Skip to content

Privacy policy

Last updated

This policy explains what we collect, why, and what you can ask us to do with it. We keep it short and plain on purpose. If anything is unclear, email support@spendcanary.com.

Who we are

SpendCanary is operated by HMJ SOLUTIONS L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates (“we”, “us”). We decide how your data is used, so we are the “controller” of it under data protection laws such as the EU and UK GDPR and the UAE’s data protection law. Contact: support@spendcanary.com.

What we collect

When you ask for a free scan

  • Your email address, so we can send your report.
  • A one-line description of your business, only if you choose to give one (“What do you sell, and where?”).

When you run our script in your Google Ads account

The script reads the last 30 days of your account and sends us a summary. It contains:

  • campaign names and settings (for example, which networks and location options a campaign uses),
  • cost, clicks and conversions, split by network, by day and by country,
  • the search terms people used, with their cost,
  • the names and settings of your conversion actions,
  • recent changes made by Google’s auto-applied recommendations,
  • your account’s currency and time zone.

We use this summary only to run our checks and write your report. We don’t keep the summary itself. We keep only what your report shows: the totals, each finding with the numbers behind it (which can include campaign names and search terms), and a technical note of any part of the scan that failed. The script does not send us your Google login, billing or payment details, your customers’ personal details, or your ads’ text.

When you sign in with Google

  • Your name, email address and Google account ID. Google gives us these when you choose “Sign in with Google” (the openid, email and profile permissions). We use them to create your account and sign you in.

When you connect Google Ads

When you connect, you give SpendCanary permission to read your Google Ads data (Google’s https://www.googleapis.com/auth/adwords permission). Google calls this full access because it has no read-only option. SpendCanary only reads: it never changes anything in your account.

  • An access key from Google (a “refresh token”) that lets us read your Google Ads data. We store it encrypted (AES-256-GCM). We delete it when you disconnect, when Google or you revoke our access, or when you delete your data.
  • The list of Google Ads accounts you can open: their names, IDs, currency and time zone, so you can pick one.
  • The same report data the script reads (listed above), for the account you pick. We use it to run our checks and write your report. As with the script, we keep only what your report shows, not the data itself.
  • Your answer to “What do you sell, and where?”, if you give one.

How we use Google user data

  • We use the data we get from Google only to show you your scans, reports and emails inside SpendCanary. We don’t use it for anything else.
  • We never sell it, never use it for advertising, and never use it to decide credit or lending.
  • We don’t use it to develop, improve or train AI or machine-learning models. Our AI helper (see “Who helps us”) gets search terms only to sort them for your own report. Under its commercial terms, it doesn’t train its models on this data.
  • We only share it with the providers listed under “Who helps us”, and only to run SpendCanary for you.
  • No person at SpendCanary reads your Google Ads data unless you ask us to (for example, in a support request), unless it’s needed for security, or unless the law requires it.
  • SpendCanary’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you join a waitlist

  • Your email address and the plan you’re interested in.

When you visit the website

  • Our hosting provider, Cloudflare, processes your IP address and basic request details to deliver the site and protect it from abuse (for example rate limiting).
  • Our forms use Cloudflare Turnstile to tell people from bots. It can set cookies that Cloudflare describes as strictly necessary for that purpose.
  • We use no advertising or tracking cookies. Our visitor statistics, if enabled, use Cloudflare Web Analytics, which does not use cookies.

Why we use it

Purpose What we use Legal basis (GDPR)
Run your scan and email your report Email, description, account summary Doing what you asked (contract)
Your account and connected Google Ads Name, email, Google account ID, access key Doing what you asked (contract)
Keep the service secure and working IP address, request details, technical notes Our legitimate interest in security
Tell you when a paid plan opens Waitlist email and plan Your consent

We don’t sell your data. We don’t use your data to advertise to you or to anyone else. We use each advertiser’s data only to serve that advertiser.

Who helps us

We use a few trusted providers (“processors”) who handle data only on our instructions:

  • Cloudflare: website hosting, database, security checks and visitor statistics.
  • Resend: sending our emails.
  • Anthropic: our AI writing helper. We send it your search terms, your one-line business description and our own report text, so it can sort the search terms and make the wording plainer. We never send it your email address, name or account ID.

These providers may process data in the United States and other countries. Where the law requires it, we rely on the safeguards they offer, such as standard contractual clauses.

Google Ads data stays in your Google account. Running a script in Google Ads is also covered by Google’s own terms and privacy policy.

How long we keep it

  • Report link: it stops working 30 days after your scan.
  • Scan results, and the email and description they belong to: deleted 13 months after the scan.
  • Unused scan scripts: the email and description are deleted 7 days after you ask for the script, if it’s never run.
  • Your account and connected Google Ads accounts: until you delete your data.
  • The Google access key: until you disconnect, Google or you revoke our access, or you delete your data, whichever comes first.
  • Waitlist: until we’ve told you your plan is open, or until you ask us to remove you.
  • Server logs: kept for up to 7 days. We remove email addresses and codes from them.

Your rights

You can ask us to:

  • show you the data we hold about you,
  • correct it,
  • delete it,
  • stop using it, or object to how we use it,
  • give it to you in a portable format.

If you signed in, you can delete everything yourself under Settings → Delete my data. You can stop our access to Google Ads under Settings → Disconnect Google Ads, or in your Google Account under Security → Third-party apps and services.

To do any of this by email, write to support@spendcanary.com from the address you used with us. See how to delete your data. We reply within 30 days. If you’re unhappy with our answer, you can complain to your local data protection authority.

Children

SpendCanary is for businesses. It is not meant for anyone under 18.

Changes

If we change this policy, we’ll update the date at the top. If a change matters to how we use your data, we’ll tell you by email before it applies.