Who we are

FineCompass is a tool that runs Google Ads campaigns for businesses. You connect your Google Ads account, it reads what is happening in it, works out which searches bring you real customers, and proposes changes. You approve them, or you do not.

If you want to ask us anything in this document, write to support@finecompass.com and a person will answer.

What we collect

Three kinds of thing, and nothing else:

• Who you are. Your email address and your name, from the Google account you sign in with. We do not ask for a password and we never see one. We do not keep your profile picture.
• What is in your Google Ads account. Your campaigns, ad groups, keywords, adverts, the searches people typed, what each one cost, and what came of it. This is a copy of your own data, read through Google’s official API. The full list is under “Data minimisation” below.
• What happens on your website, if you add our tracking line to it. When somebody taps your phone number, your WhatsApp button, your email link, or sends your contact form, we record that it happened and which advert brought them. We record the fact of the enquiry and the page it happened on. We do not record what anybody typed into your form.

Your Google Ads account, and exactly what we ask for

We connect to Google Ads through Google’s own OAuth, which means you grant permission on Google’s screen and we never handle your Google password. There are two separate steps and they ask for different things.

Signing in. We ask for:

• openid, email and profile — so we know which account is yours when you come back. Google shows this as your name, profile picture and email address. We keep your email address and your name, use them to identify you and to write to you about your own account, and keep nothing else from this step.

Connecting your advertising. A second, separate permission, which you grant later:

• https://www.googleapis.com/auth/adwords — to read your Google Ads account and to make the changes you approve. This is the only scope that touches your advertising, and it is the narrowest one Google offers for the job: there is no read-only version of it. We ask for it because the product cannot do anything without reading your campaigns, and because applying a change you have approved is the point of the product.

We do not ask for your Gmail, your Drive, your contacts, your calendar, or anything else. If a future feature needed another permission we would ask you for it then, on Google’s own screen, and you could say no and keep using everything else.

FineCompass's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

What we do with it

• Work out which searches bring you customers and which waste your money.
• Propose changes to your campaigns, with the reasoning, for you to approve or refuse.
• Make the changes you approved, and record what was done so it can be undone.
• Write to you when something needs your answer, or when a night found something worth reading.

Google user data is never used to train AI models — not ours, not anybody else’s. We do not use your data to build a profile of you, or to work out anything about your competitors. Your campaign data is used for your campaigns.

Data protection mechanisms for sensitive data

Encryption in transit. Every connection that carries your data is encrypted. FineCompass is served only over HTTPS, using TLS 1.3; a plain HTTP request is redirected to HTTPS, and browsers are told to use HTTPS only from then on. Our servers reach the database through Google Cloud SQL’s encrypted connector, and the database refuses any connection that is not encrypted. Our calls to Google’s APIs and to OpenAI are made over HTTPS.

Encryption at rest. The database, the disks it runs on and its backups are encrypted at rest by Google Cloud using AES-256.

Google OAuth tokens. When you connect Google Ads, Google gives us a refresh token. We encrypt it with AES-256-GCM before it is stored, with a key kept in Google Secret Manager, and the only thing allowed to read that key is FineCompass’s own server, running under its own Google Cloud service account. The short-lived access tokens made from it are created in memory when needed and never stored. Tokens are never sent to your browser or shown to you or anyone else, are not written to our logs, and are left out of the data export. Signing in to FineCompass stores no Google token at all: your session is an encrypted cookie that says who you are.

Access control. Each customer’s data is fenced off from every other customer’s by row-level security enforced inside the database itself, and every request is checked against your account membership before it is answered. You can only ever see the Google Ads accounts you connected; other customers and anonymous visitors cannot reach them. On the Google Cloud side, the only person with access to the project is FineCompass’s owner, and the service runs under a dedicated service account with only what it needs: to connect to the database, read its own secrets and write logs.

Data minimisation. From Google Ads we read only what the product uses: your campaigns, ad groups, keywords and negative keywords, adverts and their extensions, location targets, conversion actions, daily performance figures, the search terms that triggered your adverts, performance by location (as totals, never by person), your account’s name, currency and time zone, and its change history (what was changed, when, and by which Google user). We do not read billing, payment details or invoices, the list of people with access to your account, your audience or customer lists, or anything that identifies an individual person who searched.

Retention and deletion. We keep your Google Ads data while your FineCompass account is open, because your history is what lets the product tell a real change from noise. If you disconnect Google Ads in Settings, we delete the stored token at once and stop reading your account; to remove FineCompass’s access on Google’s side as well, remove it at myaccount.google.com/permissions. The copy of your data we already hold stays until you close your account or ask us to delete it. When you close your account, everything we hold — your Google Ads data, the token, your website enquiries — is deleted from the live database immediately, and it is gone from our encrypted backups within 7 days, as they roll over. Our server logs are kept for 30 days.

AI processing. Some of the reasoning is done by OpenAI’s models, through OpenAI’s API: to understand what your business sells, to judge what a search means, to write advert text, and to explain a decision. For that, OpenAI receives only the parts the task needs, such as your website’s text and the search terms, keywords, adverts and campaign figures in question. Under OpenAI’s API terms, this data is not used to train OpenAI’s models, and OpenAI keeps it for no more than 30 days, for abuse monitoring, before deleting it.

Incident response. If we find a breach that affects your data, we act at once to contain it — cutting off access and replacing the encryption key if tokens could be involved — and work out what happened and which data was exposed. We tell the affected customers by email without undue delay, and within 72 hours of finding out: what happened, what data was involved, and what we are doing about it. Where Google user data is involved we also tell Google, and we tell the authorities wherever the law requires it.

Who we share Google user data with

Two companies process it on our behalf, under contract, and nobody else:

• Google Cloud, which hosts our servers and our database, in the United States.
• OpenAI, which processes the parts described under “AI processing” above when the engine is reasoning about your account.

We never sell Google user data, and we never use it for advertising. We transfer it only to provide the service to you, for security, or when the law requires it. We never share one customer’s data with another customer, and we never hand it to anyone for their own purposes.

Where it is kept

Everything lives in a Google Cloud database in the United States, encrypted as described above. Each business’s data is walled off from every other business’s inside the database itself, not merely by the application asking nicely — see the security page for how that works.

How to take it back

There are three different things you might want, and they are three different buttons.

• Stop it acting. Settings → Stop everything. The nightly check stops immediately and nothing is proposed. Your adverts keep running exactly as they are.
• Cut off our access to Google. Settings → Disconnect. We delete the stored permission, and we can no longer reach your Google Ads account. You can also remove FineCompass from your own Google account at myaccount.google.com/permissions, which ends the permission on Google’s side and works even if our site is down. Your copy of your campaign data stays until you ask for it to go.
• Delete everything. Settings → Close this account. Everything we hold about your business, your campaigns and your customers is deleted, along with the Google permission. This cannot be undone by us or by you. Your Google Ads account and your adverts are untouched — whatever is running keeps running.

Before you delete anything you can take a copy: Settings → Take your data gives you one file with everything we hold. It deliberately leaves out the Google permission itself, because that is a key to your advertising account and it does not belong in a file on your computer.

If you would rather ask a person than press a button, write to support@finecompass.com and we will do it for you.

Cookies

One cookie, to keep you signed in. No advertising cookies, no analytics that follow you to other sites, nothing sold to anybody.

Children

This is a tool for businesses. It is not for anybody under 18 and we do not knowingly collect their data.

Changes to this policy

If we change what we collect or what we do with it, we will change this page and say so at the top, and we will write to you before the change takes effect rather than after.