1. Who we are
ROAS OS ("we," "us," "our") is an AI-assisted performance-marketing analytics product. This policy explains what data we collect when you use the app, why we collect it, who we share it with, and the choices you have. Contact us at s4shiva4u00379@gmail.com for any privacy question or request.
2. Data we collect
- Account data: name, email, hashed password (if you sign up with email), or your Google account identifier (if you sign in with Google).
- Business data you provide: brand/company details, targets (CAC, ROAS, budget), and any CSV files you upload.
- Connected ad account data: if you connect a Meta or Google Ads account, we retrieve campaign, ad set, ad, spend, impressions, clicks, and conversion data via the platform's official API (e.g. Meta's Graph API) using an access token you explicitly authorize. We do not request more permissions than the analytics features require.
- Billing data: subscription plan and status. Card details are handled entirely by our payment processor and merchant of record, Paddle — we never see or store your card number.
- Usage data: basic product usage logs (e.g. logins, AI requests, report generation) used for billing limits and abuse prevention.
3. How we use your data
Your data is used only to operate the product you signed up for:
- Computing the KPIs, health scores, campaign recommendations, and budget allocations shown in your dashboard — all of this is deterministic and calculated directly from your own connected/uploaded data.
- Generating written summaries, ad copy, and creative suggestions via the Anthropic API (Claude). When this feature is used, the relevant account metrics are sent to Anthropic solely to generate that response; Anthropic does not use API data to train its models. If no AI key is configured, the product falls back to deterministic template text and no data leaves our servers for this purpose.
- Processing subscription payments via Paddle.
- Operating core account features: authentication, team invites, sharing reports, and support.
We do not sell your data, and we do not use your connected ad-account data for any purpose other than the analytics you've asked us to run on it.
4. Third parties we share data with
- Neon (Postgres hosting) — stores all application data.
- Vercel — hosts and runs the application.
- Anthropic — processes account metrics you choose to run AI features on, to generate the response (see above).
- Paddle — processes subscription payments as our merchant of record.
- Meta / Google — only if you explicitly connect an ad account or sign in with Google; we exchange OAuth tokens with them to retrieve the data you authorized.
We do not share your data with any other third party, and we never sell it.
5. Data retention & deletion
We retain your account and connected-platform data for as long as your account is active. You can disconnect a Meta ad account at any time from Onboarding → Connect Data, which deletes the stored token immediately and stops future syncs (see our data deletion instructions). To request full account deletion, email s4shiva4u00379@gmail.com — we will delete your account and associated data within 30 days, except where retention is required by law (e.g. billing records).
6. Security
Sessions are secured with signed, httpOnly cookies. Passwords are hashed, never stored in plain text. Ad-platform access tokens are stored server-side only and are never exposed to the browser or to any third party outside the platform that issued them.
7. Your rights
You can access, correct, export, or delete your data at any time by contacting us. If you are in the European Economic Area, UK, or India, you have rights under GDPR / the DPDP Act 2023 respectively to access, correct, or erase your personal data, and to withdraw consent for any processing based on consent (such as a connected ad account) at any time.
8. Changes to this policy
We may update this policy as the product changes. Material changes will be reflected by updating the "Last updated" date above.