ads tag)

We use Google's advertising tag (Google Ads, operated by Google LLC) to measure how well our own advertising performs — for example, how many visitors arrive from one of our ads and whether they go on to run an audit. When it runs, the tag records pages visited and interactions with our ads, and Google may set cookies on your device and use device identifiers for this measurement and for improving our ad campaigns. This is measurement of our own marketing only; it is never used to send your audit data, CSV contents, or connected Google Ads data back into advertising systems.

Your cookie choice controls whether this measurement runs. In regions that require a consent choice (such as the EU/EEA and UK), the tag runs in a limited, cookieless mode until you accept, and your banner decision is recorded on your device. Everywhere else, measurement runs by default and applicable opt-outs are honored. If you reject, the tag does not load on future visits, and your refusal persists until you change it. You can accept, reject, or change your decision at any time via the "Cookie settings" link in the footer of every page, and you can opt out of personalized Google ads separately through Google's Ad Settings.

3. How We Use Information

We use the information described above to:

• Authenticate you when you sign in
• Connect to and retrieve performance data from your Google Ads account, at your request, to generate an audit
• Generate and deliver the audit report you requested
• Save your audit history so you can revisit past results under your account
• Maintain the aggregate usage statistics shown on our website
• Respond to you if you contact us for support
• Improve the accuracy and usefulness of the Service
• Detect and prevent abuse, fraud, or security issues

We do not sell your personal information. We do not use your uploaded CSV data or connected Google Ads data for any purpose beyond generating the audit you requested.

4. Third-Party Service Providers

We rely on the following categories of third-party providers to operate the Service:

• Authentication (Supabase Auth) — manages magic-link sign-in and your session.
• Database/backend hosting (Supabase) — stores your account information, connected Google Ads refresh tokens, saved audit results, lead/contact information described in Section 2.4, and the aggregate statistics described in Section 2.5.
• Google Ads API (Google) — the source of live performance data when you choose to connect your account, governed by Google's own privacy practices for the account holder's underlying data.
• Advertising measurement (Google Ads / Google) — measures the performance of our own advertising as described in Section 2.8, subject to your cookie choice.
• Website hosting — serves the Service and processes the technical log data described in Section 2.6.

We do not sell your personal information, and we do not share it with data brokers or marketing networks. The only third-party marketing data sharing is the advertising measurement described in Section 2.8, which runs strictly according to your cookie choice.

5. Data Retention

• Refresh tokens are retained until you disconnect your Google Ads account or delete your ClearSpend account, whichever happens first.
• Saved audit results are retained until you delete them individually or delete your account.
• Lead/contact information described in Section 2.4 is retained until you ask us to delete it, or until it's no longer needed for the purposes described in this policy, whichever comes first.
• Aggregate statistics are retained indefinitely since they contain no personal information.

6. Your Rights and Choices

Depending on where you live, you may have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of that information
• Object to or restrict certain processing
• Request a copy of your information in a portable format

In addition, you can at any time, directly within the Service:

• Disconnect your Google Ads account, which immediately deletes the stored refresh token
• Delete individual saved audits from your "My Audits" history
• Delete your account entirely, which removes your account information, connection, and saved audit history
• Accept, reject, or change your cookie choice via the consent banner or the "Cookie settings" link in the footer — a rejection takes effect immediately and persists

You can also independently revoke ClearSpend's access to your Google account at any time through your Google Account's third-party access settings, regardless of what you've done within ClearSpend itself.

To exercise any other rights, contact us at mk4hartling@gmail.com. This includes rights available to California residents under the CCPA/CPRA and to individuals in the EU/UK under the GDPR, to the extent those laws apply to you.

7. Children's Privacy

The Service is intended for business use and is not directed at, or knowingly used to collect information from, individuals under the age of 16. If you believe a minor has provided us with personal information, contact us and we will delete it.

8. Security

We use reasonable administrative, technical, and physical safeguards to protect the information we hold, including storing Google Ads refresh tokens using our infrastructure provider's encrypted secrets storage rather than in plain, application-readable database fields. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice.

11. Contact Us

Questions about this Privacy Policy can be directed to mk4hartling@gmail.com.