Privacy Policy

1. Introduction

Ads Master Pro ("we", "the platform") is a Google Ads traffic-quality and budget-protection service operated by Şafak Sarı. This policy explains what data we collect, how we use it, and how we protect it.

2. Data We Collect

Account information: your name and email when you sign in with Google.

Google Ads data: campaign, click, impression and conversion metrics from the ad accounts you authorize via OAuth 2.0. We access this data solely for protection and reporting.

Visitor signals: through the protection code on your site — IP address, browser (user-agent), visit time, page URL and click identifiers such as gclid of your ad visitors. Processed for click-fraud detection.

Device identification data (device fingerprint): To detect fraudulent and repeated clicks even when the IP address changes, the protection code derives and stores an encrypted technical identifier (hash) from the visitor's browser and device characteristics (screen resolution and color depth, time zone, language settings, hardware/CPU information, browser type, graphics processor model, and canvas/WebGL technical outputs). This identifier does not contain the person's name, email or direct identity; however, because it can be used to recognize a device/visitor again, it may be treated as personal data under applicable law. Devices showing repeated fraudulent click behavior may be blocked on a long-term basis at the level of the relevant advertiser account (this block is specific to that advertiser and is not carried over to other customers).

Session recording: only for visitors arriving via an ad click, an anonymous session recording (in-page movement, mouse activity) may be kept as fraud evidence. Per GDPR/KVKK, ALL text fields, form inputs and passwords are automatically MASKED — no personal data is recorded. These recordings are used solely for fraud review and retained for a limited time. If you use this feature, we recommend informing your visitors in your own privacy policy.

3. How We Use Data

To detect and block fraudulent and low-quality traffic,

To apply protection actions (negative audiences, IP exclusions) for your ad accounts,

To provide performance and protection reports,

To keep the service secure and operational.

We never sell your data or share it with third parties for advertising.

4. Google User Data

Data we access from your Google account is used in compliance with the Google API Services User Data Policy, including the Limited Use requirements. We use your Google Ads data only for the protection and reporting features we provide to you; no human reading, advertising use, or unauthorized transfer.

You can revoke the Google connection any time from your dashboard or your Google account settings.

5. Data Security and Retention

All data is encrypted in transit and at rest (TLS 1.2+). Your Google authorization tokens (refresh tokens) are stored encrypted with AES-256-GCM and are never accessible by the client.

Visitor signal data is retained for as long as needed for fraud analysis (90 days by default), then summarized and anonymized.

6. Aggregated and Anonymous Data Use

We may produce aggregated and anonymized statistics from data generated while providing the service, in a form that does not identify any individual customer, ad account or site visitor. These statistics are used to improve the service, refine fraud-detection methods and models, and to build industry averages and benchmark reports.

Outputs produced in this scope are irreversibly anonymous: they do not show which data belongs to which customer, and individual records are never shared with other customers. Benchmark reports contain only aggregate values for groups that include a sufficient number of accounts.

Your raw (non-anonymized) Google Ads data and visitor records are not used for any purpose other than providing the service to you, and are never sold or shared with third parties. For data obtained from your Google account, the Google API Services User Data Policy (Limited Use) requirements continue to apply.

7. Your GDPR / KVKK Rights

You have the right to access, correct, delete and restrict the processing of your data. To exercise these rights, contact support@adsmasterpro.com.tr.

8. Controller – Processor Relationship and Customer Obligations

Allocation of roles for site-visitor data: The advertiser who places the protection code on their own website (our subscriber/customer) acts as the "data controller" for the personal data of that site's visitors. Ads Master Pro acts solely as the "data processor", processing such data only on the customer's instructions and for click-fraud protection purposes. By using the service, the customer accepts this legal role and the responsibilities arising from it.

The duty to inform rests with the customer: The customer who places the protection code (including device fingerprinting and session recording) on their site is obliged, under KVKK art. 10 and GDPR art. 13-14, to inform their own site visitors — in their own privacy/notice text — about what data (including IP address and device fingerprint) is processed, for what purpose, the retention period, and data-subject rights. Ads Master Pro does not provide notice directly to the customer's visitors and is not responsible for the fulfilment of this obligation.

Cookie and explicit-consent obligations rest with the customer: Device fingerprinting and similar technical identifiers are, in many jurisdictions (especially under the EU ePrivacy/GDPR regime), treated as "cookies and similar technologies" and may require prior explicit consent (e.g. via a cookie/consent banner) for processing that is not strictly necessary. The customer is solely responsible for implementing the required cookie notice/consent mechanism on their site, for adding the protection code and device fingerprint to the relevant cookie/consent category, and for relying on a valid legal basis (including explicit consent or a legitimate-interest assessment) under applicable law.

Limitation of liability and indemnity: The customer is solely liable for any administrative fines, claims, lawsuits and damages arising from the customer's failure to fulfil the above duties of notice, cookies and explicit consent. The customer agrees to indemnify and hold harmless Ads Master Pro and Şafak Sarı against claims arising from the breach of these obligations. This text does not constitute legal advice; the customer is advised to consult their own legal counsel regarding their obligations.

9. Sub-processors (Service Providers)

To deliver the service we rely on the infrastructure providers below. These providers process data solely to provide services to us and in accordance with our instructions:

Google Cloud Platform / Firebase (Google Ireland Ltd. – EU, europe-west1 region): application servers, database and authentication infrastructure.

Google Ads API (Google Ireland Ltd.): applying protection actions to the ad account you authorize and reading metrics.

SendGrid / Twilio (USA): delivery of transactional and notification emails (reports, alerts, billing notices).

iyzico (Türkiye): payment processing. Card details are processed directly by iyzico; we never see or store card numbers.

IP reputation services (ipinfo.io, IPQualityScore): checking whether an IP address belongs to a data center/VPN/proxy. Only the IP address is sent to these services; no customer or visitor identity is shared.

If we change our sub-processor list, this page will be updated. Enterprise customers may request advance notice of such changes by contacting support@adsmasterpro.com.tr.

10. Service Level and Availability

For paid plans, we target 99.5% service availability on a calendar-month basis. Scheduled maintenance, outages originating from Google Ads or other third-party services, and force majeure events are excluded from this calculation.

Scheduled maintenance is performed during low-traffic hours where possible, and maintenance expected to exceed 4 hours is announced by email at least 48 hours in advance.

Support: on paid plans, support requests are answered within 1 (one) business day. In critical situations where the service is entirely unavailable, we respond as quickly as possible.

If the availability target is missed in a calendar month, upon request the subscription period is extended free of charge in proportion to the downtime. This is the exclusive remedy for service interruptions.

Failure of the protection code to run on the customer site (code removal, incorrect installation, site outage or content-security-policy blocking) and delays or restrictions on the Google Ads side are excluded from the availability calculation.

11. Contact

Privacy questions: support@adsmasterpro.com.tr

General support: support@adsmasterpro.com.tr