Privacy Policy

1. Introduction

1.1 This Privacy Policy explains how HERUS ADTECH INC. (“Company”, “we”, “us”) collects, uses, and protects personal data when you access or use our AI compliance SaaS platform, dashboards, APIs, integrations with third-party advertising platforms (including Meta, Google, and TikTok), and related services (the “Services”).

1.2 This Privacy Policy applies to (a) visitors to our websites, (b) registered users and account holders of the Services, and (c) individuals whose personal data we process on behalf of our business customers in connection with the Services, as described below.

1.3 When we determine the purposes and means of the processing of personal data, we act as a “controller” (or equivalent term under applicable law). When we process personal data on behalf of our business customers and in accordance with their instructions (for example, when we analyze ads, creatives, or landing pages they upload to the Services), we act as a “processor”, “service provider”, or “contractor” under applicable law.

1.4 By using or accessing our Services, you acknowledge that you have read this Privacy Policy. Where required by applicable law (for example, for certain cookies or direct marketing communications), we will obtain your consent separately.

1.5 Our Services are also governed by our Terms and Conditions. If there is any conflict between this Privacy Policy and the Terms and Conditions regarding how we handle personal data, this Privacy Policy will prevail.

2. Information We Collect

We collect personal and non-personal information from you in several ways, including directly from you, automatically through your use of our Services, and from third parties. The main types of information we collect include:

• Personal Identifiers: Name, username, IP address, and device ID.
• Contact Information: Email address.
• Account and Profile Information: Login credentials, preferences, survey responses, and feedback.
• Payment and Transaction Information: Payment details and transaction history (processed by third-party payment providers; we do not store full credit card numbers).
• Professional and Business Information: Business email, company name, company size, industry, corporate affiliations, and information about your role and responsibilities.
• Usage Data: Data on how you interact with our Services, including analytics, browsing, clicks, feature usage, session recordings of your interactions with our user interface (such as mouse movement, clicks, scrolls, keyboard interactions in non-sensitive fields, page navigation, and errors), and error and performance telemetry such as stack traces, URLs, release versions, and device diagnostics. Sensitive fields (for example, passwords and payment details) are masked and not intentionally collected by these tools.
• Device and Network Information: IP address, browser type, operating system, software and hardware attributes.
• Location Data: If enabled, geolocation information from your device.
• Information from Third-Party Services: If you choose to connect our Services to third-party services (for example, advertising platforms, analytics tools, or single sign-on providers), we may receive information from those services as permitted by their terms and your settings. This may include campaign names, ad account identifiers, ad creatives and metadata, performance metrics, and other information needed to provide and improve the Services.

• Meta Data Access and Usage: When you connect your Meta Business Manager account through our Services, we access and process the following data from Meta via the Meta Graph API:

  • Business Manager account information and ad account metadata (account ID, name, status, currency)
  • Ad campaign data, ad creative content (images, videos, text), and ad performance metrics (impressions, clicks, spend)
  • Ad account configuration data, spend caps, and account status information
  • Webhook subscription data for real-time ad status monitoring

  App Functionality: We use this data solely to provide ad compliance monitoring, ad management, reporting, and analytics services as part of our platform. Specifically, our app scans your Meta ad creatives and landing pages to identify potential policy violations and provide recommendations to prevent ad rejections.

  Appropriate Data Access: We do not access your personal Facebook profile data, friends list, personal posts, or other personal information. We access only business and advertising-related data from your Meta Business Manager account.

  Request Minimum Scopes: We request only the specific permissions (scopes) necessary to perform these functions, such as `ads_management`, `ads_read`, and `business_management`.

• Google Ads Data Access and Usage: When you connect your Google Ads account through our Services, we access and process the following data from Google via the Google Ads API:

  • Google Ads customer account information, including account IDs, names, currency, and account hierarchy (Manager Accounts / MCCs and their sub-accounts)
  • Campaign data, ad group data, and individual ad details (headlines, descriptions, final URLs, ad type, and approval/policy status)
  • Ad performance metrics (impressions, clicks, cost, conversions) to provide unified reporting across platforms
  • Policy summary data, including approval status and policy topic entries, to identify disapproved or limited ads

  App Functionality: We use this data solely to provide ad compliance monitoring, performance reporting, and analytics services as part of our platform. Specifically, our app scans your Google Ads campaigns and ad creatives to identify policy violations, alert you to disapproved or limited ads, and help prevent account suspensions.

  Appropriate Data Access: We do not access your personal Google account data, Gmail, Google Drive, Google Calendar, or any data outside of your Google Ads accounts. We access only advertising-related data from the Google Ads accounts you explicitly authorize.

  Request Minimum Scopes: We request only the https://www.googleapis.com/auth/adwords scope, which is the minimum required to access campaign, ad, and policy data across complex account structures (including MCCs). No more granular read-only scope is available from the Google Ads API that covers all required compliance data.

  You may disconnect your Google Ads account at any time through the Services, which will stop further data collection, subject to data retention requirements described in the "Retention" section below.

• Special Categories: We do not intentionally seek to collect "special category" data or similarly sensitive personal data (such as information about health, race or ethnic origin, religious or philosophical beliefs, union membership, or biometric data) through the Services. If you choose to include such information in content you upload (for example, in ad creatives or landing pages), you are responsible for ensuring that you have a lawful basis to do so, and we will process such data only as necessary to provide the Services in accordance with your instructions and applicable law.

We may also collect information from third-party services you connect to the Services, such as social media accounts or advertising platforms, to provide functionality and integrate your workflows.

3. Cookies and Tracking Technologies

Our website and Services may use cookies and similar tracking technologies to enhance your experience, analyze usage, and provide certain features. Cookies are small data files stored on your device that help us recognize your browser, remember preferences, and measure performance. We use the following types of cookies:

• Essential Cookies: Required for core functionality, such as login and account security. Cannot be disabled.
• Functional Cookies: Remember preferences and settings to personalize your experience.
• Performance and Analytics Cookies: Collect anonymous usage data to improve the Services.
• Advertising/Marketing Cookies: Deliver personalized offers, relevant ads, and measure ad effectiveness.

By using our website or Services, you consent to the use of cookies as described in this section.

Session Replay, Product Analytics, and Error Monitoring

We use third-party service providers to (a) record and replay a subset of user sessions for user-experience research and debugging, (b) produce product analytics about how features are used, and (c) collect error and performance telemetry when the Services misbehave. These tools help us identify bugs, improve reliability, and understand how users interact with the Services.

These providers act as processors (or "service providers" / "contractors" under applicable US state law) that process data only on our documented instructions and do not use the data for their own marketing or to build independent profiles of you. We configure these tools to mask sensitive inputs (including passwords, payment card details, and similar fields) so that the contents of those fields are not intentionally collected.

A current list of our sub-processors is available on request using the contact details in the "Contact" section. You may exercise the rights described in the "Your Rights" section below, including requesting that we stop session replay or analytics processing about you, by contacting us.

4. Legal Basis for Processing (EU/UK Users)

For users in the EU/UK, we process personal data based on the following legal grounds:

• Performance of a contract with the user
• Compliance with legal obligations
• Consent for certain processing (e.g., marketing emails or cookies)
• Legitimate interests, such as improving the Services, preventing fraud, or ensuring security

5. How We Use Your Information

We use the information we collect for purposes including, but not limited to:

• Operating, maintaining, and improving the Services.
• Managing accounts, processing transactions, and providing support.
• Personalizing content, communications, and marketing.
• Detecting fraud, ensuring security, and maintaining the integrity of the Services.
• Complying with legal obligations, enforcing agreements, and responding to law enforcement requests.
• Using aggregated, de-identified, or anonymized information (that does not identify you) to improve and train our models and algorithms, benchmark performance, and generate statistical insights. We do not use your personal data in a way that would identify you when we perform these activities.
• Research, analytics, and AI model improvement using aggregated or anonymized data.

We will not use your personal data for purposes incompatible with those stated above without notifying you.

6. How We Share Your Information

We may share your personal data with service providers and affiliates that help us operate and improve the Services. All such third parties are contractually obligated to process and protect your data in accordance with this Privacy Policy and applicable law, to process it only on our documented instructions, and to apply appropriate technical and organizational safeguards. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

The categories of third-party service providers we use include:

• Cloud hosting, storage, and database infrastructure providers.
• Session replay, product analytics, and user-experience research providers (as described in the "Cookies and Tracking Technologies" section).
• Error and performance monitoring providers used to detect and diagnose issues.
• Payment processing providers.
• Transactional and operational email delivery providers.
• Identity, authentication, and single sign-on providers.
• Customer support and communications tooling.

A current list of our sub-processors is available on request using the contact details in the "Contact" section.

With respect to Meta data specifically: We share ad performance data, compliance reports, and analytics with authorized users within your organization through our platform interface. We do not share your Meta ad data with third parties except with the categories of service providers listed above as strictly necessary to provide the Services (for example, cloud hosting and database services), or as required by law. We do not sell, rent, or license your Meta ad data to third parties for their own use; we do not use Meta Platform data for advertising, marketing, profiling, or to build independent user profiles; and we do not transfer Meta Platform data to data brokers, information resellers, or credit bureaus. You may disconnect your Meta Business Manager account at any time through the Services, which will stop further data collection, subject to the data retention periods described in the "Retention" section below.

You may request deletion of your personal data, including data we have received from Meta, at any time. See our User Data Deletion page for instructions on how to submit a deletion request.

7. Data Security

We implement technical and organizational measures to protect your personal data from unauthorized access, loss, or disclosure. These measures may include access controls, encryption in transit, network and application security controls, and regular monitoring of our systems. However, no method of electronic transmission or storage is completely secure.

8. Your Rights

Depending on your jurisdiction, you may have rights including:

• Accessing and obtaining a copy of your collected personal data.
• Correcting or updating inaccurate or incomplete data.
• Requesting deletion of your personal data.
• Objecting to or restricting certain processing activities.
• Withdrawing consent where processing is based on consent.
• Exercising your rights under applicable laws such as GDPR or CCPA.
• Any other rights prescribed under the applicable law of the respective jurisdiction shall also apply.

To exercise any of the rights described above, you can contact us using the contact details provided in the “Contact” section below. We may need to verify your identity before responding to your request.

9. Retention

We retain personal data only as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Actual retention periods depend on the type of data and the purpose for which it was collected. Indicative retention periods include:

• Account and profile data: retained while your account is active and for a limited period after account closure to satisfy legal, audit, tax, and dispute-resolution requirements.
• Data received from connected advertising platforms (including Meta and Google Ads): retained while the connection is active, and deleted or anonymized within a reasonable period (typically 30 to 90 days) after you disconnect the account or close your account, except where we are required to retain it to comply with applicable law or resolve an ongoing dispute.
• Session replay, analytics, and error / performance telemetry: retained on a rolling basis for a limited period (typically up to 12 months for session replays and up to 90 days for error telemetry) before automatic expiry.
• System logs and backups: retained on a rolling basis (typically up to 90 days) before expiry or rotation.

Aggregated or anonymized data that no longer identifies you may be retained indefinitely for research, analytics, or model-improvement purposes. You may request deletion of your personal data at any time, subject to applicable law, via our User Data Deletion page or by contacting us as described in the "Contact" section.

10. International Transfers

If personal data is transferred outside of your country, we ensure adequate protections are in place consistent with applicable law, including GDPR requirements.

11. Children

The Services are not intended for children under 13 in the U.S., or under 16 in the EU/UK unless parental consent is provided. We do not knowingly collect personal data from children below these ages. If we become aware that a child below these ages has submitted data, we will promptly delete it.

12. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. Updates will be posted on our website with the “Last Updated” date. Continued use of the Services constitutes acceptance of the updated Privacy Policy.

13. US State Privacy Notice

This section provides additional information for residents of certain US states that have enacted comprehensive privacy laws. To the extent these laws apply to our processing of your personal information, this section supplements the other parts of this Privacy Policy.

Categories of personal information

In the 12 months preceding the “Last Updated” date of this Privacy Policy, we may have collected the categories of personal information described in the “Information We Collect” section above. These categories generally correspond to the following under applicable US state laws:

• Identifiers (such as name, email address, IP address, and device identifiers).
• Commercial information (such as records of Services purchased or considered).
• Internet or other electronic network activity information (such as usage data and log information).
• Professional or employment-related information (such as business role and company details).
• Geolocation data (such as approximate location derived from IP address).

Residents may also have the right to obtain a portable copy of their personal information and to opt out of targeted advertising or profiling where applicable

Purposes for collection and use

We collect and use these categories of personal information for the business purposes described in the “How We Use Your Information” section.

Disclosures for business purposes

As described in the "How We Share Your Information" section, we may disclose the categories of personal information listed above to service providers, contractors, and other third parties for business purposes such as cloud hosting and database infrastructure, product analytics and session replay, error and performance monitoring, customer support, authentication and single sign-on, transactional email delivery, and payment processing. These recipients are contractually restricted to processing personal information only on our documented instructions and for the business purposes for which it was disclosed.

No sale or sharing

We do not “sell” personal information and do not “share” personal information for cross-context behavioral advertising, as defined under applicable US state privacy laws.

Your state privacy rights

Residents of certain US states may have the rights described in the “Your Rights” section above (for example, the rights to know, access, delete, correct, and opt out of certain processing). You can exercise these rights by contacting us as described in the “Contact” section. We will not discriminate against you for exercising any of your privacy rights. Any other rights prescribed under the applicable law of the relevant jurisdiction shall also apply.

14. Contact

For questions about this Privacy Policy or your personal data, contact us at: