Privacy Policy

This Privacy Policy explains what information Shabba ("Shabba", "we", "us" or "our") collects, how we use it, who we share it with and the choices you have. It covers our website at shabba.io (the "Site") and our web application at app.shabba.io (the "App"), including the Google Ads data you choose to connect.

We wrote it to be read. If anything is unclear, email charles@shabba.io.

The Short Version

• We use your Google Ads data only to run the tools you choose and show you the results. Copies of tool results are deleted automatically after 30 days.
• We never sell your data, and never use your Google Ads data for advertising.
• We never use your data to train AI models.
• Tools never change your Google Ads account without your explicit confirmation.
• We never see your Google password or your full card number.
• You can disconnect, cancel or delete your account at any time.

Who We Are

Shabba is a trading name of Charles Bannister, a sole proprietor based in Chicago, Illinois, United States. Charles Bannister is the data controller for the personal information described in this policy. For the Google Ads data you connect, we process it only to provide the tools you choose, on your instructions. You can contact us at charles@shabba.io.

Information We Collect

If you visit the Site

We automatically collect information about your device and visit, such as your browser, IP address, time zone, the pages you view, the site or search that referred you, and how you interact with the Site. We collect this with cookies, log files and analytics tags. For more information about cookies, and how to disable them, visit allaboutcookies.org.

If you get in touch

When you use the get-in-touch form, we receive your message, the name and email address you choose to give (both optional), the page you sent it from and your IP address. We use these to read and reply to your message and to block spam. Messages are delivered to us through Slack and kept as long as needed to deal with them, and no longer than two years.

If you sign up to the newsletter

When you sign up on the Site, we send a link to the address you gave, and you are only added once you click it (double opt-in). We keep your email address, the page you signed up on, and when and how you agreed, including the wording you agreed to. You can unsubscribe at any time with the link in every email.

If you create an account

• Account details: your name, email address and, if you sign in with Google, your Google account ID and profile picture.
• Billing details: your plan, billing term, credit purchases and balance, and payment history. Payments, invoices and cancellations are handled by Stripe and its customer portal. We never see or store your full card number.
• Usage records: which tools you run, when, on which Google Ads account (by customer ID), and how much usage each run cost. We use these to bill you correctly, enforce fair-use limits and fix problems.
• Messages you send us: support requests, feedback and anything else you choose to share.
• Technical logs: IP address, browser, and error and request logs from the App, used for security and to keep the service running.

If you connect a Google Ads account

You connect Google Ads through Google's own sign-in and permission screen. You choose which Google account to connect, and you can disconnect at any time. When you do, we receive and store:

• Tokens from Google (an OAuth refresh token and a short-lived access token) that let the App call the Google Ads API on your behalf. Both are stored encrypted. We never see your Google password.
• Basic profile information from the connected Google account: email address, name and profile picture, so you can see which account is connected.
• A list of the Google Ads accounts you can access: customer IDs, account names, currencies, time zones, which accounts are manager or test accounts, and the accounts you star or hide, so you can pick an account in each tool.

How We Use Google Ads Data

A tool reads only the Google Ads data it needs to do what you asked, when you run it or at the times you schedule it to run. That can include campaign, ad group, keyword, ad, asset, product, bidding, budget, setting and performance data (such as impressions, clicks, cost and conversions).

• We use it only to provide the tools you use: to fetch, analyse and show you the results, to produce exports you request, to make and record the changes you confirm, and to remember the items you mark in a tool (for example, snoozed or marked as OK).
• Changes only when you confirm them. Some tools can make changes to your Google Ads account, such as adding or removing a negative keyword, adding a keyword or ad group, updating ad text or a link, or pausing an ad. A tool never makes a change until you have reviewed it and explicitly confirmed it. Each tool states whether it can make changes.
• What we keep, and for how long. Google Ads data is stored in our private, encrypted cloud storage on AWS in the United States (Ohio, us-east-2):
  • Tool results, so you can open a recent run again and download exports: deleted automatically after 30 days. Your browser also keeps a copy (in its IndexedDB storage, on your device) for up to 30 days, which you can clear at any time by clearing your browser's site data for app.shabba.io.
  • Link and page speed checks (the URLs checked, account names and spend figures): deleted automatically after 30 days.
  • Your change history: each change you confirmed, with what it was before and after, so you can see what changed and undo it. Kept while your account is open, including after you disconnect Google Ads.
  • Records of your runs and schedules (which tool, which accounts, the settings you chose) and items you mark in a tool (the item's text and any note you add). Kept while your account is open. Snoozes expire 30 days after the snooze ends.
  Everything above is deleted when you delete your Shabba account (see below).
• We never sell it, use it for advertising (including retargeting or personalised ads), share it with data brokers or advertising platforms, or use it to determine credit-worthiness or for lending.
• We never use it to train artificial intelligence or machine learning models, whether ours or anyone else's.
• People at Shabba do not look at your Google Ads data unless you ask us to (for example, to help with a support request, when we may view the App as you; this is recorded), it is needed for security (for example, investigating a bug or abuse), it is required by law, or it has been aggregated and anonymised for internal operations.

Google API Services User Data Policy

Shabba's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Artificial Intelligence (AI) Features

Shabba does not send your data to any AI provider today. We plan to add AI features, such as checking whether a search term fits an ad group. Before any of them goes live, we will update this section to name the provider, say exactly what is sent and how long the provider keeps it, and tell you by email or in the App. These rules will apply whatever the provider:

• Only the data the feature needs is sent, and never your password, payment details or Google access tokens.
• Neither we nor the provider will use your data, or AI inputs and outputs, to train AI models.
• AI features will never change your Google Ads account without your explicit confirmation.

How We Use Your Other Information

• To create and run your account, and to sign you in;
• To process payments and send receipts and invoices;
• To respond to support requests and feedback;
• To send service messages, such as security notices or changes to these policies;
• To send product news, but only where you have agreed or where the law allows, and you can unsubscribe at any time;
• To send the newsletter to people who signed up and confirmed their address, until they unsubscribe;
• To send App users a couple of getting-started emails after they sign up, and a short note if they haven't been in for a while. Every one has a one-click unsubscribe link, and you can turn them off in Settings, Emails;
• To keep the Site and App secure, prevent fraud and abuse, and fix problems;
• To understand how the Site is used and improve it (using aggregated analytics);
• To measure our own marketing on the Site (see Cookies and Advertising below).

Legal bases (UK and EEA users)

We process your information to perform our contract with you (running your account and the tools you use), for our legitimate interests (security, fraud prevention, improving the service and marketing our own products, balanced against your rights), to comply with legal obligations (such as tax records), and with your consent where we ask for it (such as optional cookies and marketing emails). You can withdraw consent at any time.

Who We Share Information With

We do not sell your personal information. We share it only with service providers that help us run Shabba, under contracts that limit them to using it for that purpose:

• Google: sign-in with Google and the Google Ads API, which is how tools read and, when you confirm, change your Google Ads data.
• Amazon Web Services (AWS): hosting, processing and storage, in the United States (Ohio, us-east-2).
• Stripe: payments and billing.
• Email delivery providers: to send account and service emails.
• Amazon SES: the email sending service from AWS, which we use to send our emails from the United States. Newsletter sign-ups and marketing emails (our newsletter, and tips and product news to app users who have said yes) are stored and sent by Shabba itself, through Amazon SES. We don't use a separate newsletter service. You can unsubscribe from any of these at any time.
• Slack: to deliver messages sent through the get-in-touch form to us.
• Google Analytics: to understand how visitors use the Site. You can read Google's privacy policy and opt out using the Google Analytics opt-out add-on.

An up-to-date list of our service providers is available on request.

We may also share information to comply with the law or a lawful request, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets. In a sale, Google user data would only be transferred after asking for your explicit consent.

Cookies and Advertising

The App uses only the cookies it needs to sign you in and keep it secure. With your consent, the Site also uses analytics cookies (Google Analytics, through Google Tag Manager), and may use advertising tags to measure and target our own marketing for Shabba. These stay off until you press Accept on the cookie banner, and you can change your mind at any time with "Cookie settings" at the bottom of every page. Google Ads data you connect to the App is never used for this.

You can opt out of targeted advertising here:

• Google: adssettings.google.com
• Facebook: facebook.com/settings/?tab=ads
• Microsoft (Bing): account.microsoft.com/privacy/ad-settings
• LinkedIn: linkedin.com/psettings/advertising
• The Digital Advertising Alliance: optout.aboutads.info

We do not change our data practices in response to a browser's Do Not Track signal.

How Long We Keep Information

• Google tokens, connected profile and account list: until you disconnect Google Ads or delete your Shabba account. When you disconnect, we delete them and ask Google to revoke Shabba's access (unless another Shabba account you use is connected through the same Google login, in which case you can remove access at Google yourself; see below).
• Tool results, and link and page speed checks: 30 days.
• Change history, run and schedule records, and items you mark: while your account is open.
• Newsletter sign-ups: while you are subscribed. If you unsubscribe, we keep your address and a record of your choice so we don't email you again. An unconfirmed sign-up is not sent the newsletter.
• Get-in-touch messages: as long as needed to deal with them, and no more than two years.
• Account, usage and support records: while your account is open, and deleted when you delete your account, except where we must keep them longer.
• Billing and tax records: as long as tax law requires (usually up to seven years).
• Server and security logs: up to 30 days. Logs record IDs (such as your user ID and Google Ads customer IDs), not your Google Ads data.
• Backups: our database backups are kept for 7 days, so deleted data leaves them within 7 days.

Disconnecting and Deleting Your Data

• Disconnect Google Ads at any time from Settings › Integrations in the App. You can also remove Shabba's access from your Google account at myaccount.google.com/permissions. Either way, Shabba can no longer read or change your Google Ads data.
• Cancel your plan at any time through the billing portal (provided by Stripe), linked from the App's billing page.
• Delete your account from your account settings in the App, or by emailing charles@shabba.io from the email address on your account. Deleting your account cancels any plan, disconnects Google Ads and deletes your account, change history, run and schedule records and the items you marked straight away. Copies of tool results expire within 30 days and backups within 7 days.

Security

We protect your information with encryption in transit (HTTPS) and at rest, by keeping Google access tokens encrypted, by limiting staff access to what is needed, and by using reputable infrastructure providers. Tools receive only a short-lived access token for each run, and stored Google Ads data is encrypted and kept only as long as described above. No system is perfectly secure, but if a breach affects your data we will tell you and the relevant authorities as the law requires.

Where Your Data Is Processed

We are based in the United States, and our service providers, including Google and Stripe, mainly process data in the United States. The App, our tools and our emails run on AWS in the United States. If you are in the UK or EEA, your information is transferred to the United States; where our providers carry out those transfers, they rely on safeguards such as the EU-U.S. Data Privacy Framework (and its UK extension) or the EU Standard Contractual Clauses and UK International Data Transfer Addendum.

Your Rights

Depending on where you live, including under US state privacy laws (such as California's) and, for UK and EEA residents, the UK GDPR and EU GDPR, you may have the right to:

• access the personal information we hold about you;
• correct it;
• delete it;
• restrict or object to how we use it, including for direct marketing;
• receive a copy of your data in a portable format: email us and we will send it to you (there is no self-serve download); and
• withdraw consent where we rely on it.

To use these rights, email charles@shabba.io. We will respond within one month. We will never treat you differently for using your privacy rights. If you are in the UK or EEA and unhappy with how we handle your information, you can also complain to your local data protection authority, such as the UK Information Commissioner's Office at ico.org.uk.

Children

Shabba is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.

Changes to This Policy

We may update this policy as our service or the law changes. We will change the date at the top and, for significant changes, especially any change to how we use Google Ads data or AI, we will tell you by email or in the App before the change takes effect.

Contact Us

For questions about this policy or your data, or to make a complaint, email charles@shabba.io.