Privacy Policy

elevAIt ("elevAIt", "we", "us") is a digital agency based in Greece and is the data controller responsible for the personal data described in this policy.

Address

Vasilissis Olgas 24, Marousi 15124, Greece

Email

info@elevait.gr

Phone

+30 6972 778 979

We collect only what we need in order to respond to you and to operate our services.

Information you give us

• Contact form: your name, email address, an optional subject line, and the content of your message.
• Direct correspondence: anything you choose to include when you email, call, or message us.

Information collected automatically

• Analytics data: pages visited, approximate location, device and browser type, referring site, and interaction events, collected through Google Analytics 4.
• Server logs: our hosting provider records IP addresses, request timestamps, and user-agent strings as part of normal operation and abuse prevention.

We do not collect special categories of personal data (such as health, biometric, or political data), and we do not knowingly collect payment card details through this website.

• To read and reply to enquiries you send us.
• To provide, maintain, and support the services a client has engaged us for.
• To understand how our website is used, so we can improve it.
• To keep our site and services secure and to prevent abuse.
• To meet legal, accounting, and regulatory obligations.

We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.

Where the GDPR applies, we rely on the following legal bases under Article 6:

• Consent — for analytics cookies and for optional marketing communications. You may withdraw consent at any time.
• Performance of a contract — to deliver services to our clients and to take steps at your request before entering a contract.
• Legitimate interests — to respond to enquiries, secure our systems, and improve our services, where those interests are not overridden by your rights.
• Legal obligation — to comply with tax, accounting, and other statutory requirements.

We use Google Analytics 4 to measure traffic and understand how visitors use the site. It sets cookies and processes usage data, including a truncated IP address, on our behalf. This helps us see which pages are useful and where the site can be improved.

You can block or delete cookies through your browser settings, or opt out of Google Analytics entirely using the Google Analytics Opt-out Browser Add-on. Blocking cookies will not prevent you from using the site.

elevAIt operates a small suite of internal command-line tools that connect to the Google Ads API in order to manage and report on the advertising accounts of the agency's own clients. This section describes that access in full, for transparency and to meet the disclosure expectations of the Google Ads API Terms and Conditions.

Nature of the tooling

The tooling is internal and single-operator. It consists of Python scripts run locally by the agency principal. It is not a product: there is no user interface exposed to anyone outside elevAIt, no hosting, no public endpoint, no sign-up, and no resale or distribution to third parties. No mobile application is involved.

Scope requested, and what it is used for

The tooling requests a single OAuth 2.0 scope, https://www.googleapis.com/auth/adwords, which grants access to the Google Ads API. It is used for four things:

• Reporting — reading campaign, ad group, ad and placement performance (spend, impressions, reach, clicks, CTR, CPM, conversions) so Google Ads figures can be included in the agency's weekly client reports, and to diagnose traffic quality.
• Campaign management — applying negative placement and content exclusions, adjusting budgets and bidding strategies, and pausing or enabling campaigns and ad groups.
• Campaign creation — building correctly configured Search and Display campaigns with exclusions and conversion tracking applied from the outset.
• Account management — reading account settings and conversion actions to verify that conversion tracking is correctly configured and linked to Google Analytics 4.

The tooling does not use Keyword Planning Services, does not create Google Ads accounts, and does not use the App Conversion Tracking and Remarketing API.

Whose accounts are accessed

Access is limited to Google Ads accounts that elevAIt operates directly under its own manager account, with the account owner's authorisation, or that have been explicitly authorised through it. The tooling is not used to access accounts belonging to unrelated advertisers, and no API data is exposed to any third party.

Who uses it

One person: the agency principal, authenticating with their own Google Account. There are no other users, no user accounts, and no multi-tenant access. Client staff receive the output of the tooling — reports and spreadsheets — but never interact with the tool or with the API.

What data is accessed, and what is not

The data retrieved is aggregate advertising performance and account configuration data belonging to the advertising accounts described above. No end-user personal data is requested, stored, or processed through the Google Ads API, and no profile of any individual consumer is built from it.

Storage and security

• The tooling runs locally on a single machine operated by the agency principal. There is no server, no hosted component and no public endpoint.
• All API calls are made server-side from that machine over encrypted connections (TLS), authenticated with OAuth 2.0.
• OAuth client credentials, refresh tokens and the developer token are stored in the operator's home directory with owner-only (0600) file permissions, outside any source-control repository.
• API responses are used to generate aggregate performance reports and are not retained beyond what those reports require.

Sharing

Reports are shared only with the client that owns the corresponding advertising account. No Google Ads API data is sold, redistributed, or passed to any third party.

Revoking access

The agency principal can revoke the tooling's access at any time at myaccount.google.com/permissions. A client may withdraw elevAIt's access to their advertising account at any time from within their own Google Ads account, or by emailing info@elevait.gr. On withdrawal we stop accessing the account and delete the stored credentials relating to it.

Compliance

We share personal data only with service providers who process it on our behalf under contract, and only to the extent needed:

• Vercel — website hosting and server logs.
• Google (Analytics) — website usage measurement.
• Google (Ads API) — access to client advertising accounts for reporting and campaign management, as described in section 6.
• Our email provider — delivery of messages sent through the contact form.

We may also disclose data where we are legally required to do so, or where it is necessary to establish, exercise, or defend legal claims.

Some of our providers process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard recognised under Chapter V of the GDPR.

• Contact enquiries: kept for up to 24 months after our last exchange, unless they become part of a client relationship.
• Client records: kept for the duration of the engagement and for as long as tax and accounting law requires afterwards.
• Analytics data: retained according to our Google Analytics configuration, currently 14 months.
• Server logs: retained on a short rolling window by our hosting provider.

All traffic to this site is served over HTTPS. Credentials and API keys are held in encrypted environment variables and are never committed to source control. Access to systems holding personal data is limited to those who need it. No system is perfectly secure, but we take reasonable and appropriate measures to protect your data, and we will notify you and the competent authority where a breach requires it.

If you are in the EEA or the UK, you have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time.

To exercise any of these, email info@elevait.gr. We will respond within one month. If you believe we have handled your data improperly, you may lodge a complaint with the Hellenic Data Protection Authority at dpa.gr.

Our website and services are not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as our services or legal obligations change. The revised version will be posted on this page with a new "last updated" date. Material changes affecting how we use Google user data will be communicated to affected users directly where feasible.

Questions about this policy or about how we handle your data can be sent to info@elevait.gr, or by post to elevAIt, Vasilissis Olgas 24, Marousi 15124, Greece.