AdLabs Privacy Policy

Summary#

• AdLabs is operated by AdLabsPPC OÜ, a company registered in Estonia. We are the controller of your account, billing, support, website and marketing data. For the Amazon advertising, sales and AMC data you connect, we act on your organization's instructions.
• We collect what we need to run AdLabs: your account details, the Amazon advertising data you connect, the work you do in AdLabs, and billing and support records.
• We never sell personal data or Amazon data, and we never show one customer's data to another customer.
• If you connect an AI assistant such as ChatGPT or Claude, AdLabs sends that assistant the data each request needs and, if you allow it, carries out the changes it asks for. We do not receive your chat with the assistant, only its requests and anything you or it put in a bug report or help search.
• We store application data on Amazon Web Services in the United States, encrypted in transit and at rest.
• You can ask us to access, correct, export or delete your data at any time by emailing team@adlabs.app.

1. Who we are#

AdLabs is an Amazon advertising management platform. This policy is issued by AdLabsPPC OÜ, registry code 16817105, Villardi tn 11-7, 10136 Tallinn, Estonia ("AdLabs", "we", "us").

We decide how and why your account, billing, support, website and marketing data is used, so we are its controller. The Amazon advertising, sales and AMC data you connect belongs to your organization: we process it to provide AdLabs on your organization's instructions.

This policy applies to:

• the AdLabs website at adlabs.app
• the AdLabs application at dashboard.adlabs.app
• the AdLabs MCP server at mcp.adlabs.app. MCP (Model Context Protocol) is the standard AI assistants use to connect to apps. This includes the AdLabs app for ChatGPT and the AdLabs connectors for Claude and other AI assistants.

Read it together with our Terms and Conditions and our Cookie Policy.

2. The data we collect#

Account and team information#

• Your name, email address and, if you choose to give it, your phone number.
• Your organization, the teams and Amazon profiles you belong to, and your role.
• If a colleague invited you to AdLabs, we received your name and email address from them.
• Sign-in is handled by Google Firebase Authentication. AdLabs does not store your password.
• If you create an AdLabs API key, we store only a scrambled (hashed) version and its last four characters.

Amazon connection information#

When you connect an Amazon account, you sign in with Amazon and authorize AdLabs. Amazon then shares with us:

• the name, email address and postal code on the Amazon login you use to authorize us
• your advertising profile, account, marketplace and advertiser identifiers
• access tokens that let AdLabs act on your behalf. These are stored encrypted and never shown in the browser or to other customers.

We never ask for or store your Amazon password.

Amazon advertising and sales data#

With your authorization we retrieve and store:

• Advertising data from the Amazon Ads API: campaigns, ad groups, keywords, targets, bids, budgets, placements, audiences, DSP entities and performance metrics.
• Search terms and search query data: the words shoppers typed on Amazon, with their performance. This data is not meant to identify anyone and we do not use it for that, although a search term can occasionally contain a word that relates to a person.
• Sales data from Seller Central or Vendor Central, if you connect it: totals such as sales, units and traffic, used to calculate metrics such as TACoS.
• Amazon Marketing Cloud (AMC) data, if you connect an AMC instance: the queries you run and their aggregated results.

We do not request or store Amazon shoppers' names, addresses or contact details.

Work you do in AdLabs#

• Change history: every change made through AdLabs (for example to a bid, budget, status or target), with who made it, when, the old and new values, and the source of the change (the app, an automation, the optimizer or the AdLabs MCP server). Changes made through the AdLabs MCP server must include a note explaining the reason, which is saved with the change.
• Saved content: instructions and context you save for AI assistants, saved prompts, filters, tags, dashboards, automations, reports and settings.
• Shared links: dashboard share links you create, and short-lived CSV download links (see section 4).

Billing information#

Billing is handled by Stripe. We store your Stripe customer and subscription identifiers, plan, subscription status and invoice-related details. We do not receive or store full card numbers.

Support and feedback#

Messages, feedback and bug reports you send us through the in-app support widget (Gleap), by email, or through the AdLabs MCP server's bug report tool. A bug report sent through the MCP server contains your own words, the assistant's description of the problem and the requests involved, which can include advertising data.

Technical and usage information#

• Application error reports through Sentry, which can include your browser type, the page you were on, technical details of the error and a replay of the app session around the error, which can show what was on screen.
• Security and service logs on our infrastructure, which can include IP addresses, timestamps and the requests made, including AdLabs MCP server requests, which carry a session identifier so our support team can trace a problem.
• Product usage such as AdLabs Academy lessons completed, quiz results and tutorial videos watched.

Website visitors, sign-ups and marketing#

• Details you enter in website forms, for example when you request a demo, book a call or download a resource.
• How you found us: answers you give at sign-up, and the campaign and click identifiers attached to your visit (for example UTM parameters, Google click IDs and Meta and LinkedIn click and browser identifiers).
• Information collected by cookies and similar technologies (see section 9).
• If you join a sales or onboarding call with us, it may be recorded and transcribed.

3. How and why we use your data#

You need to give us an email address and connect an Amazon account to use AdLabs. Without them we cannot provide the service.

We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects. The AdLabs optimizer and automations change advertising settings based on rules you configure; they do not evaluate people.

Amazon data commitments#

• We use Amazon data only to provide AdLabs to the customer who authorized us, including sending it to AI assistants that customer connects.
• We do not sell, rent or license Amazon data.
• We never show one customer's data to another customer.
• We do not sell, share or disclose Amazon data, alone or aggregated, to anyone except Amazon, the service providers listed in section 5 that process it for us under contract, and the AI assistants you choose to connect, which receive it at your instruction.
• We do not use Amazon data to target Amazon shoppers.
• We do not use your advertising data to train machine learning or AI models.

4. AI assistants, the AdLabs MCP server and the ChatGPT app#

You can connect AdLabs to an AI assistant that you use, such as ChatGPT, Claude, Codex, Gemini, Cursor or Perplexity, through the AdLabs MCP server. You authorize the connection by signing in to AdLabs and approving it, or by giving the assistant your AdLabs API key.

What the assistant can access. The assistant can see and do what your AdLabs account can, for the teams and profiles you have access to. This includes the names of team members who made changes, so connecting an assistant shares them with that assistant's provider.

• Read: campaigns, targets, search terms, search query data, products, audiences, dayparting, automations, AMC results and change history, including which team member made each change.
• Change, if you allow it: pause or enable items, change bids and budgets, add targets or negatives, and revert supported changes. Read-only or read-and-write access is set in your assistant's connector settings.

What we receive from the assistant. Only the details of each request: for example the profile, date range, filters, values to apply and the reason note for a change, plus a session identifier used for support. We do not receive, request or reconstruct your conversation with the assistant.

What we send back. The advertising data that answers the request, with the AdLabs identifiers needed to act on it.

How it is used and kept. We use the requests to carry out your instructions and to troubleshoot problems. Changes made through the AdLabs MCP server are saved in your change history like any other change. Request logs are kept as set out in section 7.

The assistant provider. Once data reaches your assistant, it is handled under that provider's own terms and privacy policy (for example OpenAI for ChatGPT, Anthropic for Claude), not this one. Apart from help-search text (below), AdLabs does not send your advertising data to any AI provider of its own.

Help search. If you or your assistant search AdLabs help content with meaning-based search, the search text is processed by Google's Gemini models to find matching articles. It contains whatever you or your assistant include in the search, which can include advertising data.

Temporary links and data. Data exports create a CSV download link that works without signing in for 15 minutes, then expires. Data held for an assistant during a session expires automatically within about an hour.

Turning it off. Disable or regenerate your API key in AdLabs to cut off every connection that uses that key immediately, or remove the AdLabs connector in your assistant.

5. Who we share data with#

We do not sell personal data. We share data only with:

• Amazon, which receives the changes and requests you make through AdLabs, under your authorization.
• AI assistants you connect, including ChatGPT. At your instruction, AdLabs sends the assistant you authorized the Amazon data needed to answer each request, as described in section 4.
• Service providers that run AdLabs on our behalf, under contract and only for that purpose:
  • Amazon Web Services: hosting, databases, storage and encryption
  • Google Cloud (Firebase): sign-in and multi-factor authentication
  • Stripe: payments and subscriptions
  • Sentry: error monitoring, including session replays when an error occurs
  • Gleap: in-app support, feedback and customer emails
  • Google (Gemini): AI processing of AdLabs help content and help searches
  • Attio and Pipedrive: customer relationship management
  • Cloudflare and Cloudways: website delivery, hosting and security
  • CookieYes: cookie consent records
  • Calendly and Fathom: call booking, recording and transcription
• Advertising and analytics partners whose tags run on our website and application, as described in section 9 and our Cookie Policy: Google (Analytics, Tag Manager and Ads), Meta, LinkedIn, OpenAI and Ahrefs. When you sign up, we may also send Google, Meta and LinkedIn your email address and name in hashed form to measure our own advertising. These tags are not used to send your Amazon advertising data to these partners.
• Embedded content providers: YouTube for videos, and Trustpilot, Capterra, GetApp and Software Advice for review badges on our website.
• People you choose to share with: team members you invite, agencies or partners you grant access, and anyone who has a dashboard share link or a CSV download link you create. Anyone with such a link can open it without signing in, so treat it like a password.
• Authorities and advisers, where the law requires it or where needed to establish, exercise or defend legal claims.
• A buyer or successor, if AdLabs is involved in a merger, acquisition or sale of assets, under this policy's protections.

6. International transfers#

AdLabsPPC OÜ is established in Estonia. Our application data is stored and processed in the AWS us-east-2 region (Ohio, United States), and several of our service providers are based in the United States. Where personal data leaves the European Economic Area or the United Kingdom, we rely on the EU-US Data Privacy Framework (and, for UK data, its UK Extension) where the recipient is certified, or on the European Commission's Standard Contractual Clauses with the UK Addendum. Contact us for a copy of the relevant safeguards.

When you connect an AI assistant, data reaches that provider at your instruction; see its privacy policy for where it processes data.

7. How long we keep data#

• Account, Amazon and advertising data, change history and saved content: for as long as your account is active, so your history and reports stay available.
• After you ask us to delete your account: we revoke all Amazon and AI connection tokens, remove access and delete your data from our production systems within 30 days. Encrypted backups are destroyed within a further 30 days. We confirm deletion in writing on request.
• If you ask us to delete specific data: we delete that data within the same 30 days.
• If you disconnect an Amazon account: we stop collecting data from it immediately and delete the Amazon data we hold for it within 30 days.
• Amazon data for subscriptions that end without a deletion request: deleted within 30 days after the subscription ends.
• Other account data for subscriptions that end without a deletion request: deleted 12 months after the subscription ends.
• Security, service and AdLabs MCP server request logs: 90 days, then deleted.
• Support messages, bug reports, call recordings, website form details and usage data: 24 months after our last contact with you, then deleted.
• CSV download links: expire after 15 minutes.
• Data held for an assistant session: expires within about an hour.
• Short tracking links (links that open a specific view in AdLabs): deleted after 90 days.
• Dashboard share links: until you delete them.
• Invoices and accounting records: 7 years from the end of the financial year, as Estonian accounting law requires.
• Marketing contacts: until you unsubscribe or ask us to delete them. We then keep your email address on a do-not-contact list so we do not email you again.

8. How we protect data#

• Each customer's data is separated by team and profile at the application and database level, so one customer's queries cannot return another customer's data.
• TLS 1.2 or higher for all traffic to the website, application, API and MCP server.
• AES-256 encryption at rest for databases, storage and backups, with keys managed by AWS.
• Multi-factor authentication for staff, least-privilege access, and production database access limited to a small named group of engineers. Access is logged.
• AdLabs passed an Amazon Developer Data Security Assessment conducted by PwC in December 2025.
• AdLabs is a Verified partner in the Amazon Ads Partner Directory.

If a security incident affects your data, we will notify affected customers within 48 hours of confirming it, and notify the authorities as the law requires. To report a vulnerability or a privacy concern, email team@adlabs.app.

9. Cookies and tracking#

On our website (adlabs.app) we use:

• Google Tag Manager, Google Analytics and Google Ads (including enhanced conversions)
• the Meta Pixel, the LinkedIn Insight Tag and the OpenAI advertising pixel
• Ahrefs analytics, YouTube video embeds and review badges
• our own first-party cookies that remember how you arrived, kept for up to 180 days

In our application (dashboard.adlabs.app) we use:

• Google Firebase to keep you signed in
• Gleap for in-app support and Sentry for error monitoring
• Google Tag Manager, Google Analytics, Google Ads, Meta, LinkedIn and OpenAI tags to measure sign-ups

You can accept or reject non-essential cookies on our website through the cookie banner and change your choice at any time. Our Cookie Policy lists each cookie, its purpose and how long it lasts. Most browsers also let you block cookies, though parts of AdLabs may not work if you do.

10. Your rights and choices#

In AdLabs you can at any time:

• review and update your account details (contact support to change your login email)
• create, regenerate or disable your API key
• disconnect an Amazon account, or remove AdLabs from your Amazon account settings
• remove the AdLabs connector from your AI assistant
• delete saved prompts and dashboard share links, and remove saved instructions. Removed instructions stay in our records until your account is deleted, or until you ask us to delete them
• review your change history and revert supported changes
• export your advertising data as CSV (for a full copy of your personal data, email us)
• unsubscribe from marketing emails using the link in each email

You also have the right to:

• access the personal data we hold about you
• correct inaccurate data
• delete your data, on the timeline in section 7
• restrict or object to our processing, including processing based on legitimate interests and direct marketing
• receive your data in a portable format
• withdraw consent at any time, where we rely on it, without affecting earlier processing

Your right to object. You can object at any time to processing based on our legitimate interests, and to direct marketing, by emailing team@adlabs.app. We will stop marketing at once.

To exercise any of these rights, email team@adlabs.app. We will respond within one month.

If your organization's administrator manages your AdLabs account, some requests may need to go through them.

11. Children#

AdLabs is a business service. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

12. Other websites and services#

AdLabs links to and works with services we do not control, including Amazon and the AI assistants you connect. Their own privacy policies apply to them.

13. Changes to this policy#

We may update this policy as AdLabs changes. We will post the new version here with a new "Last updated" date, and tell account holders directly about material changes.

14. Contact us#

AdLabsPPC OÜ
Villardi tn 11-7, 10136 Tallinn, Estonia
Registry code 16817105
Email: team@adlabs.app

We have not appointed a Data Protection Officer. Privacy questions go to the email address above.

15. Complaints#

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to a data protection supervisory authority where you live or work, or where you believe a breach happened. In Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee.