This policy explains how AdCerberus collects, uses, stores and deletes personal data. The service is operated by Individual entrepreneur Nikita Vereshchagin in Georgia. Application data and server backups are hosted by Contabo in France.
01 / CONTROLLER
02 / DATA
User ID, email, display name, password hash, verification and login timestamps, organization membership and role. Telegram ID, username and chat ID may exist when the account is linked to the bot. Session and CSRF tokens are stored as hashes with expiry and activity timestamps.
Meta user and business identifiers when returned, granted permissions, encrypted access-token material, token expiry, validation and revocation state, and safe error codes. Statistics-only connections request ads_read. Buyers can separately choose statistics and management, which requests ads_read and ads_management for explicit pause or start actions on selected campaigns in their authorized accounts. An authorized administrator management connection may additionally request ads_mcp_management. The selected permissions are shown before authorization. Campaign-action requests, results and observed status are retained for operation and audit within the stated retention categories.
Selected advertising-account ID and name, account status, currency, timezone, connection and AdCerberus organization, team or buyer allocation, plus validation and last-sync state.
Stored facts include campaign identity and name, reporting date, clicks, spend, source and synchronization provenance. Current Meta reads can also return campaign status, objective and buying type, plus impressions, inline-link clicks, CPC, CPM, CTR and configured action aggregates.
Synchronization records retain the selected advertising account and campaign identifiers, names, currency, time zone, reporting dates and the returned performance aggregates listed above. They also retain validation results and source links needed to check the report. Meta synchronization records follow the 30-day raw-row schedule below. AdCerberus does not collect Facebook passwords, browser cookies or Facebook session data.
When you connect Google Ads, AdCerberus stores your Google account identifier, granted scopes, encrypted access and refresh tokens, token expiry and connection status. It discovers accessible manager and advertising accounts, then imports only the advertising accounts selected and assigned to a buyer. Stored reporting includes account and campaign identifiers and names, currency, timezone, app metadata, reporting dates, clicks, impressions, spend, conversions and app-install conversions. Google authorization connects a reporting source; it does not sign you into AdCerberus.
Google Ads data supports the reporting, synchronization and explicit campaign association features visible in AdCerberus. Google requires the adwords permission for this API; its consent description includes campaign management. The current AdCerberus Google Ads integration reads account and reporting data. It does not create ads, change campaigns or budgets. OpenID identifies the Google account that authorized the connection. Google Ads data is available to authorized workspace members within the assigned organization, team and buyer scope and can be exported when an authorized user requests it.
Disconnecting Google Ads disables its selected account routes and future access through that connection. It does not erase reporting history or automatically revoke the Google-side grant. You can remove the application access in your Google Account. To request deletion of Google Ads connection or reporting data held by AdCerberus, email support@adcerberus.com. The Meta-specific Privacy center and Meta retention timetable do not apply to Google Ads data. Imported Google Ads history remains after disconnection; no automatic Google Ads reporting-retention period is currently enforced. The operator handles deletion requests separately. Exported copies and data held by Google remain under their respective owners control.
Google receives OAuth authorization and API requests for your connected Google Ads accounts. Google processing may occur outside the AdCerberus application hosting location in France. Application tokens are encrypted in storage; credentials are not included in display status or ordinary logs. Human access to Google API data is limited to your specific agreement, security investigation, legal requirements or permitted aggregated internal operations. AdCerberus does not sell Google API data or use it for unrelated advertising. Its use and transfer of Google API information follow the Google API Services User Data Policy, including the Limited Use requirements.
AdCerberus uses a session cookie to keep you signed in. The application protects it from JavaScript access and configures secure transmission in production. Local browser storage remembers language, theme, the last selected organization with its user reference, and report display preferences. These preferences remain until replaced or cleared in your browser. Clearing local storage does not erase server data; clearing the session cookie requires signing in again.
03 / PURPOSE
Account access and requested reporting support the service relationship with the user or their organization. Facebook data access starts with the user’s explicit authorization, which can be withdrawn. Security, access control and limited diagnostic records protect the legitimate interests of the service and its users, subject to their rights. Where applicable, records are also processed to meet legal obligations. We do not sell Meta data or use it for unrelated advertising.
04 / LIFECYCLE
05 / RETENTION
The timetable below applies to Meta data and the listed operational records; it does not define Google Ads reporting retention. These durations are AdCerberus policy targets, not evidence that enforcement is healthy. The live status reports the actual mode. Preview-only, overdue or failed status is not compliance.
Automatic retention and backup disposal are enabled. Completion requires a fresh verified inventory showing that every backup capable of restoring the erased data has actually been removed. A request stays open while such a backup exists. Check the live retention status for failures or overdue cleanup.
06 / ACCESS & REQUESTS
AdCerberus organization and role checks restrict workspace access. Access-token material is encrypted, and session and CSRF token values are stored as hashes. These controls do not replace a complete security statement.
Authorized members of your organization can see data within their assigned roles and buyer/team scope. The operator has access needed to run and secure the service and handle requests. Contabo GmbH, a German hosting provider, provides server hosting in France for application data and server backups. Meta and Google Ads receive authorization and API requests for their connected accounts. Namecheap Private Email receives support email and forwards a copy to the operator's Gmail mailbox; Google Sheets receives report data when an authorized user requests an export. Other integrations are used only when configured for the workspace.
The hosting location describes AdCerberus application storage. Google operates infrastructure in multiple countries, so Google Ads authorization and API requests, support email and requested Sheets exports may be processed outside France. Meta and Google describe their own processing in their privacy policies. You can contact the AdCerberus operator for information about recipients and data transfers.
Contabo privacy policy Meta privacy policy Google privacy policy
For access, correction, deletion or other questions about your data, email support@adcerberus.com. You do not need to sign in or reconnect Facebook to make a request. Include your AdCerberus account email and describe the data concerned. The operator may ask for limited information to verify ownership; never send passwords, access tokens or Facebook cookies. The Privacy center is also available for eligible Meta connections.
You may request information about processing, access and a copy of your data, correction, deletion, restriction or blocking, and portability where applicable. You may withdraw consent and object to processing on grounds available under applicable law. These requests are available even if you cannot sign in. Email support@adcerberus.com; the operator will verify ownership using information proportionate to the request.
Requests are handled within the time limits required by applicable law. If information is needed, a lawful extension applies, or a request cannot be fully fulfilled, the operator will explain the reason and next steps. Limited records may be retained where there is a valid legal ground; a backup-pending state is not a claim that deletion is complete. You may complain to the competent data-protection authority or court. Updated policies will show their revision date and material changes will be communicated to affected users.
AdCerberus