Privacy Policy
Last updated: October 2, 2026 · XerAds
1. Who We Are
XerAds Platform is operated by PT AMAL DIGITAL STUDIO ("XerAds", "we", "us", or "our"). This policy applies to xerads.id, the XerAds Platform, and related support services.
2. Data We Collect
We collect information needed to create and secure your account, provide requested features, process subscriptions, and operate the Platform.
- Account and contact data, such as your name, email address, password (stored only as a one-way hash), an author profile picture if you upload one, and service communications.
- Usage and technical data, such as features used, pages visited, IP address, browser type, device and operating-system information, and security logs.
- Business and campaign-planning data that you enter, such as business name, website, industry, offer, location, objective, budget, and generated campaign drafts.
- Integration data and credentials you choose to connect, including Google Ads, Meta Marketing API, CMS, and social-media integrations. Sensitive credentials are stored encrypted where retained.
- Payment and subscription information processed by our payment providers. We do not store payment-card or bank-account credentials.
3. Google Data and Google APIs
Sign in with Google. If you sign in with Google, XerAds asks Google only for your basic identity (the openid, email and profile permissions). We store your name and email address to create and secure your XerAds account. Google shows your profile picture on its consent screen, but XerAds does not store it, and we keep no Google token from sign-in.
Linking Google Ads. XerAds manages Google Ads accounts through its own Google Ads manager account. You can link an account in two ways. By customer ID: you enter the account's customer ID, XerAds' manager account sends a link invitation, and an administrator of that Google Ads account accepts it in Google Ads; no Google sign-in is involved, and a XerAds administrator confirms who owns the account before XerAds uses it. With "Connect with Google": you sign in to Google and grant the Google Ads permission (https://www.googleapis.com/auth/adwords). XerAds uses that permission only to list the Google Ads accounts you can access (each account's ID, name, currency, time zone, and whether it is a manager or test account) so you can choose which to link, and to accept the link to XerAds' manager account for the accounts you choose. This token is short-lived and is never stored with your account: XerAds keeps it encrypted for at most 30 minutes while you choose, then deletes it.
Connections through your own Google Cloud project. If you connected Google Ads earlier with your own Google Cloud project, that connection keeps working. XerAds stores its refresh token encrypted. When you disconnect the connection, XerAds asks Google to revoke the token and deletes its own copy.
What XerAds accesses after linking. Once an account is linked to XerAds' manager account, XerAds reads and changes it through that manager account, not through your Google sign-in (a connection through your own Google Cloud project uses that connection's token instead). Depending on the features you use, XerAds accesses the account's ID, name, currency, time zone and link status; campaigns, budgets and bidding settings; ad groups, ads and their text, assets and asset groups; keywords and other targeting criteria; search terms; Google's recommendations; and performance metrics such as impressions, clicks, cost and conversions. XerAds changes an account only at the request of you or someone you have given access to your workspace, directly or through Xera AI or an automation you set up, for example creating and publishing campaigns, pausing or enabling them, changing budgets, adding negative keywords, and applying or dismissing recommendations. Xera AI asks for your approval before it changes a budget, applies or dismisses a recommendation, or enables a campaign. The separate Keyword Planner feature uses XerAds' own Google Ads access to suggest keywords, search volumes, competition and bid ranges; its inputs and results are reused for up to 24 hours and then deleted automatically.
How we use it. We use Google user data only to provide and improve the features you see and use in XerAds: showing your accounts, campaigns, reports and alerts; building and publishing campaigns; making the changes you request; Xera AI answers and actions; and the automations you set up. We also use it where needed for security and to meet legal obligations. We do not use Google user data for advertising, including retargeting or personalized ads. We do not sell it, and we do not give it to advertising platforms, data brokers or information resellers. We do not use it to decide creditworthiness or for lending, and we do not use it to develop, improve or train generalized AI or machine learning models.
Human access. XerAds staff do not read your Google user data, except to link or confirm an account you asked us to manage (they see its ID, name and link status), when you ask us to (for example in a support request), when it is needed for security (such as investigating abuse), or when the law requires it.
Limited Use. XerAds' use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
4. Meta Marketing API
When you connect Meta, we receive the data allowed by your grant or the business partner access you provide. This can include your app-scoped user ID and public profile, ad account and business IDs and names, connected Facebook Page and Instagram account identifiers, campaign, ad set, ad and creative records, budgets, targeting settings, delivery status, and reporting metrics such as reach, impressions, clicks, spend, and conversions.
The standard advertising connection requests public_profile, ads_read, and ads_management to identify the connection, read advertising reports, and manage ads. Optional Meta agent tools, when enabled, may also require business_management, pages_show_list, instagram_basic, catalog_management, and ads_mcp_management for the business assets and tools you choose to use. Availability depends on the permissions Meta grants and your access to each asset.
We use Meta data to show and synchronize your advertising workspace, report results, and execute the campaign and creative operations you authorize. For accounts managed through XerAds partner access, the access is limited to assets assigned for that service. Workspace and agency access controls restrict which customers and team members can use the records.
We do not sell or license Meta Platform Data or use one client's data for another client's advertising. We do not use it for surveillance, unlawful discrimination, eligibility decisions, or unrelated personal profiles. We share it only for the authorized service, on your permitted instructions, or as required by law, subject to Meta's terms.
You can withdraw access through Meta's app or business integration settings, or remove the relevant business partner or asset access. All users may request deletion at privacy@xerads.id or follow our Data Deletion instructions. We also process verified deletion requests sent by Meta. Removing a connection and deleting stored data are separate actions, as explained below.
5. How We Use Your Data
We use personal and service data to deliver and maintain the Platform, authenticate users, provide support, process payments, protect against abuse, improve user-facing features, and meet legal obligations. We do not sell or rent personal data.
6. AI-Assisted Features and Xera AI
When you use an AI feature, such as content generation, campaign planning or Xera AI, the brief, prompt and content you supply are sent to the AI provider that runs that feature for your workspace. Contact us for the providers used for your workspace.
Google Ads data is handled more strictly. Xera AI's Google Ads tools run only when the conversation uses Anthropic (Claude), OpenAI or Google (Gemini), and refuse to run on any other provider. When Xera AI or one of your automations uses a Google Ads tool, the data the tool returns (for example campaign settings, search terms and metrics) goes to that provider so it can answer your request or carry out the task you asked for. XerAds' own access to these providers is through their paid business APIs, whose terms do not allow the provider to train its models on that data; an agency that runs Xera AI on its own API key is responsible for that key's terms. XerAds does not use Google user data to train AI models either. Requests to OpenAI ask it not to store them. If you later switch such a conversation's agent to another AI provider, what the conversation already contains is sent to that provider, and a memory saved from it reaches the provider your other conversations use (see below).
Xera AI keeps your conversations, including the Google Ads data its tools returned, in your conversation history until you delete the conversation. Xera AI may suggest facts to remember from a conversation and uses a suggestion only after you approve it; when you ask Xera AI to remember something, it saves it without a separate approval. Saved memories are used in later Xera AI conversations in your workspace, whatever AI provider those use, and are kept with your XerAds account until the account is deleted. Do not enter passwords, access tokens, or personal customer lists into prompts.
8. Retention and Deletion
We keep your account information while you use XerAds, and the data of each ad account you link for as long as it stays linked.
When a Google Ads account stops being linked to XerAds (you remove it from XerAds, you disconnect it, you or another administrator end XerAds' manager link in Google Ads, or, for a connection made through your own Google Cloud project, Google rejects its token when XerAds next tries to use it), XerAds stops reading and changing it. 30 days later, XerAds automatically deletes its copy of that account's data: the campaigns, budgets, ad groups, ads, keywords, assets and other settings it read from Google, Google's review results for your ads, the performance metrics and the alerts based on them, and any token still stored for the connection. XerAds keeps the account's customer ID and name, the record of the link, and the audit record of changes made through XerAds, with any email addresses removed. Campaigns you built in XerAds, with the record of what XerAds published from them, and your Xera AI conversations stay in your workspace until you delete them or your account.
You can remove XerAds' access from Google at any time: for Sign in with Google and "Connect with Google", at https://myaccount.google.com/connections; for the manager link, in Google Ads under Admin > Access and security > Managers. Ending the manager link there has the same effect as removing the account from XerAds, including the deletion of our copy of its data 30 days later. Live campaigns keep running in Google Ads until you pause or end them there.
To delete your XerAds account and its data, email privacy@xerads.id from the address registered to your account and name the account. Do not send passwords or tokens. After verifying the request, we delete the account, revoke the Google tokens it holds, end its Google Ads manager links and delete its ad data. We complete a request within 30 days, unless the account has a record the law requires us to keep, such as the history of credits bought and used in it. Deleting such an account can take longer: we keep only that record, only for that purpose, and tell you when the rest has been deleted. Removing a Google Ads account from XerAds, as described above, does not wait for this: its data is deleted 30 days after the link ends.
Meta data is deleted on a valid request from you or from Meta, or when your XerAds account is deleted; see section 4 and our Data Deletion page. Disconnecting a Meta connection clears its stored tokens.
9. Your Rights and Choices
Subject to applicable law, including Indonesia's Personal Data Protection Law (Law No. 27 of 2022), you may request access, correction, deletion, or export of your personal data and withdraw permission for connected services. Use the available disconnect and deletion controls, or email privacy@xerads.id if you cannot access your account or the required control.
Google access can also be removed from your Google Account's third-party connections page, and XerAds' Google Ads manager link can be ended in Google Ads under Admin > Access and security > Managers; for Google Ads, ending the link starts the deletion described in section 8. Meta access can be removed from Apps and Websites or Business Integrations; business partner and asset permissions are managed in Meta Business Settings. For Meta, withdrawing access prevents future API activity through that grant but does not by itself erase records already stored; section 8 and our Data Deletion page explain how to request deletion.
11. Changes to This Policy
If we materially change how we access, use, store, or share Google or Meta data, we will update this policy and provide appropriate notice. We will obtain any renewed consent and platform approval required before using data for an additional purpose.
12. Contact Us
For privacy questions or requests:
- Email: privacy@xerads.id
- Website: xerads.id/contact