Privacy Policy

1. Controller

Daniel Klose, Talstraße 62, 55218 Ingelheim, Germany
Phone: +49 171 1656423 · Email: info@daniel-klose.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2. Hosting

AdLoop Cloud runs on European infrastructure: the MCP service on servers operated by Hetzner Online GmbH (Germany), the dashboard and database on Laravel Cloud in the AWS Frankfurt region (Germany). When you visit the website, IP addresses, meta and communication data, and website access data may be processed.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure, efficient provision of the service (Art. 6(1)(f) GDPR).

3. Your rights

You have the right at any time to obtain information about your stored data, rectification of inaccurate data, erasure (unless retention obligations apply), restriction of processing, data portability, and withdrawal of any consent you have given. Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object on grounds relating to your particular situation. You may also lodge a complaint with the competent supervisory authority.

4. Cookies

Cookies are small data packets stored on your device. We use the following categories:

• Necessary cookies: required for operation (session, CSRF protection). Always active.
• Analytics cookies: for website analytics (Google Analytics). Only with your consent.
• Marketing cookies: for advertising and remarketing (Google Ads, Reddit Ads). Only with your consent.

Google Consent Mode v2: We use Google Consent Mode v2. The analytics and marketing scripts are technically loaded but respect your cookie settings: without your consent, no cookies are set and no personal data is collected. In that case only anonymized, cookieless signals are transmitted that do not allow conclusions about individual users.

Open cookie settings

5. Registration

When you register, we store your name, email address, and password (encrypted) to provide the platform. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

5a. Transactional emails (Resend)

We use the service Resend to deliver account-related emails (e.g. email address verification, password resets, security and account notifications). Emails you send to addresses on our domain (e.g. support requests) are also received via Resend and forwarded to our mailbox. We do not send newsletters or marketing emails.

• Provider: Plus Five Five, Inc. (d/b/a "Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA.
• Data processed: name, email address, the content of the respective message, and technical delivery data (e.g. time and delivery status).
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for security notifications and the forwarding of inbound email additionally our legitimate interest in secure operation and reachable support (Art. 6(1)(f) GDPR).
• Data transfers: processing takes place on servers in the USA. Resend is certified under the EU-US Data Privacy Framework; in addition, a data processing agreement including the EU Standard Contractual Clauses is in place.
• More information: resend.com/legal/privacy-policy

6. Your Google account connection

The core of the service is connecting your Google accounts (Google Ads, Google Analytics, Google Tag Manager, Google Search Console, Google Merchant Center) to AI tools of your choice.

• Stored data: one OAuth refresh token (encrypted; the key is held outside the database), your Google email address, the permissions you granted, and the account IDs you selected (Google Ads customer ID, GA4 property, GTM container, Search Console property).
• No storage of campaign or analytics data: AdLoop Cloud operates as a pass-through. Advertising and analytics data are fetched from Google at your AI tool's request and forwarded directly, without being stored by us.
• Change log: write changes to your advertising accounts are logged for accountability (type of change, time, affected account).
• Disconnect anytime: disconnecting in the dashboard revokes the access at Google and deletes the stored token.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Google API Services — Limited Use: AdLoop Cloud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

With whom we share, transfer, or disclose Google user data:

• The AI assistant you connect (e.g. Claude, ChatGPT, Cursor, Gemini): data you request is transmitted into your AI session at your instruction. Your AI provider processes it under its own terms — connect only tools you trust.
• Our hosting processors (Hetzner Online GmbH, Germany; Laravel Cloud, AWS Frankfurt region): technical infrastructure through which the data transits and on which the encrypted token is stored (see section 8).
• No one else. We do not sell Google user data, do not share it with advertisers or data brokers, do not use it for our own advertising, and do not disclose it to any other third party unless legally required.

No AI/ML training: We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

How we protect Google user data (sensitive data):

• All data transfers are encrypted in transit (TLS).
• The OAuth refresh token is stored with authenticated encryption (libsodium XSalsa20-Poly1305) at rest; the encryption key is held outside the database, so a database leak alone cannot expose tokens.
• Access to your Google data requires your personal API key or an OAuth grant; keys can be revoked at any time and restricted to individual client accounts.
• Campaign and analytics data are never stored on our servers (pass-through only); write changes are recorded in an audit log.
• Hosting is located in the EU (Germany); access to production systems is restricted to the controller.
• Disconnecting your Google account revokes the grant at Google and deletes the stored token immediately.

7. Google Analytics

We use Google Analytics 4 (GA4) to analyze website usage. We employ Google Consent Mode v2: the analytics scripts are technically loaded but set no cookies and store no personal data without your consent. Personalized tracking only takes place after your explicit consent.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Data collected: page views, session duration, devices and browsers, approximate location (country/region). IP addresses are automatically anonymized by GA4.
• Legal basis: consent (Art. 6(1)(a) GDPR), revocable at any time via the cookie settings.
• Data transfers: transfers to the USA are possible. Google is certified under the EU-US Data Privacy Framework.
• More information: policies.google.com/privacy

7b. Reddit Ads

We use the Reddit pixel for conversion tracking of our advertising campaigns on Reddit. Reddit has no equivalent of Google Consent Mode — so a stricter rule applies here: without your consent the Reddit pixel is not loaded at all and no data whatsoever is transmitted to Reddit, not even anonymized signals.

• Provider: Reddit Netherlands B.V., Strawinskylaan 4117, 1077 ZX Amsterdam, Netherlands (for users in the EEA).
• Data collected: interactions with Reddit ads (incl. click IDs), conversions (e.g. registrations), device and browser information.
• Purpose: measuring the effectiveness of our Reddit campaigns and optimizing ad delivery.
• Legal basis: consent (Art. 6(1)(a) GDPR), revocable at any time via the cookie settings.
• Data transfers: transfers to the USA (Reddit, Inc.) are possible, based on EU standard contractual clauses.
• More information: reddit.com/policies/privacy-policy

8. Processors

• Hetzner Online GmbH (Germany) – hosting of the MCP service
• Laravel Cloud (USA, data processing in the AWS Frankfurt region) – dashboard and database
• Plus Five Five, Inc. (Resend) (USA) – delivery of transactional emails and receipt of emails to our domain (see section 5a)
• Google Ireland Limited (Ireland) – Google Ads / Google Analytics APIs (at your instruction) and website analytics (only with consent)
• Mintlify, Inc. (USA) – hosting of the documentation site (docs.getadloop.com). No account or campaign data is processed there; only standard server access data occurs, and no cookies are set.
• Reddit Netherlands B.V. (Netherlands) – conversion tracking for Reddit advertising campaigns (only with consent)

All processors were selected carefully and meet the requirements of the GDPR.

If you use AdLoop Cloud as a processor for data you are responsible for yourself (e.g. as an agency managing client accounts), our data processing agreement under Art. 28 GDPR applies. It is concluded electronically (Art. 28(9) GDPR) and takes effect upon registration and use — no signature required. You can view it at any time and save it as a PDF.

9. SSL encryption

This site uses SSL/TLS encryption to protect data transmission. You can recognize an encrypted connection by the "https://" in the address bar and the lock icon.