Legal
Privacy Policy
Last updated: 6 November 2026
1. Who we are
Optizads is run by Afef Ayed, entrepreneur individuel (EI) registered in France under SIREN 902 750 165, 13 rue Sainte Ursule, 31000 Toulouse, France. For any question about your data, write to support@optizads.com.
This policy covers the website optizads.com, the Optizads app at app.optizads.com and Oppy in Slack. It explains what we collect, why, who receives it, how long we keep it and your rights under the General Data Protection Regulation (GDPR) and the French data protection law.
We are the controller of the data about you as a visitor, as a user and as a customer. The data in a workspace, such as the data of the advertising accounts it connects and the files it uploads, is processed for the business that owns the workspace: that business is the controller and we are its processor, as set out in our Terms of Service. For that data, contact the business first. We will help it answer you.
2. What we collect
When you visit optizads.com
- The website sets no cookies. If you choose a light or dark theme, your choice is kept in your browser’s storage on your device and is not sent to us.
- Our host, Vercel, records technical data when a page is loaded, such as your IP address, your browser, the page requested and the time, to deliver the site and keep it secure.
- The live website asks before it loads Google Tag Manager, a Google service. If you accept, loading it sends Google your IP address and information about your browser, and the tags in it may measure your visit. If you refuse, it does not load. Your answer is kept in your browser’s storage.
Your account
- Your name, your email address and, if you sign in with Google, the profile picture of your Google account.
- Your language and display preferences, the workspaces you belong to and your role in each.
- Sign-in records and security logs, including a keyed hash of each device you sign in from, when we check new devices.
When you sign up
- The answers you give on the sign-up form, such as your name, email address, website, role, monthly ad spend and the ad platforms you use, and, if you give them, your phone number, how you heard of us and your note. We email you a code to prove the address is yours.
- A bot check from Cloudflare (Turnstile), which runs in your browser on the sign-up page.
- Your network: your IP address is checked with ipapi.is, to tell whether it belongs to a VPN, a proxy or a data centre. We keep a keyed hash of the address, never the address itself, with the country, region and city your connection points to and the kind of device you use. These network details are cleared after 30 days. Your answers stay with your request.
Your workspace
- Its name and brand: logo, colours, your own domain and the reply address of your emails, if you set them.
- The email addresses of the people you invite and of the people who receive your reports.
- Your messages to Oppy, in the app or in Slack, your comments, tasks and notes, and the files you upload, such as sales exports, documents and images.
- Your settings, including the mode and the money limits that apply to changes.
- The data of the Google services you connect, described in section 5, of the Meta and LinkedIn ad accounts you connect, described in section 6, of Slack if you add Oppy to it, described in section 7, and of the AI apps and API keys that reach your workspace, described in section 8.
- Your business’s Knowledge: the pages of its public website and the public profiles it names, which the app reads and keeps, the notes your team writes, and the facts about the business that someone states to Oppy.
- The tools you connect with a key, if you do: Odoo and Mercury (figures by day), Sanity (published documents) and your work tool (the tasks you sync with it).
Billing
Our payment provider, Stripe, collects your card details: we never see or store your full card number. Stripe keeps your company name, billing email and address, VAT number and invoices, which we can see. In our own systems we keep your plan, your billing status and your Stripe customer reference.
How you use the app
On app.optizads.com only, and only if you accept it when the app asks, our analytics tool, PostHog, records how the app is used: the pages you open, your clicks and scrolling, errors and console messages, and recordings of your sessions that show the screen as you saw it, including the text on screen. What you type in fields stays hidden. These records are linked to your user identifier and email address. You can say no, or change your mind at any time in the app's account menu, under Manage account. PostHog also receives records of the AI requests behind Oppy, which can include the question and the answer, with the identifiers of the workspace and ad account concerned. We keep them to find and fix problems in Oppy’s answers.
When you contact us
The emails you send us. If you book a call from the app, the booking tool Cal.com receives the name, email address, time and notes you enter.
Public business information
To check your settings and know your business, the app reads public business information: the pages of your website and the public profiles it names, kept in your workspace’s Knowledge, the public address of a shop from Google Maps, which is not stored, and pictures that represent your accounts.
Where it comes from, and what is required
Some of this data comes from others: the person who invites you, or adds you as a recipient of reports, gives us your email address, and the platforms and tools you connect give us their data. You need to give us your name and email address to create an account, and your billing details to subscribe. Without them we cannot provide the Service. The rest is optional, but some features need it.
3. Why we use your data and on what legal basis
- To provide the Service (your account, audits, plans, tasks, chat, reports, the changes you approve or allow, the emails you set up): the contract with your company. For the team members a customer invites, our legitimate interest, shared with the customer, in providing the Service to its team.
- Billing, invoices, accounting and taxes: the contract and our legal obligations.
- Security, and preventing fraud and abuse, including logs and the checks of new sign-ups: our legitimate interest in protecting the Service and its users.
- Support and the specialist reviews you ask for: the contract.
- Understanding how the app is used, and finding and fixing problems (PostHog usage records and session recordings): your consent, asked in the app before anything is recorded, as French law requires for trackers that are not strictly necessary (article 82 of the Loi Informatique et Libertés). Records of AI requests: our legitimate interest in providing answers that are right.
- Measuring visits to optizads.com and which ads lead to a sign-up (Google Analytics, Google Ads): your consent, asked in the cookie panel for each purpose separately, under article 82 of the Loi Informatique et Libertés.
- Answering your messages and the calls you book: our legitimate interest, or steps taken at your request before a contract.
- News about the Service, if we send it to customers: our legitimate interest. Each such email lets you stop them at any time.
- Complying with the law, and establishing or defending legal claims: our legal obligations and our legitimate interest.
4. How Oppy uses AI
To answer questions and write tasks, plans and reports, the app sends what each request needs (your question, the relevant account data and parts of your files) to AI models through OpenRouter, which routes each request to Anthropic, Amazon Bedrock or Google Vertex AI. These requests may be processed outside the European Union, including in the United States.
To search a business’s Knowledge by meaning, passages of its text are sent through OpenRouter to an embedding model made by OpenAI, which turns each passage into a list of numbers kept in our database. The text itself stays in your workspace.
We do not use your data to train AI models. Under their own terms, these providers do not use the data sent through their programming interfaces to train their models. The questions and Oppy’s answers are stored in your workspace.
Oppy makes no decision with legal effects, or similarly significant effects, about a person. The changes it applies in Autonomous mode concern advertising campaigns, within the limits the customer sets.
5. Data from Google
With your permission, given on Google’s own screen, the app accesses:
- Sign in with Google: your name, email address and profile picture.
- Google Ads: your accounts’ campaigns, ad groups, keywords, search terms, ads, assets, budgets, bids, conversion settings, performance and change history. The app applies the changes you approve or allow.
- Google Analytics 4, read only: your properties, conversions, revenue and traffic data.
- Google Merchant Center: your products, prices and their status. When you approve such a task, the app adds improved product titles through a supplemental data source, or a Shopping promotion through a promotions data source.
- Google Search Console, read only: search queries, pages, clicks and impressions.
- Google Data Manager: to send to Google Ads the conversions from the sales files you upload.
- Google Sheets, read only: only the sheets you pick in Google’s file picker or add by their link, to show a figure from them in the app and let Oppy read them. The file picker gives the app the files you pick in it, and nothing else of your Google Drive.
How we use it. Only to provide and improve the features you use in Optizads (audits, plans, tasks, answers, reports and changes), to keep the Service secure, and to comply with the law.
Who receives it. Only the providers that run these features, listed in section 9, each bound by contract to protect it: our host and database, the AI providers that produce Oppy’s answers, and our analytics tool, which records sessions to find and fix problems. We never sell it, never use it for advertising and never use it to develop, improve or train generalized AI or machine learning models.
Who reads it. Our team reads your Google data only with your permission, for security, to comply with the law, or in aggregated and anonymous form for our internal operations. Your permission is given when you ask a specialist to review a task, when you report a problem and ask us to look at it, or when you accept usage recording in the app, whose replays can show your Google Ads data. Records of AI requests are read only to investigate a problem you reported, or for security.
How it is protected. It is stored in our database in Ireland, and the access tokens Google gives us are encrypted.
How to stop it. You can remove Optizads’ access at any time in your Google Account settings. Deleting a workspace deletes the Google data we stored for it. You can also ask us to delete it.
Optizads’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Data from Meta and LinkedIn
With your permission, given on Meta’s or LinkedIn’s own screen, the app accesses the ad accounts you choose:
- Meta Ads: the ad accounts your login reaches, their campaigns, ad sets, ads and creatives, budgets, bids and performance, pixels and custom audiences, the Pages your ads run as, the business that owns the account and Meta’s recommendations. The app applies the changes you confirm or allow.
- LinkedIn Ads: the ad accounts your login reaches, their campaign groups, campaigns and ads, budgets, bids, targeting and performance, conversion rules, Lead Gen Forms and audiences, and the posts of the company Page your ads run from. The app applies the changes you confirm or allow. Of a contact list you choose to send, LinkedIn receives only the hashed email addresses, never a name.
How we use it. Only to provide the features you use (audits, plans, tasks, answers, reports and the changes you confirm), to keep the Service secure, and to comply with the law. We never sell it, never use it for advertising and never use it to train AI models.
How long. LinkedIn lets us keep an ad account’s figures for a year: older days are deleted. Removing an ad account in Optizads, or deleting the workspace, deletes everything we kept of it.
How it is protected. It is stored in our database in Ireland, and the access tokens Meta and LinkedIn give us are encrypted.
How to stop it. Remove Optizads’ access in Meta’s Business Integrations settings or in your LinkedIn settings (Data privacy, Permitted services), or remove the ad account in Optizads.
7. Data from Slack
If your workspace adds Oppy to Slack, Slack sends us the following, with the permission a Slack admin gives on Slack’s own screen:
- The Slack workspace: its name and identifier, and the access token Slack gives Oppy.
- The people who use Oppy: their Slack identifier, linked to their Optizads login once they confirm it with the one-time link Oppy sends them. Their Slack display name is read when we show it, on that link’s page and in Settings, and is not stored.
- Channels: the identifiers of the channels Oppy is in, with the account and the settings an admin chooses for each.
- Messages and actions: Slack sends Oppy its direct messages and the messages of the channels it is in. We keep only what is meant for Oppy: direct messages, mentions, /oppy commands, the messages someone hands to Oppy, links to the app shown as cards, the buttons pressed on Oppy’s messages, and every message of a channel where an admin asked Oppy to answer each one. The others are not kept.
How we use it. Only to answer the people who write to Oppy, to post what they ask for or set up (answers, changes to confirm, tasks, alerts, briefings and reports), and to keep each conversation in your workspace’s Chat. As with any question to Oppy, a message and what its answer needs go to the AI models described in section 4.
What we never do. We never use Slack data to train AI models, never use one organization’s Slack data for another, never sell it and never use it for advertising.
What Slack keeps. What Oppy posts in Slack is held by Slack, under your organization’s own agreement with Slack.
How long. The messages and actions Slack sends us are deleted after 30 days. A conversation with Oppy stays in your workspace like any other, until it or the workspace is deleted. Remove Slack in an ad account’s Settings, Integrations deletes that account’s channel settings. Removing Oppy from Slack, or Remove Slack on the last account it was added to, deletes the access token, the links between Slack people and Optizads logins, the channel settings and the messages still stored.
How it is protected. It is stored in our database in Ireland, and the access token Slack gives us is encrypted.
8. Data through Claude, ChatGPT and the API
If someone on your workspace’s team connects an AI app such as Claude or ChatGPT to Optizads, or an admin makes an API key for your own agents, we keep the following:
- The connection: for an app, the person who connected it, the app’s name and identifier, the workspace they chose, and when it was connected and last used. The sign-in itself runs on Supabase, listed in section 9, which issues the app’s access tokens. For a key: its name, what it may do, the ad accounts it reaches and its daily limit, with a one-way fingerprint of the key, never the key itself.
- What a tool is asked: only the details of the request, such as a task’s new words, a question for Oppy or a design’s brief. The app never sends us your conversation, and we never ask for it. A question for Oppy is kept with his answer as a conversation in the person’s Chat in Optizads, as one asked there, and answered through the AI providers listed in section 9.
- A yes or a no on a change Oppy prepared: recorded as the person’s, with the change and how it ended, in the account’s history, as when it is given in Optizads.
- A line for each call: which tool, when, the account, task or design it was about, and whether it worked.
What the tools return. Only what the person or the key may open in that workspace: the ad accounts’ names, identifiers and figures (such as spend, clicks and conversions, by day or by campaign), their campaigns, keywords and search terms, the goal, the plan and the latest audit, the changes made through Optizads with the name of who decided them, what Optizads keeps about the business (its website’s pages, notes and files), the reports’ names, Oppy’s answers, tasks with their words, status, priority, dates and the name of the person they are assigned to, comments with their authors’ names, and designs with links to their files, each good for an hour. What a tool returns goes to the app’s provider (for example Anthropic or OpenAI) under your own agreement with them.
What we never do. We never use this data to train AI models, never sell it and never use it for advertising.
How long. The connections and the lines for each call stay with your workspace until it is deleted. Removing an app or revoking a key stops it at once.
How it is protected. It is stored in our database in Ireland. Every call is checked against the person’s or the key’s rights before anything is read or changed.
9. Who receives your data
We share data only with the providers that help us run Optizads, each for its own task and bound by contract to protect it:
- Vercel: hosting of the website and the app. The app runs on servers in Dublin, Ireland, and pages are delivered through Vercel’s worldwide network.
- Supabase: database, sign-in and file storage, in Ireland.
- Google: sign in with Google, the Google services you connect, Google Maps Platform for public business addresses, and Google Tag Manager on optizads.com.
- OpenRouter, and the model providers it routes to (Anthropic, Amazon Web Services through Amazon Bedrock, Google Cloud through Vertex AI, and OpenAI for searching a business’s Knowledge by meaning): the AI behind Oppy.
- PostHog: analytics, session recordings and error reports in the app.
- Stripe: payments, invoices and VAT.
- Resend: sending emails, such as sign-in links, invitations, alerts and reports.
- Cal.com: booking calls from the app.
- Cloudflare: the bot check on the sign-up page (Turnstile).
- ipapi.is: telling whether the network of a sign-up is a VPN, a proxy or a data centre. It receives the IP address only.
Data is also seen by:
- our team, and the specialists who work for us, bound by confidentiality, when needed for the Service, support, security or the law;
- the members of your workspace, and the people you send reports to. A report you share by link can be opened by anyone who has the link;
- Meta and LinkedIn, for the ad accounts you connect: they receive the changes you confirm or allow, and the audiences you send them;
- Slack, if your workspace adds Oppy to it: what Oppy posts there is held by Slack, under your organization’s agreement with Slack;
- the work tools you connect, which receive the tasks you sync with them;
- authorities, when the law requires it;
- a company that takes over the Optizads business, if that happens. We will tell you beforehand.
We do not sell your data and we do not share it for advertising.
10. Transfers outside the European Union
Several of our providers are based in the United States or may process data there, in particular OpenRouter and the AI model providers, PostHog, Stripe, Resend, Google, Cloudflare, Cal.com and Vercel. These transfers rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for the companies certified under it, or on the standard contractual clauses adopted by the European Commission. Write to us to get a copy of the safeguards that apply.
11. How long we keep your data
- Workspace data is kept as long as the workspace exists. Deleting a workspace deletes its data and its files. We keep only the record of the actions our team took in it (for security), the billing records the law requires us to keep (ten years for accounting documents in France), and AI cost records that are no longer linked to the workspace. Removing an ad account deletes everything kept of it.
- LinkedIn figures are kept for a year at most, as LinkedIn requires.
- Sign-up checks: the network details of a sign-up (the keyed hash of its address, its place and its device) are cleared after 30 days. The answers you gave stay with your request.
- Slack: the messages Slack sends us are deleted after 30 days. Removing Oppy from Slack deletes its access token, the links between Slack people and Optizads logins, and the channel settings. Conversations with Oppy are workspace data.
- Your personal account is kept until you ask us to delete it. We delete it within one month of your request, except for what the law requires us to keep.
- Backups: deleted data can remain in our backups for a limited time.
- Hosting and security logs, and app analytics and recordings, are kept for a limited time, then deleted.
- The emails we exchange are kept for up to three years after our last exchange.
12. How we protect your data
- All connections to the website and the app are encrypted (HTTPS).
- The access tokens Google, Meta, LinkedIn and Slack give us, and the keys of the tools you connect, are stored encrypted.
- Sign-up checks keep a keyed hash of a network address, never the address itself.
- Our database and files are hosted in Ireland. The database is backed up every day.
- Access is limited to the people who need it, and the actions our team takes in workspaces are logged.
- Our providers are bound by contract to protect your data.
13. Your rights
You can ask us at any time to:
- access your data and get a copy of it;
- correct it, or delete it;
- limit its use, or object to its use, including to any use based on our legitimate interest, and to our news at any time;
- receive the data you gave us in a common format, to reuse it elsewhere;
- withdraw a consent you gave, without affecting what was done before;
- follow your instructions on what happens to your data after your death.
Write to support@optizads.com. We may ask you to prove your identity. We answer within one month. For a complex request, this can be extended by two months, and we will tell you why.
For data in a workspace, write to the business that owns it. If you write to us, we pass your request on to that business.
If you think your rights are not respected, you can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of the country where you live or work.
15. Children
Optizads is a service for businesses. It is not meant for children, and we do not knowingly collect their data.
16. Changes to this policy
We publish every change on this page, with its date. For a change that matters, we tell our customers by email or in the app before it applies.
17. Contact
For any question or request about your data, write to support@optizads.com.