AdVizion AI, Inc. (“AdVizion”, “we”, “us”) operates the AdVizion platform at advizion.ai. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our services.

1. Information We Collect

We collect the following categories of information:

Account information: name, email address, and authentication credentials provided through Amazon Cognito when you sign up.
Content you upload: images, videos, and audio files you submit for analysis. These are stored in AWS S3 and associated with your account.
Usage data: pages visited, features used, credits consumed, timestamps, and browser or device information.
Payment information: Stripe handles all payment card data on our behalf. We only receive a payment status and a customer reference; we never store raw card numbers.
Google Ads connection: only if you explicitly connect Google Ads, as described in the Google Ads Integration section below.

2. How We Use Your Information

To operate, maintain, and improve the AdVizion platform.
To run AI analyses on your uploaded media (attention heatmap, emotion prediction, brand attention, customer intent, and transcription).
To generate AI-powered coach reports, decision reports, and improved ad variants using AdVizion's proprietary models.
To process payments and manage your credit balance through Stripe.
To send product updates and account notifications (you may opt out at any time).
To detect, prevent, and respond to fraud, abuse, or security incidents.
If you connect Google Ads, to list accessible Ads accounts, attach performance to your AdVizion projects, and (only when you explicitly confirm) create paused draft campaigns.

3. Google Ads Integration

Connecting Google Ads is optional and is initiated only when you click Connect Google Ads in Settings → Integrations. AdVizion then sends you to Google OAuth to authorize the connection. The OAuth scope requested is https://www.googleapis.com/auth/adwords (Google Ads API). App sign-in with Google through Amazon Cognito is a separate login integration and is not the Google Ads connection.

When you authorize the connection, AdVizion may access:

Account and customer identifiers: Google Ads customer resource names and customer IDs returned by listAccessibleCustomers, plus account metadata such as descriptive name, currency, time zone, whether the account is a manager account, and whether it is a test account.
Campaign information: campaign IDs, names, and status for campaigns you select or that AdVizion created as paused drafts.
Creative, ad, and asset metadata: ad and asset resource names, headlines, descriptions, YouTube video asset IDs, and related ad-group metadata needed to show what is attached to a draft or existing campaign.
Performance and reporting: impressions, clicks, cost, conversions, conversion value, and derived rates (CTR, CPC, cost per conversion) for connected campaigns, used to attach results to your Project, Campaign, Creative/version, and Decision Report records.

Write operations. AdVizion does not automatically activate campaigns or start spend. The only Google Ads write operations AdVizion performs are ones you start and confirm: registering a YouTube video as an asset and creating a paused draft campaign, ad group, and ad; or pausing a campaign AdVizion previously created. Activation and spend changes must be completed in Google Ads. Material writes are confirmed in the product and recorded in an audit event with the Google Ads request ID when Google returns one.

Credentials and storage. After you authorize Google, AdVizion exchanges the authorization code on the server and stores the OAuth refresh token. The refresh token is encrypted with a server-side key and stored in AWS DynamoDB (the UserMetadata table), associated with your AdVizion user ID. Access tokens are obtained from the refresh token when the server calls Google Ads APIs; they are not shown in the browser. Connection metadata (status, selected customer ID, optional manager/login customer ID, accessible account list, last validation time) is stored in the same DynamoDB record. Historical AdVizion campaign and report rows are stored in DynamoDB and related media in AWS S3. These stores run in AdVizion's AWS account (ECS application servers, DynamoDB, S3).

Retention. Encrypted Google Ads credentials and connection metadata are kept while the Google Ads connection is active on your account. After you disconnect, stored refresh tokens are revoked with Google when possible and deleted from AdVizion. Historical AdVizion campaign, report, and performance snapshots you already generated are retained with your account unless you delete those records or your account. Upon account deletion we remove personal data within 30 days, except where retention is required by law.

Disconnect. You can disconnect Google Ads from Settings → Integrations. Disconnect revokes and deletes the stored Google OAuth refresh token, clears the active connection, and records an audit event. It does not delete campaigns, ads, or data in your Google Ads account. Historical AdVizion Decision Reports and performance records remain unless you delete them separately.

Deletion requests. You can disconnect Google Ads yourself, delete individual project items in the product, or request account and Google Ads connection deletion at privacy@advizion.net.

Service providers and sale. Google Ads OAuth and API traffic is sent to Google to operate the connection you authorized. Connection metadata and encrypted tokens are stored on AWS. We do not sell Google user data or other personal data. We do not share Google Ads data with other advertising platforms or unrelated vendors.

AI and machine learning. Google Ads account, campaign, creative metadata, and performance figures are used to operate your AdVizion workspace: showing connection status, attaching performance to your projects, and producing during-campaign decision suggestions for you. AdVizion does not use Google Ads user data to train generalized AI or ML models for other customers. Uploaded creatives (images, video, audio) are analyzed by AdVizion's own models to produce Decision Reports; that analysis is of media you upload, not of Google Ads API payloads used as training data.

AdVizion's use of Google user data from the Google Ads API complies with Google's API Services User Data Policy, including the Limited Use requirements: that data is used to provide or improve user-facing features of AdVizion that you can interact with, is not transferred except as needed to provide those features or as required by law, and is not used for serving ads, including retargeting, personalized or interest-based advertising, or advertising measurement independent of the Google Ads reporting you asked AdVizion to display.

4. Security and Data Protection for Google User Data

This section describes the specific mechanisms AdVizion uses to protect Google user data obtained through the Google Ads API (OAuth scope https://www.googleapis.com/auth/adwords). Each statement below reflects controls that are implemented in the AdVizion application and its AWS infrastructure today.

Encryption in transit. All Google OAuth and Google Ads API traffic between AdVizion's servers and Google is transmitted over HTTPS/TLS. Traffic between your browser and advizion.ai is served over HTTPS.
OAuth handling. The OAuth authorization flow uses a single-use, server-issued state value that expires after 10 minutes, plus PKCE (RFC 7636, S256). Google's authorization code is exchanged for tokens on AdVizion's server only; it is consumed once and is never exchanged by the browser. The OAuth client secret and the Google Ads developer token exist only as server-side secrets in AWS Secrets Manager and are never sent to the browser. Access tokens and refresh tokens are never displayed in the user interface, returned by any AdVizion API response, or stored in the browser.
Encryption at rest. Google Ads refresh tokens are encrypted by the application before storage using symmetric authenticated encryption (Fernet, AES-128-CBC with HMAC-SHA256) with a key held in AWS Secrets Manager; only the ciphertext is written to the database, and a legacy plaintext token is re-encrypted the first time it is read. The encrypted token, connection metadata, Google Ads account and campaign identifiers, deploy records, and performance snapshots are stored in Amazon DynamoDB, which encrypts all table data at rest using AWS-owned keys. Related media and report files are stored in Amazon S3 buckets configured with default server-side encryption (SSE-S3, AES-256). Server-side secrets are stored in AWS Secrets Manager, which encrypts them at rest with AWS KMS.
Access controls. Google Ads data is available only to authenticated AdVizion users acting within the account that connected Google Ads. Every Google Ads record is stored under the connecting user's identifier, and every API request is authorized against the authenticated caller, so one customer cannot read, select, or act on another customer's Google Ads connection, accounts, campaigns, or metrics. Backend services run under an AWS IAM task role scoped to the specific DynamoDB tables, S3 prefixes, and secrets they need. Production infrastructure access is limited to authorized AdVizion personnel who require it for security, support, or legal purposes.
Secrets and logging. AdVizion installs a log-redaction filter on its application and HTTP access loggers that replaces OAuth authorization codes, state values, access tokens, refresh tokens, ID tokens, client secrets, developer tokens, and bearer credentials with [REDACTED] before any log line is written. OAuth error handling logs only an error category and hostnames, never the exchanged code or token. Google Ads API failures are logged with the operation name, an error code category, Google's request ID, and a correlation ID so they can be investigated without recording credentials.
Data isolation. Google Ads information is stored and processed only in association with the AdVizion user and workspace that connected the account. It is not aggregated across customers, exposed to other tenants, or used to build shared datasets.
Monitoring and incident response. Application and HTTP request logs are written to Amazon CloudWatch Logs with per-request correlation IDs. Every Google Ads connection change and every write to your Google Ads account (asset registration, paused campaign creation, campaign pause, and any failed write) is recorded in an append-only audit trail visible to you on the Audit trail page, including the action, the acting user, the timestamp, the customer ID, the campaign ID, and Google's request ID when Google returned one. Security-relevant product events are also surfaced to AdVizion's account owner through an activity feed. AWS account activity is available through AWS CloudTrail event history. If we determine that Google user data has been accessed without authorization, we will investigate, contain the incident, revoke affected credentials, and notify affected users and, where required, regulators or Google, in accordance with applicable law.
Retention and deletion. Encrypted Google Ads credentials and connection metadata are kept only while the connection is active. When you disconnect, AdVizion requests revocation of the grant from Google and deletes the stored refresh token; the user interface then shows the connection as disconnected with the token deleted. Disconnecting does not modify, pause, or delete any campaign, ad, or data inside your Google Ads account. Historical AdVizion deploy records, Decision Reports, and performance snapshots remain in your account until you delete them or your account. Upon account deletion we remove personal data within 30 days, except where retention is required by law.
Limited Use. Google Ads data is used only to provide prominent, user-facing AdVizion features: showing your connection and account list, attaching campaign and performance data to your projects and Decision Reports, creating paused draft campaigns you explicitly confirm, and pausing campaigns AdVizion created. It is not sold. It is not used for personalized or interest-based advertising, retargeting, credit or lending decisions, data brokerage, or training generalized AI or machine learning models. Humans at AdVizion do not read Google user data except with your explicit consent, when necessary for security or to support a request you made, or when required by law.

5. Data Sharing and Disclosure

We do not sell your personal data. We share data only with the following service providers:

AWS (Amazon Web Services): cloud hosting (ECS), S3 object storage, DynamoDB, and Amazon Cognito authentication.
AdVizion AI infrastructure: AI image and video generation and analysis. Media you upload may be processed by AdVizion's model infrastructure.
Stripe: payment processing.
Google: Google OAuth and the Google Ads API for the optional Google Ads connection described above.

We may also disclose data when required by law or to protect the rights and safety of AdVizion and its users.

6. Data Retention

We retain uploaded media and analysis results for as long as your account is active. You may delete individual items from your project at any time. Google Ads credentials are retained only while the connection is active, as described above. Upon account deletion we remove your personal data within 30 days, except where retention is required by law.

7. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your data. To exercise any of these rights, contact us at privacy@advizion.net.

8. Cookies and Tracking

AdVizion uses session cookies for authentication and analytics cookies to understand how users navigate the product. You may disable cookies in your browser, but this may affect functionality.

9. Children's Privacy

AdVizion is not intended for users under 16 years of age. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version here and update the “Last updated” date above.

11. Contact Us

If you have questions about this policy, contact privacy@advizion.net.