Privacy Policy

1. Who we are

Advaro (“Advaro”, “we”, “us”) is operated by Eberything Limited, registered in Hong Kong SAR, at 3 Arbuthnot Road, Hong Kong. Contact: support@advaro.co. Product sites: https://advaro.co and https://app.advaro.co.

For the Advaro product account (login, billing, support), we typically act as a data controller. For Google Ads account data and any customer, lead, or messaging data you connect so we can operate your campaigns, we typically act as a data processor / service provider on your instructions. You remain the controller of that merchant and end-customer data, and the advertiser of record in Google Ads.

2. Scope

This policy describes how we handle personal data and account data when you use Advaro’s marketing site, waitlist, free tracking audit, application, or related services. It also explains how we use Google user data obtained through Google OAuth and the Google Ads API, in line with Google’s API Services User Data Policy (including Limited Use requirements where they apply).

3. Google Ads data and the adwords scope

When you connect a Google Ads account, Advaro requests the Google OAuth scope https://www.googleapis.com/auth/adwords. That scope can include read and write access to linked accounts (including under a manager / MCC relationship if you grant it). We use this scope only to:

• Read campaign, ad group, keyword, asset, conversion, audience, and performance data needed to diagnose tracking, reconcile verified outcomes, report, and propose improvements.
• Write only changes you have approved in Advaro, or that fall within policies and autonomy stages you have explicitly enabled. We do not change budgets, bid strategies, or primary optimization targets without your explicit approval.

We do not sell Google user data. We do not use Google Ads data to serve ads to third parties, to build independent advertising profiles, or for purposes unrelated to providing Advaro to the merchant who authorized access. Data obtained via Google APIs is used only to provide, maintain, and improve Advaro’s merchant-facing features described on our site. Human review of Google user data is limited to what is needed for support, security, abuse prevention, or to operate the Service you requested.

4. What we collect

• Account data: work email, name you provide, business profile, goals, preferences, and waitlist / audit requests (website URL and email).
• Google OAuth tokens, Google account identifiers, Google Ads customer IDs, manager (MCC) links, and campaign configuration you authorize.
• Operational data from channels you connect (for example WhatsApp Business, CRM, CSV, or booking logs): lead / booking records, GCLIDs when available, and structured extraction results (e.g. booking confirmed). This may include personal data of your customers if you send it to us.
• Usage, diagnostics, security logs, and support communications.
• Payment and billing identifiers if you purchase a paid plan (processed by our billing provider; we do not store full card numbers).

5. Legal bases (pilot markets)

Where the Hong Kong PDPO or Singapore PDPA apply, we process personal data as needed to perform a contract with you, to take steps at your request, with your consent (for example OAuth and optional marketing), and for legitimate business purposes such as security, fraud prevention, and improving the Service — provided those purposes are not overridden by your rights. You must have a lawful basis to share your customers’ data with us.

6. OAuth token storage and security

Access and refresh tokens for Google Ads are stored on our servers, encrypted at rest when encryption keys are configured, and used only to call Google APIs on your behalf. We apply access controls, logging, and least-privilege practices appropriate to a production Ads integration. No method of transmission or storage is 100% secure. You may disconnect Google Ads at any time; we then revoke or delete stored tokens as part of offboarding, except where we must retain limited records for security, dispute, or legal compliance.

7. Conversations, customers, and retention

If you connect messaging or CRM channels, we may process conversation or booking content to classify verified outcomes. You must not send us special-category data or children’s data unless we have agreed in writing. We retain structured outcomes needed for bidding, reporting, reconciliation, and audit trails. Raw message text is retained only as long as needed for classification quality, support, and security. Typical operational retention is aligned to Google Ads conversion lookback (often up to about 90 days from click for GCLID uploads) plus a reasonable period for reporting and disputes; we may keep de-identified aggregates longer. Exact windows may be shown in-product as features finalize.

8. Access, correction, and deletion

You may request access to, correction of, or deletion of personal data we hold about you, and you may request export of account history where available. To delete your Advaro account and associated personal data:

1. Use in-app offboarding / settings where available, or
2. Email support@advaro.co with the subject “Data deletion request”, or
3. Use our Contact page.

We will verify the request and complete deletion or confirm lawful retention within a reasonable period (typically within 30 days), subject to legal obligations. Uploaded conversions and other writes already sent to Google Ads cannot always be fully reversed or “unlearned” by Google’s bidding models. Deleting Advaro does not automatically delete your Google Ads account or historical Ads data held by Google.

9. Processors

We use infrastructure and service providers under contracts that restrict use of data to providing services to us. Typical categories: cloud hosting and CDN (e.g. Vercel), database and authentication (e.g. Supabase), transactional email (e.g. Resend), background jobs, and AI model providers when those features are enabled. A current list can be requested at support@advaro.co.

10. International transfers

Data may be processed in Hong Kong SAR and in regions where our processors operate (including outside Hong Kong or Singapore). We take steps appropriate to the applicable regime, including contractual safeguards with processors where required.

11. Cookies and marketing site

The marketing site uses cookies or similar technologies that are strictly necessary to operate the site. Analytics or advertising cookies, if introduced later, will be disclosed and, where required, consented to. Waitlist and audit forms collect the contact details you submit so we can respond.

12. Children

Advaro is a business service and is not directed to children under 16.

13. Complaints

Contact us first at support@advaro.co. You may also have the right to complain to the Office of the Privacy Commissioner for Personal Data (Hong Kong) or the Personal Data Protection Commission (Singapore), depending on your location.

14. Changes

We may update this policy. Material changes will be posted on this page with an updated effective date. Where required by law we will provide additional notice. Continued use after the effective date constitutes acceptance of the updated policy where permitted by law.

15. Contact

Privacy questions: support@advaro.co · Contact form · Terms of Service