Privacy Policy

This Privacy Policy explains how MW Marketing Partners LLC (“GodAds”, “we”, “our”, or “us”) collects, uses, shares, and protects personal data when you use the GodAds platform, including the marketing website at god-ads.com and the application at my.god-ads.com(together, the “Service”).

By using the Service you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Who we are

GodAds is a Software-as-a-Service platform that helps marketing agencies manage Facebook / Meta and Google advertising campaigns on behalf of their clients. The data controller is:

MW Marketing Partners LLC
30 N Gould St #45421
Sheridan, WY 82801
United States of America
Email for privacy requests: mwmarketingpartners@outlook.it
Email for general support: hello@god-ads.com

2. Data we collect

2.1 Account data

When you create a GodAds account we collect the agency name you provide, the email address you register with, and a secure one-way hash (bcrypt) of your password. We never store or see your plain-text password.

2.2 Billing data

Subscription payments are processed by Stripe, Inc. We do not see or store your full card number. We only retain the last 4 digits, card brand, and Stripe customer / subscription identifiers needed to operate your account. Stripe may also collect your billing address and VAT / tax identifier at checkout.

2.3 Integration tokens

If you connect a Facebook / Meta, Google Ads, or GoHighLevel account, we store OAuth access and refresh tokens in encrypted form. These tokens are only used to call the respective APIs on your behalf. They can be revoked at any time from Settings.

2.4 Campaign and client data

While using the Service you may upload or create: client records (name, email, phone), media files (images and videos), ad copy, audience definitions, and campaign configurations. This content is stored on our infrastructure and is only accessible to your agency (and to us as described below).

2.5 Leads

When a person submits a Meta (Facebook / Instagram) instant form or a Google Ads lead form on one of your campaigns, the platform sends us the submitted data (typically name, email, phone, and any custom questions; for Google also the ad click identifier). We store these leads in our database and can forward them to your GoHighLevel CRM if connected. Individual leads are personal data of the submitters — agencies are the data controllers for these leads and must have their own privacy notice in place.

2.6 AI prompts and outputs

If you use the AI Creator, the business information and prompts you provide are sent to OpenAI for text and image-prompt generation. Per the OpenAI API Terms of Use, OpenAI does not train on data submitted through the API. We keep a copy of prompts and outputs so you can view and reuse generations.

2.7 Usage data and logs

We automatically collect limited technical data: IP address, browser user-agent, approximate geolocation (city-level, from IP), device and operating system, pages visited, errors, and timestamps. This data is used to keep the Service secure and working. If you consent to analytics cookies, we also receive aggregated usage data via Vercel Analytics and Google Analytics 4 (see the Cookie Policy).

2.8 Cookies

See our Cookie Policy for the full list of cookies used and how to manage them.

2.9 Conversion tracking for your clients

If you turn on conversion tracking for one of your clients, we process the following on your behalf, as your data processor (see Section 12):

• What we collect: the contact details a person leaves in a form (name, email, phone), the ad click identifiers (Google gclid, gbraid, wbraid; Meta fbclid, fbc, fbp), the page address, the IP address and the browser user-agent of the submission.
• Where it comes from: the GodAds script installed on your client's website, the contacts of your client's connected GoHighLevel location, and the Meta and Google lead forms of your campaigns.
• Who receives it: conversion events are sent to your client's Google Ads account (Google Data Manager API) and to the Meta dataset you configured (Meta Conversions API). Email and phone are hashed with SHA-256 before they leave our systems; click identifiers, IP address and user-agent are sent as the platforms require to match a conversion to an ad click.
• Consent on the website: by default the script starts only after the visitor accepts cookies on that website (through its cookie banner, Google consent mode, or a call from the site). If you set it to start on every visit, collecting consent is the responsibility of the website owner.
• How long we keep it: these records are kept with your client's leads and conversion history until you delete them or your account is terminated (see Section 7).

3. How we use data

• To provide, operate, and maintain the Service (performance of contract).
• To process subscription billing and wallet top-ups (performance of contract).
• To send transactional emails: welcome, password reset, trial reminders, payment failures, performance reports you configured, token-expiry warnings, and security notices (performance of contract + legitimate interest).
• To provide customer support when you contact us (performance of contract).
• To prevent, detect, and respond to fraud, abuse, security incidents, and policy violations (legitimate interest + legal obligation).
• To measure aggregate usage and improve the Service, only if you have consented to analytics cookies (consent).
• To measure the effectiveness of our own advertising on Meta and Google, only if you have consented to marketing cookies (consent).
• To comply with U.S. tax, accounting, and other legal obligations (legal obligation).

We do not sell personal data. We do not use your account, client, or lead data to train any machine-learning model.

4. Legal basis under the GDPR

If you are in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on one of the following legal bases:

• Contract (Art. 6(1)(b) GDPR): to provide the Service you signed up for.
• Legitimate interest (Art. 6(1)(f) GDPR): to keep the Service secure, prevent abuse, and operate the business.
• Consent (Art. 6(1)(a) GDPR): for optional cookies and marketing communications. You can withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c) GDPR): for tax, accounting, and anti-fraud obligations.

5. Who we share data with (subprocessors)

We use the following subprocessors to deliver the Service. All of them are contractually bound to protect your data and to process it only on our documented instructions.

Opt-in tracking. Meta Pixel, Google Analytics 4, and Vercel Analytics are only loaded after you accept the relevant cookie category in our cookie banner. Before your choice, no analytics or marketing scripts run.

We may also disclose personal data if required by law, valid legal process, or to protect the rights, property, or safety of GodAds, our users, or the public. In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to this Privacy Policy.

6. International data transfers

GodAds is operated from the United States. If you are located in the EEA, UK, or Switzerland, your personal data will be transferred to and processed in the United States and other countries where our subprocessors operate. Where required, these transfers are covered by the European Commission's Standard Contractual Clauses (Module 2 or 3) and/or the EU–U.S. Data Privacy Framework where the subprocessor is certified. Supplementary measures (encryption at rest and in transit, access controls) are applied to mitigate transfer risks.

7. How long we keep data

• Account data: for as long as your account is active, plus up to 30 days after cancellation, after which it is permanently deleted except as noted below.
• Billing records (invoices, Stripe transaction metadata): at least 7 years, to comply with U.S. tax and accounting obligations.
• Audit logs: up to 2 years.
• Encrypted backups: up to 90 days, after which they are overwritten.
• Leads collected on your behalf: retained until you delete them or your account is terminated.
• Conversion-tracking records (the data listed in Section 2.9 and the outcome of each upload to Google and Meta): retained like leads, until you delete them or your account is terminated.
• Support emails: up to 24 months after the last interaction.

8. Your rights (EEA / UK / Switzerland)

Under the GDPR and equivalent laws you have the right to:

• access the personal data we hold about you,
• have inaccurate data corrected,
• have your data erased (“right to be forgotten”) in certain cases,
• restrict or object to certain processing,
• receive your data in a structured, machine-readable format (portability),
• withdraw any consent you previously gave,
• lodge a complaint with a supervisory authority in your country of residence or place of work.

To exercise any of these rights, email us at mwmarketingpartners@outlook.it. We will respond within 30 days. We may ask for reasonable information to verify your identity before acting on a request.

9. Your rights under California law (CCPA / CPRA)

If you are a California resident, you have the right to:

• know what categories of personal information we collect, why, and with whom we share it,
• request a copy of the specific pieces of personal information we hold about you,
• request deletion of your personal information (subject to legal exceptions),
• request correction of inaccurate personal information,
• opt out of the “sale” or “sharing” of personal information,
• not be discriminated against for exercising your rights.

We do not sell personal information for monetary consideration. When marketing cookies are enabled, limited pseudonymous data (cookie identifiers, IP) may be “shared” with Meta and Google for cross-context advertising on our marketing site — you can opt out at any time using our cookie banner or the “Cookie preferences” link in the footer. California residents can also email us at mwmarketingpartners@outlook.it to exercise their rights. We will not discriminate against you for exercising them.

10. Children

The Service is not directed to individuals under 18, and we do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, contact us and we will delete it promptly.

11. Security

We take security seriously. We encrypt data in transit (TLS 1.2+) and at rest where supported by the underlying provider, enforce strong password hashing (bcrypt with a per-user salt), apply role-based access controls, maintain audit logs, and limit employee access on a need-to-know basis. We will notify affected users and the relevant supervisory authorities of personal-data breaches within the timeframes required by applicable law (72 hours under the GDPR).

12. Agencies as data controllers for their clients' data

When you (an agency) upload client information, campaign data, or receive leads on behalf of your clients, you act as the data controller of that personal data and GodAds acts as a data processor on your instructions. You are responsible for having a lawful basis, a privacy notice, and, where applicable, data-processing agreements with your own clients. For conversion tracking this includes informing the visitors of your client's website, the cookie / consent banner on that website, and the lawful basis for sharing conversion data with Meta and Google. A Data Processing Addendum is available on request from mwmarketingpartners@outlook.it.

13. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email at least 30 days in advance and display a notice inside the app. The “Last updated” date at the top of this page reflects the latest revision. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14. Contact

If you have any questions about this Privacy Policy or how we handle your data, contact us at mwmarketingpartners@outlook.it.