Privacy policy
Last updated: October 26, 2026
1. Introduction
This privacy policy explains how overads ('we', 'us', 'our') collects, uses, and protects information when you visit our marketing site or use the overads product. By using overads you agree to the practices described here. It covers both the personal data we hold about you and the advertising, search, and customer data you connect to your workspace from third-party platforms.
2. Data we collect
We collect account information you provide directly (name, email, workspace name), authentication metadata from your identity provider, usage telemetry generated as you use the product, and ad-account data you authorize us to fetch via OAuth from supported platforms. When you sign up we also record sign-up source and device information: the campaign parameters of the link you arrived from (utm_source, utm_medium, utm_campaign, utm_content, utm_term, utm_id), advertising click identifiers (fbclid, gclid, msclkid, ttclid, li_fat_id, twclid, gbraid, wbraid), the referring site and the page you first landed on, the browser user agent (device type, operating system, browser and version), screen size, timezone and language, and an approximate location (country, region, city) that our hosting provider derives from your IP address at request time. This is also recorded for sign-up attempts that are not completed, together with the email address entered. We do not store your IP address with this sign-up and device information. Separately, we record the IP address and browser of each sign-in session to protect your account, and delete those records within 7 days after the session ends (sessions last up to 30 days). We do not collect payment card numbers directly; payment processing is handled by our payments provider.
3. How we use data
We use the data we collect to operate the service, authenticate you into your workspace, sync metrics from connected ad platforms, generate AI suggestions, send transactional email, prevent abuse, and improve the product. We use sign-up source and device information to measure which campaigns and channels bring sign-ups and where onboarding stalls; it is not used to build advertising profiles. We do not sell personal data and we do not train third-party foundation models on customer ad data.
4. Google user data and Limited Use
When you connect a Google account, we request only the scopes that support the features you have enabled, and we want you to know exactly what each one is. For Google Ads, we request the Google Ads API scope; Google defines it as a management scope, but today we use it solely to read your ad account, campaign, and performance data, and any future features that change your Google Ads account will be off by default and clearly presented to you before anything is written. Where you enable Search Console reporting, we request read-only access to your Search Console performance data. If you connect a Gmail mailbox for CRM email, we ask Google for read and send access to that mailbox plus your email address, and we store only the resulting refresh token, encrypted; message syncing is not built yet, so no mail is read today. We do not request access to your Drive, Contacts, Calendar, or Photos. overads' use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, this means we use Google user data only to provide and improve the reporting, analytics, and recommendation features you asked for; we do not use it for advertising, we do not sell it, and we do not transfer it to third parties except as necessary to provide the service, to comply with applicable law, or as part of a merger or acquisition with notice to you. No human at overads reads your Google user data except with your explicit consent for a specific support request, where it is necessary for security purposes such as investigating abuse, or where the law requires it. You can disconnect a Google account at any time from Settings, which revokes our stored access and refresh tokens; you can also revoke our access directly from your Google Account permissions page.
5. Meta data: Facebook, Instagram, Threads and WhatsApp
When you connect a Meta account, Meta shows you each permission overads asks for, and we use each one only for the feature it names. Facebook Pages: with pages_show_list, pages_read_engagement and pages_manage_posts we list the Pages you choose and publish the posts you approve to them; with pages_read_user_content and pages_manage_engagement we show the comments on your Page's posts on the Engagement page and carry out the replies, likes, hides and deletions you make there; with read_insights we show your Page's and posts' reach, impressions, engagement and follower numbers. Comments and Page insights are read from Meta when you open that page and are not stored by overads. Instagram: with the Instagram permissions we read the professional account's name, picture and id, and publish the posts you approve to it. Threads: with threads_basic we read your Threads profile name, picture and id to show which account is connected, and with threads_content_publish we publish the posts you approve to it. Meta ads: with ads_read and business_management we read the ad accounts you select and their campaigns, ad sets, ads and daily performance, and keep that history so reports and suggestions can compare periods. With ads_management, overads changes your Meta ads (pausing or resuming, budgets, new ads from the Ad Launcher and new audiences) only when a person in your workspace confirms the change, or when a workspace admin has set an automation rule that may apply it within limits they chose; each change is recorded in your workspace's audit log. Competitors: when you follow other advertisers, we read their public ads from Meta's Ad Library. WhatsApp: if you link your own number to approve work from WhatsApp, we store the number and a record of each approval request and notice we send to it. For every connection we store Meta's access token, encrypted as described in section 6, with the account's id, name and picture. We use Meta data only to provide the features you use: we do not sell it, use it to build advertising profiles, or share it with anyone except the subprocessors that run those features. When you ask the overads assistant about your ads, Pages or comments, the data it needs to answer is processed by our AI inference subprocessors. Disconnecting an account in Settings deletes its stored token from overads. To also remove overads' access on Meta's side, remove overads under Business integrations in your Facebook settings, or under Website permissions in your Threads settings; when you remove overads from Threads, Meta tells us and we delete that connection. Deleting your overads account also asks Meta to revoke our access to your ad accounts.
6. Data protection and security
We treat OAuth credentials and connected-platform data as sensitive, and protect them with specific technical controls rather than general assurances. Encryption in transit: all traffic to overads is served over HTTPS, and we set HTTP Strict Transport Security with a one-year max-age so browsers refuse to connect over plaintext. Encryption at rest: OAuth access and refresh tokens for every connected platform, including Google, are encrypted before they are written to the database using envelope encryption backed by a managed key service. Each ciphertext is bound to your workspace through an encryption context enforced by the key service, so a token belonging to one workspace cannot be decrypted in the context of another, even by someone holding database access. Production refuses to start without a configured encryption key, so plaintext credential storage is not a state the service can reach. Credential handling: we never log access tokens, refresh tokens, or passwords. Account passwords are stored only as bcrypt hashes, and password-reset and session tokens are stored only as SHA-256 hashes, so the stored value cannot be replayed. Access control: every request that touches workspace data is authenticated and authorized against your membership of that workspace before any query runs, roles limit what each member can do, and multi-factor authentication is available on your account. Administrative and security-relevant events are recorded to an audit log. We apply hardened HTTP security headers, including a restrictive content security policy, across the application. Deletion: see the retention section below, and the data deletion page for how to request erasure. No system is perfectly secure, and we do not claim otherwise, but if we become aware of a breach affecting your personal data we will notify affected customers and any required regulators without undue delay.
9. Your rights
Depending on where you live, you may have rights to access, correct, export, or delete the personal data we hold about you. You can exercise most of these rights from inside the product Settings. For anything else, write to privacy@overads.io and we will respond within thirty days.
10. GDPR (EEA, UK, Switzerland)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process personal data on the legal bases of contract performance, legitimate interest, and consent where applicable. We record sign-up source and device information on the basis of our legitimate interest in first-party measurement of our own marketing and onboarding; the attribution cookie is not set if you reject cookies. We offer a Data Processing Agreement that incorporates the relevant Standard Contractual Clauses for international transfers.
11. CCPA (California)
If you are a California resident, you have specific rights under the California Consumer Privacy Act including the right to know what personal information we collect, the right to delete personal information, and the right to opt out of any sale of personal information. We do not sell personal information.
12. Data retention
We retain personal data and ad-platform data, including the encrypted credentials of the platforms you connected, for as long as your workspace exists, including while it is paused because a trial ended, a subscription ended or a payment failed. Nothing is deleted when a workspace pauses: its data is kept until you delete the workspace or your account. Sign-up source and device details are kept with your account and deleted with it. When a sign-up is not completed, the password hash entered for it is deleted within a day, and the attempt itself, with its email address and sign-up source and device information, is deleted 90 days after the last attempt. Deletion is immediate rather than staged: when you delete your account or a workspace, those records are removed from our primary database as part of that request. There is no soft-delete window and no restore path, so if you need a copy of anything, ask hello@overads.io before you delete. Encrypted backups age out within ninety days. The data deletion page sets out exactly what is removed, and the few things that fall outside it.
13. AI assistant connections
You can connect an AI assistant, such as ChatGPT or Claude, to an overads workspace through our MCP server, either by signing in to overads from the assistant and approving the connection, or with an API key you create. Only a workspace owner or admin can approve a connection or create a key, and only for a workspace on a plan that includes it. Each connection is limited to the one workspace and the permissions approved on the approval screen, and can use only the overads functions those permissions allow: reading connected social accounts and whether they still work, posts and where they were delivered, workflows and their runs, and ad results and landing-page scans already in overads, and, where approved, creating, editing, scheduling, cancelling and publishing posts, uploading media and running saved workflows. A connection cannot reach other workspaces, your overads password, or the credentials of the platforms you connected. From the assistant we receive only the requests it makes to overads and their contents, such as post text, media links, schedule times and questions for the overads assistant; we do not request or receive your conversation history with the assistant. We use these requests only to carry them out, as described in this policy: a post is sent to the social networks you chose when it publishes, and a question for the overads assistant is processed by our AI inference subprocessors in the same way as a question asked in the app. When the assistant marks a request as safe to retry, its result is kept for 24 hours so a retry does not repeat the action. For each signed-in connection we keep the app's name and return address, the workspace, the approved permissions, who approved it, and when it was created and last used. The access and refresh tokens we issue to the assistant are stored only as keyed hashes, never in a readable form; access tokens expire after one hour and refresh tokens are replaced each time they are used. Approving and ending a connection are recorded in the audit log. You can disconnect an app at any time in Settings > API keys and MCP > Connected apps, and it stops working on its next request. Changing or resetting your password, or signing out everywhere, disconnects every app you connected; leaving a workspace ends the connections you made in it; and a connection unused for 90 days ends on its own. The stored record of an ended connection is deleted 90 days after it ends; the audit log entries stay part of the workspace's audit history. Whatever overads returns to the assistant is then held and processed by the assistant's provider under its own terms and privacy policy, which we do not control; please review them before you connect.
14. Contact
Questions about this policy or our data practices can be sent to privacy@overads.io. For formal data protection inquiries from the EEA or UK, write to the same address with the subject prefix 'GDPR request'.