App Privacy Policy

§1. General provisions

The data controller is Mateusz Popławski, a sole trader operating under the business name MatPop Digital Mateusz Popławski, business address: Rydygiera 18/17, 01-793 Warsaw, Poland, registered in CEIDG (the Polish Central Register of Business Activity), tax ID (NIP): 9492207271 (the “Controller”, “we”). For any matter related to personal data protection, you can contact us at: [email protected].

“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

This policy covers only the Mateusz Popławski application, which we use to manage Google Ads advertising accounts. The rules for the mateuszpoplawski.pl website, its forms, newsletter and cookies are described in a separate Privacy Policy.

§2. What this application is

Mateusz Popławski is a tool for the internal management of Google Ads advertising accounts: our own accounts and the accounts of clients who have granted us access. The application runs locally, on our computers. It is not a web service, it has no sign-up, we do not make it available to anyone outside our business, and it has no users other than us.

The application connects to Google APIs directly from our computer, using our own credentials and within our own Google Cloud project. We do not use any intermediary that would send requests to Google on behalf of multiple parties.

§3. What data from Google services we process

The application primarily uses Google Ads data from the accounts we have access to. This includes information about account structure and settings, such as campaigns, ad groups, ads, keywords, negative keywords, targeting settings and budgets, as well as campaign performance data, including impressions, clicks, costs, conversions and conversion value. The application also makes changes to these accounts, in line with the work we carry out on them.

Depending on the task, the application may also use other Google services:

• Google Analytics 4: traffic and conversion data and reports for the associated websites.
• Google Merchant Center: product data, including product statuses and prices.
• Google Sheets and Google Drive: access to selected files in order to import and export information used in campaign management.
• Google Tag Manager: access to container configuration in order to make the changes we are commissioned to make.

Access to these services is optional and requires the appropriate permissions. The full scope of permissions is shown on the Google consent screen when the application is authorised.

What the application does not collect

The application does not collect personal data of the advertiser’s end customers, contact details from forms, or email content. Nor does it collect audience lists or remarketing data that could identify specific individuals.

§4. Purposes and legal bases

Data from Google services is used solely to run and optimise advertising campaigns on the accounts we have access to: performance analysis, diagnostics, preparing recommendations and reports, and making changes to campaigns. We do not use it for any other purpose; in particular, we do not profile individuals based on it and we do not build marketing databases from it.

The legal basis for processing is:

• necessity for the performance of a contract to run advertising campaigns (Article 6(1)(b) GDPR),
• our legitimate interest in security and in establishing or defending legal claims (Article 6(1)(f) GDPR).

§5. Access credentials

Authorisation takes place via OAuth 2.0. The client ID, client secret, refresh token and developer token are stored only in a configuration directory on our computer and are not sent anywhere other than to Google services. The application never asks for, and never receives, a Google account password. Only persons authorised by us have access to the computers on which the application runs.

§6. Where data is stored

Downloaded data is stored on our computers: in a local query cache, in account configuration files, and in reports and summaries saved to disk.

To prepare analyses and recommendations, we use an assistant based on a large language model, to which we pass only the data needed for a given analysis; we never pass it access credentials. We do not use data from Google services to train or improve generalised artificial intelligence models.

We apply appropriate organisational and technical measures, including access control to our devices, to protect this data against unauthorised access.

§7. Data recipients

We do not sell, rent or share data obtained from Google services with third parties for marketing purposes. We do not use any intermediary that would send requests to Google on behalf of multiple parties. Data concerning a client’s account is shared with that client in the form of reports and summaries, because it relates to their account. Data may also be disclosed to parties authorised to receive it under the law.

§8. Data retention

We keep data obtained from Google services for as long as our work on the given advertising account continues, and delete it, together with the application’s local files, once that work ends. Reports delivered to a client remain at the client’s disposal.

§9. Revoking access

The owner of a Google account can revoke the application’s access at any time at https://myaccount.google.com/permissions. Once access is revoked, the application can no longer retrieve data from, or make changes to, that account.

§10. Rights of data subjects

To the extent that the processed data constitutes personal data, you have the right to access it, to have it rectified or erased, to restrict its processing, to object, to data portability, and to lodge a complaint with the supervisory authority (the President of the Polish Personal Data Protection Office, UODO). Requests can be sent to [email protected].

§11. Compliance with Google policies

This application’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

§12. Changes to this privacy policy

We reserve the right to amend this policy where required by law, by a change in the scope of permissions the application requests, or by a change in how it works. The current version is always available at https://mateuszpoplawski.pl/en/app-privacy-policy, and its effective date is shown in the header.

§13. Contact

MatPop Digital Mateusz Popławski, tax ID (NIP): 9492207271, email: [email protected]