AdWash Privacy Policy

This Privacy Policy (the "Policy") explains how Yelu Marketing ("Yelu Marketing", "we", "us", or "our"), the operator of the AdWash platform at adwash.ai (the "Service"), collects, uses, discloses, and safeguards information about you when you use the Service or interact with us. This Policy is incorporated into and forms part of the AdWash Terms of Service.

By using the Service, you confirm you have read and understood this Policy. If you do not agree, do not use the Service.

This Policy applies to (a) visitors of adwash.ai, (b) account holders who sign up to use the Service, (c) employees and authorized representatives of customers, and (d) third parties whose information is processed by us at the direction of a customer (for example, end customers of a customer's home service business whose contact details enter the Service through a connected CRM).

Account information. When you create an account we collect your name, email address, and a hashed copy of your password. If you sign in with Google we receive your name, email, profile picture, and Google account identifier from Google pursuant to your authorization.

Business profile. During onboarding you provide business information such as your business name, industry, offerings, service area, primary advertising goal, monthly ad budget, website URL, phone number, business hours, and uploaded brand assets (logos, images, brochures). This information is used to generate and operate your advertising campaigns.

Google Ads data. When you link a Google Ads account to our manager account we collect campaign, ad group, ad, keyword, conversion, and performance metrics from the Google Ads API. We do not collect or store your Google Ads payment method.

CRM data. If you connect a CRM (Housecall Pro, ServiceTitan, or similar) we receive job, customer, and invoice records via webhooks and scheduled syncs. These may include customer names, phone numbers, addresses, job values, payment status, and the Google Click Identifier (GCLID) that ties a job back to the ad click that produced it.

Billing information. Subscription billing is handled by Stripe. We receive a Stripe customer identifier and subscription status; we do not collect, store, or have access to your full payment card details.

Communications. We retain messages you send to our support channels, including conversations with the in-product Help bot, and your interactions with marketing emails (open and click events).

Technical data. We log standard server-side data such as IP addresses, browser user agent, request timestamps, errors, and a session cookie used for authentication.

We process the information described above to:

• Provide, operate, and improve the Service.
• Generate, publish, and optimize Google Ads campaigns on your behalf, including weather-triggered automation and bid optimization.
• Upload offline conversions (paid jobs) back to Google Ads so smart bidding can learn from confirmed revenue.
• Calculate and display return-on-investment metrics in your dashboard.
• Authenticate you, process subscription billing, send service and administrative communications, and respond to support requests.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information. We do not use your business data to train general-purpose machine learning models for any customer other than your own account.

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR: (a) performance of a contract, to deliver the Service you signed up for; (b) legitimate interests, to secure, improve, and market the Service, balanced against your interests and rights; (c) consent, where we ask for it (for example, optional marketing emails); and (d) legal obligation, to comply with applicable law.

Sub-processors. We share the minimum information necessary with vendors that provide infrastructure and tools, in each case under a written contract that restricts their use of the data. Current sub-processors include:

• Hostinger (cloud hosting, VPS)
• Stripe (subscription billing)
• Google LLC (Google Ads API, OAuth, Gemini AI)
• Resend (transactional email delivery)
• Open-Meteo (public weather forecasts; no personal data)

CRM partners. When you connect a CRM, we exchange data with that CRM as you authorize, including pushing offline conversions back to Google Ads on your behalf.

Legal and safety. We may disclose information when required by law, in response to a valid legal process, to enforce our Terms, or to protect the rights, property, or safety of Yelu Marketing, our customers, or the public.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred subject to the protections of this Policy.

We process information primarily in the United States. Where personal data is transferred from the EEA, UK, or Switzerland to countries that have not received an adequacy decision, we rely on Standard Contractual Clauses or equivalent safeguards approved by the relevant authorities.

We retain account and business profile information for as long as your account is active and for a reasonable period thereafter to comply with legal, tax, and audit obligations and to resolve disputes. CRM and Google Ads performance data is retained for as long as needed to power historical reporting on your dashboard, up to 36 months by default. You may request earlier deletion subject to the retention periods imposed by applicable law.

We use administrative, technical, and physical safeguards to protect information against unauthorized access, alteration, disclosure, and destruction. These include TLS in transit, encryption at rest for credential and payment data, HMAC signature verification on incoming webhooks, scoped OAuth tokens, principle-of-least-privilege access controls, and audit logging of administrative actions. No system is perfectly secure; we cannot guarantee absolute security.

Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict processing of your personal information, to object to processing based on legitimate interests, and to withdraw consent. You may also have the right to lodge a complaint with a supervisory authority.

You can edit most of your business profile from within the Service (Settings → Profile). For requests we cannot fulfill through the product, contact us at privacy@yelumarketing.com. We will respond within the timelines required by applicable law.

The California Consumer Privacy Act, as amended (the CCPA), grants California residents specific rights regarding personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising. To exercise access, deletion, or correction rights, contact privacy@yelumarketing.com. We will verify your request using reasonable means.

The Service is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information, contact us and we will delete it.

We may update this Policy from time to time. If we make material changes, we will notify you by email or in-product notice before the changes take effect. The "Last updated" date at the top of this Policy reflects the most recent revision.

Yelu Marketing, the operator of AdWash. For privacy questions, data subject requests, or to designate a representative under applicable law:

privacy@yelumarketing.com