AdWash Privacy Policy

This Privacy Policy (the "Policy") explains how Yelu Marketing ("Yelu Marketing", "AdWash", "we", "us", or "our"), the operator of the AdWash platform at adwash.ai (the "Service"), collects, uses, discloses, and safeguards information about you when you use the Service or interact with us. This Policy is incorporated into and forms part of the AdWash Terms of Service.

By using the Service, you confirm you have read and understood this Policy. If you do not agree, do not use the Service.

This Policy applies to (a) visitors of adwash.ai, (b) account holders who sign up to use the Service, (c) employees and authorized representatives of customers, and (d) third parties whose information is processed by us at the direction of a customer (for example, end customers of a customer's business whose contact details enter the Service through a connected CRM or through the customer's ads).

Account information. When you create an account we collect your name, email address, and a hashed copy of your password. If you sign in with Google we receive your name, email, profile picture, and Google account identifier from Google pursuant to your authorization.

Business profile. During onboarding you provide business information such as your business name, industry, offerings, service area, primary advertising goal, monthly ad budget, website URL, phone number, business hours, and uploaded brand assets (logos, images, brochures). This information is used to generate and operate your advertising campaigns.

Google Ads data. When you link a Google Ads account to our manager account we collect campaign, ad group, ad, keyword, search term, location, hour-of-day, conversion, and performance metrics from the Google Ads API, and keep them as a history of your account's results. We do not collect or store your Google Ads payment method.

Leads from your ads. When people respond to your ads, we receive what Google records about them: for calls, the caller's area code, the time and the call's length; for lead forms and Local Services messages and bookings, the name, phone number, email address, and message the person submitted. We use these to show you your leads and to judge which campaigns bring them.

Your website. When you give us your website, we read its pages, including its logo, the phone numbers and links it shows, and its text, to write your ads, to complete them (call button, business name, logo, links to your pages), and to keep them current. We read it again regularly, at most daily, so a redesign or a removed page is noticed.

CRM data. If you connect a CRM (Housecall Pro, ServiceTitan, or similar) we receive job, customer, and invoice records via webhooks and scheduled syncs. These may include customer names, phone numbers, addresses, job values, payment status, and the Google Click Identifier (GCLID) that ties a job back to the ad click that produced it.

Billing information. Subscription billing is handled by Stripe. We receive a Stripe customer identifier and subscription status; we do not collect, store, or have access to your full payment card details.

Communications. We retain messages you send to our support channels, including conversations with the in-product Help bot, messages you send through our contact form, and calls you book with us. If you create an account and don't finish signing up, we may send you up to two reminder emails; every one has a link to stop them, and stopping them stops any other marketing email from us too. Emails about your account and billing (receipts, cancellation confirmations, notices before a price changes) are part of the Service and aren't marketing.

Advertising measurement and retargeting. On our public pages and during sign-up we use Google's tag (Google Ads and Google Analytics) to measure whether our own ads lead to sign-ups and booked calls, and where people stop during sign-up. If you arrive from one of our ads and accept, we keep the ad click identifier and campaign tags from the link and save them with your account and subscription. When you pay or book a call, Google's tag sends your email address to Google in hashed form so the sign-up can be matched to the ad (enhanced conversions). Google's tag also lets Google show AdWash's own ads to people who visited our public pages or started signing up and didn't finish (retargeting), using cookie identifiers and the pages visited. None of this starts until you accept on the cookie notice, or switch it on in Your Privacy Choices: before that, Google's tag doesn't load and nothing is sent to Google. No thanks or Global Privacy Control keeps it all off, and you can switch it off again at any time (see our Cookie Policy). None of this runs inside the dashboard, and none of it uses your Google Ads account, your campaigns, or your customers' data.

Technical data. We log standard server-side data such as IP addresses, browser user agent, request timestamps, errors, and a session cookie used for authentication.

We process the information described above to:

• Provide, operate, and improve the Service.
• Generate, publish, and optimize Google Ads campaigns on your behalf, including weather-triggered automation and bid optimization.
• Make the changes to your Google Ads account that you authorize in the Service, including, where you switch them on, managing daily budgets within your monthly budget, blocking searches that waste money, testing new versions of your ads, setting ad schedules and service areas, adding seasonal campaigns, and running promotions you approve.
• Write ad copy, suggestions, and summaries with AI (Google Gemini), using your business profile, your website, and your campaigns' results.
• Upload offline conversions (paid jobs) back to Google Ads so smart bidding can learn from confirmed revenue.
• Calculate and display return-on-investment metrics in your dashboard.
• Authenticate you, process subscription billing, send service and administrative communications, and respond to support requests.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information for money, and we do not use your data to train general-purpose AI models. Retargeting on our public pages (Section 3) is the one way we let a third party, Google, use information about visits for advertising; see Section 11 for how to opt out. We do learn from campaign results across the accounts we manage, for example which keywords, ad structures, schedules, offers, and weather bring leads in a trade, and we use those learnings, in aggregated and de-identified form that does not identify you, your end customers, or your campaigns, to build and improve campaigns for other customers.

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR: (a) performance of a contract, to deliver the Service you signed up for; (b) legitimate interests, to secure, improve, and market the Service, balanced against your interests and rights, which is also the basis for the two reminder emails after an unfinished sign-up (Section 3); (c) consent, where we ask for it (for example, Google's measurement and retargeting cookies on our public pages: Google's tag doesn't load, sets no cookies or identifiers and sends nothing until you accept); and (d) legal obligation, to comply with applicable law.

Sub-processors. We share the minimum information necessary with vendors that provide infrastructure and tools, in each case under a written contract that restricts their use of the data. Current sub-processors include:

• Hostinger (cloud hosting, VPS)
• Stripe (subscription billing)
• Google LLC (Google Ads API, OAuth, Gemini AI and Imagen, Google Places, Google Workspace email for our team, and Google Ads and Google Analytics measurement on our public pages and sign-up). For retargeting, Google also uses visit information under its own terms; see how Google uses information from sites that use its services
• Resend (email delivery)
• Zoho (the adwash.ai mailboxes, such as support@adwash.ai)
• OpenFreeMap (map images for the service area map; your browser loads them directly when the map opens, so OpenFreeMap receives your IP address and browser details). Map data © OpenStreetMap contributors, © OpenMapTiles; ZIP code areas from the U.S. Census Bureau.
• Open-Meteo (public weather forecasts; no personal data). Weather data by Open-Meteo.com, licensed under CC BY 4.0.

CRM partners. When you connect a CRM, we exchange data with that CRM as you authorize, including pushing offline conversions back to Google Ads on your behalf.

Legal and safety. We may disclose information when required by law, in response to a valid legal process, to enforce our Terms, or to protect the rights, property, or safety of Yelu Marketing, our customers, or the public.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred subject to the protections of this Policy.

We process information primarily in the United States. Where personal data is transferred from the EEA, UK, or Switzerland to countries that have not received an adequacy decision, we rely on Standard Contractual Clauses or equivalent safeguards approved by the relevant authorities.

We retain account and business profile information, Google Ads performance data, and CRM data for as long as your account exists, to power your dashboard's history and the Service's learning. Lead details (callers, form fills and messages) are deleted after 365 days. Support conversations, contact-form messages and booked calls are kept while your account exists, and otherwise until you ask us to delete them. Records of what you authorized (consents) are kept for as long as needed to show what was agreed, billing records for as long as tax law requires, and server logs only as long as needed to run and secure the Service. When an account is closed we keep its data unless you ask us to delete it; on request we delete it within 30 days, except where the law requires us to keep it and except for de-identified, aggregated learnings that no longer identify you. Backup copies are deleted in the ordinary course of our backup schedule.

We use administrative, technical, and physical safeguards to protect information against unauthorized access, alteration, disclosure, and destruction. These include TLS in transit, hashed passwords, encryption of the CRM credentials you connect, payment card details held only by Stripe, HMAC signature verification on incoming webhooks, scoped OAuth tokens, principle-of-least-privilege access controls, and audit logging of administrative actions. No system is perfectly secure; we cannot guarantee absolute security.

Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict processing of your personal information, to object to processing based on legitimate interests, and to withdraw consent. You may also have the right to lodge a complaint with a supervisory authority.

You can edit most of your business profile from within the Service (Settings → Profile). For requests we cannot fulfill through the product, contact us at privacy@yelumarketing.com. We will respond within the timelines required by applicable law.

The California Consumer Privacy Act, as amended (the CCPA), grants California residents specific rights regarding personal information. We do not sell personal information for money. Retargeting on our public pages (Section 3) lets Google use identifiers (cookie IDs and IP address) and internet activity (the pages of our site visited) to show AdWash's own ads, which the CCPA treats as "sharing" for cross-context behavioral advertising, and some other state laws as "selling" or "targeted advertising." It runs only if you accept it, and you have the right to opt out at any time: use Your Privacy Choices at the foot of our pages (switch AdWash ads on other sites off), press No thanks on the cookie notice, or send Global Privacy Control, which we honor as an opt-out. Residents of other US states with similar laws (including Colorado, Connecticut, Virginia, Texas, and Oregon) can opt out of targeted advertising the same way. We do not knowingly sell or share the personal information of anyone under 16. We do not discriminate against anyone for exercising these rights. To exercise access, deletion, or correction rights, contact privacy@yelumarketing.com.

How requests work. We confirm a request by matching it to your account: from the email address on the account, or by asking you to confirm details only the account holder would know. An authorized agent may make a request for you with your signed permission, and we may ask you to confirm your identity with us directly. We answer within 45 days. If we decline a request, we tell you why; you can appeal by replying "Appeal" to our answer, and we respond to an appeal within 45 days (60 in Colorado). If we deny the appeal you may contact your state Attorney General.

What we collect, in the CCPA's categories. Identifiers (name, email, phone, IP address, cookie IDs); commercial information (your plan and billing history); internet activity (pages of our site visited, how you use the Service); professional information (your business profile and advertising accounts); and account login details, which we use only to sign you in. Sources, purposes and recipients are in Sections 3, 4 and 6. Apart from Google retargeting (Section 3), we disclose them only to our service providers, for the purposes in Section 4, and we haven't sold personal information in the last 12 months.

Your customers' information. Leads and CRM records about your own customers are processed on your behalf. If one of them asks us about their data, we pass the request to you and help you answer it.

De-identified data. We keep de-identified data in de-identified form, don't try to re-identify it, and require anyone we share it with to do the same.

AdWash is for businesses and people 18 or older. It isn't directed to children: we don't knowingly collect personal information from children under 13 (the Children's Online Privacy Protection Act), and we don't sell or share the personal information of anyone under 16. If we learn we have collected a child's personal information, we delete it promptly; if you believe a child has given us information, contact us.

We may update this Policy from time to time. If we make material changes, we will notify you by email or in-product notice before the changes take effect. The "Last updated" date at the top of this Policy reflects the most recent revision.

Yelu Marketing, the operator of AdWash. For privacy questions, data subject requests, or to designate a representative under applicable law:

privacy@yelumarketing.com