Privacy Policy
1. Scope
This policy explains how sole proprietor Viktor Osmanov (TIN 23011199800011, Bishkek, Kyrgyz Republic; "we", the "Controller"), the operator of the ODA service, handles data of visitors to oda.chat, of users of the ODA service, and the Google user data that the ODA Ads Manager AI assistant is granted access to through the Google Ads API.
ODA Ads Manager works in two ways: (1) you connect your own Google Ads account via Google sign-in (OAuth), and the assistant reads reports and suggests improvements — in development: the site is currently an information page, Google sign-in and a personal account will come later; (2) you give the ODA manager account access to your Google Ads account, we run your ads and you see the reports. This policy covers both.
The website and the service are in development; if our data handling changes, we update this document (section 9).
2. The oda.chat website
The site is static. It sets no cookies, runs no trackers or third-party scripts and has no login or lead forms. The hosting provider keeps standard technical request logs (IP address, time, requested page) for its usual period; we do not access them.
3. Data you give us yourself
When you write to us or to the ODA assistant via Telegram, WhatsApp or e-mail, we receive what you choose to provide: your name and messenger contact, the text of your messages, information about your business. This data is used only to reply and to prepare and handle your order (website, ads, CRM) and is kept while your subscription is active or we are working with you; we delete it on request (section 6). Assistant replies in the chat may be produced with a language model of a third-party service provider.
4. Google user data
4.1. Which Google Ads data is read and what is changed
ODA Ads Manager requests a single OAuth 2.0 scope — https://www.googleapis.com/auth/adwords — for two things: reading reports and applying the edits you approve. Through the Google Ads API (GoogleAdsService.SearchStream) the assistant reads, from connected Google Ads accounts:
- the list of accessible Google Ads accounts (IDs and names);
- campaigns and ad groups;
- keywords and negative keywords, including shared negative keyword lists;
- search terms (search terms report);
- ads and their assets (headline and description texts, URLs);
- statistics: impressions, clicks, cost and conversions by day;
- conversion actions (names and categories);
- account change history (change events).
The assistant makes changes to the account (campaigns, ad groups, keywords and negative keywords, ads, bids and budgets) through the Google Ads API only after you explicitly approve each edit (option 1) or in agreement with you (option 2). It does not change billing, user access or account settings.
The assistant does not request access to Gmail, Drive, Contacts, Calendar or any other Google service and does not read the user profile beyond what Google returns at sign-in. These reports contain no personal data of the advertiser's end customers (names, phone numbers, addresses).
4.2. How we obtain access
Only with your consent.
- Option 1 (on your own; in development, coming later). Once sign-in is launched, you sign in to your Google account on the standard Google OAuth 2.0 consent screen and approve the
adwordsscope. The access token issued by Google is stored on the service side, separately from the code, and is used only for Google Ads API requests for your accounts. - Option 2 (with us). You link your Google Ads account to the ODA manager account in the standard Google Ads way. The data is read through the ODA manager account by the ODA specialists who run your ads.
4.3. How we use Google data
- analytics reports by campaign, keyword and day;
- keyword value scoring, new keywords and negatives derived from search terms;
- preparing edits for human review and applying them to the account through the Google Ads API after approval;
- generating and rewriting ad copy;
- reconciling the account with the edits after they are applied.
We do not use Google Ads data for advertising, including personalised, retargeted or interest-based advertising, or for scoring, creditworthiness assessment, profiling, resale or training machine-learning models.
4.4. Where and how long Google data is stored
API responses (cache) and exports are stored in the working storage of the ODA service, separately for each connected account, and are never published. We retain them while your subscription (with auto-renewal) is active, unless you request deletion. If you do not use the service for a long time, the data is anonymised after an extended period of inactivity; the exact period will be shown in your personal account. On request the data is deleted within 30 days; once Google access is revoked, no new data is read.
4.5. Deleting data and revoking access
- Revoke access at any time at myaccount.google.com/permissions — after that the assistant can no longer read your account data (option 1);
- unlink your account from the ODA manager account in the access settings of your Google Ads account (option 2);
- request deletion of all exports and cache related to your account by e-mailing support@oda.chat — we delete them and confirm by e-mail within 30 days.
4.6. Compliance with the Google API Services User Data Policy (Limited Use)
ODA Ads Manager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
This means that Google data:
- is used only to provide the user-facing features described above;
- is not transferred to third parties except as needed for those features, as required by law or with the user's explicit consent;
- is not used for advertising, including personalised, retargeted or interest-based advertising, and is not sold;
- is not used to train generalised AI or machine-learning models;
- is read by humans only with the user's consent (for example, when you ask ODA to run your ads — option 2), for security purposes or where required by law.
5. Who we share the data with
We do not share, sell or disclose Google Ads data to third parties, except where expressly required by the law of the Kyrgyz Republic.
The exception we state explicitly: for ad-copy generation, only ad texts and keywords are sent to the Anthropic language model (API) — no account identifiers, account names, statistics or any personal data. Anthropic processes these requests as a service provider under its API terms and does not use the data to train its models. No transfer to anyone who is not a service provider takes place.
6. Your rights
- request a list of the data we hold about you and your account, and correction of inaccuracies;
- request deletion of your data, including correspondence and Google Ads data;
- revoke access to Google Ads (section 4.5).
Requests go to support@oda.chat; we respond and act within 30 days.
7. Cookies and analytics
The website sets no cookies and uses no analytics.
8. Security
OAuth tokens and configuration are kept separately from the code and the repository, with restricted access. Connections to the Google Ads API use HTTPS only. Access to an account's data is limited to those who work with that account.
9. Changes to this policy
A new version is published on this page with a new effective date. Material changes in how we handle Google data are communicated to users with connected accounts by e-mail or in the chat.
10. Data controller contact
Sole proprietor Viktor Osmanov, TIN 23011199800011, Bishkek, Kyrgyz Republic · support@oda.chat · Telegram t.me/leacli · +996 703 555 330. Assistant home page: https://oda.chat/en/ads/.