Privacy Policy

1. Who We Are

XerAds Platform is operated by PT AMAL DIGITAL STUDIO ("XerAds", "we", "us", or "our"). This policy applies to xerads.id, the XerAds Platform, and related support services.

2. Data We Collect

We collect information needed to create and secure your account, provide requested features, process subscriptions, and operate the Platform.

• Account and contact data, such as your name, email address, encrypted password, profile image, and service communications.
• Usage and technical data, such as features used, pages visited, IP address, browser type, device and operating-system information, and security logs.
• Business and campaign-planning data that you enter, such as business name, website, industry, offer, location, objective, budget, and generated campaign drafts.
• Integration data and credentials you choose to connect, including Google, CMS, and social-media integrations. Sensitive credentials are stored encrypted where retained.
• Payment and subscription information processed by our payment providers. We do not store payment-card or bank-account credentials.

3. Google Data and Google APIs

When you choose Google sign-in or connect Google services, XerAds may access your Google identity information (such as name, email address, and profile image), Google Search Console read-only data, and Google Analytics read-only data. We use this information only to authenticate you and provide the SEO analytics, reporting, and connected-account features visible in XerAds.

The Google Ads Keyword Planner integration uses administrator-managed Google Ads credentials to request keyword ideas and aggregate metrics such as search volume, competition, and bid ranges. It receives only the keyword inputs and settings needed for the visible keyword-research and campaign-planning features; XerAds does not use this integration to create, edit, or serve advertising in a user’s Google Ads account.

Google OAuth refresh tokens are encrypted at rest and are used only to obtain access needed for the Google feature you authorize. Keyword inputs and returned Google Ads metrics are cached per user for up to 24 hours to make the feature responsive. You can delete a cache entry in the product, and expired entries are automatically purged.

We do not sell Google user data, use it for targeted, personalized, retargeted, or interest-based advertising, provide it to data brokers or information resellers, or use it to train AI models. We share Google user data only when necessary to provide or improve the user-facing feature you request, to protect the service, to comply with law, or with your consent.

XerAds’ use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Your Data

We use personal and service data to deliver and maintain the Platform, authenticate users, provide support, process payments, protect against abuse, improve user-facing features, and meet legal obligations. We do not sell or rent personal data.

5. AI-Assisted Campaign Planning

When you use Google Ads Planner, the business brief you enter (for example, business name, offer, website, location, objective, and budget) may be sent to the AI provider selected for your workspace to generate the campaign draft you requested. This is separate from Google user data: XerAds does not send Google OAuth data or Google Ads API responses to an AI provider for model training.

6. Sharing and Security

We disclose data only to service providers that help us operate the Platform, when required by law, to protect rights and safety, or with your direction. Access is limited to authorized personnel and systems. We use encryption in transit, encryption for stored sensitive credentials, access controls, and audit logging designed to protect data from unauthorized access, loss, alteration, or disclosure.

7. Retention and Deletion

We retain account and campaign-planning data while your account is active, unless a shorter period is stated for a specific feature. Google Ads keyword-research cache entries expire after 24 hours and are automatically deleted. You may delete individual campaign drafts and keyword-cache entries in the Platform. After an account deletion request, we delete personal data within 30 days unless a longer period is required by law, such as transaction records retained for Indonesian tax obligations.

8. Your Rights and Choices

Subject to applicable law, including Indonesia’s Personal Data Protection Law (Law No. 27 of 2022), you may request access, correction, deletion, or export of your personal data, and withdraw consent for connected services. You can delete available Google Ads cache entries and campaign drafts in the Platform. For account-level deletion, Google-data questions, or requests that cannot be completed in-product, contact privacy@xerads.id.

9. Cookies

We use cookies and similar technologies to maintain login sessions, remember preferences, protect the Platform, and operate analytics in accordance with your choices. See our Cookie Policy for further details.

10. Changes to This Policy

If we make a material change to how we access, use, store, or share Google user data, we will update this policy and provide appropriate notice. Where required, we will obtain your consent before using data for a new purpose.

11. Contact Us

For privacy questions or requests:

• Email: privacy@xerads.id
• Company: PT AMAL DIGITAL STUDIO
• Website: xerads.id/contact