Privacy Policy

Keyword Ninja, a service operated by Yes, Please! Ltd ("we", "our", or "us"), is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have. It applies to the Keyword Ninja website, applications, and related services (the "Service"). By using the Service, you agree to the collection and use of information as described here.

1. Information We Collect

1.1 Information You Provide

• Account information: your email address, name, and basic profile details obtained from your Google account when you sign in.
• Billing information: where paid online billing is enabled, payment details processed by third-party payment processors (we do not store full card numbers).
• Communications: information you provide when you contact support, submit a contact form, or engage with the marketplace.

1.2 Google Ads Data

With your explicit authorization through Google OAuth, we access and store data from your Google Ads account, including:

• Campaign names, structures, and settings;
• Ad groups, ads, and their configurations;
• Keywords (positive and negative) and their match types and bids;
• Search terms that triggered your ads;
• Performance data such as impressions, clicks, conversions, and cost;
• Account-level information such as currency and time zone.

1.3 Google Search Console Data

If you choose to connect Google Search Console, with your separate explicit authorization through Google OAuth (read-only scope), we access and store:

• The list of Search Console properties (sites) available to your Google account, and the properties you select to connect;
• Daily aggregated search performance for connected properties: clicks, impressions, click-through rate, and average position, broken down by date, search query, and page.

1.4 Google Analytics Data

If you choose to connect Google Analytics 4 (GA4), with your separate explicit authorization through Google OAuth (read-only scope), we access and store:

• The list of GA4 accounts and properties available to your Google account, the properties you select to connect, and their Google Ads links (used only to match each property to the correct ad account);
• Daily aggregated reporting data for connected properties: sessions, engaged sessions, key events (conversions), revenue, total users, and new users — overall and broken down by date, traffic channel, campaign, ad group, keyword, search query, landing page, and hour of day.

We access aggregated reporting data only. We do not access, request, or store data about individual visitors to your website — no user identifiers, client IDs, or device-level records.

1.5 Information Collected Automatically

• Usage data: features accessed and actions performed within the Service;
• Device data: browser type, device type, operating system, and IP address;
• Cookies and similar technologies: used to keep you signed in, remember preferences, and, with your consent where required, to understand usage. You can manage non-essential cookies through our cookie settings and your browser.

2. How We Use Your Information

• To provide the Service: operate, maintain, and secure the platform and sync your Google Ads data;
• To deliver features: generate wasted-spend analysis, insights, recommendations, alerts, and automations, and apply the changes you request;
• To connect paid, organic, and analytics performance: if you connect Google Search Console or Google Analytics, display that data alongside your Google Ads performance, assess traffic quality and conversion-tracking health, and alert you to anomalies;
• To support you: respond to inquiries and provide customer support;
• To communicate: send service updates, security notices, and, where permitted, product information;
• To improve: understand usage patterns and improve the Service;
• To comply with law: meet legal obligations and enforce our Terms.

3. AI-Assisted Features

Certain insights and recommendations are generated using third-party AI model providers. When these features are used, relevant campaign data (such as performance metrics and campaign names) may be sent to the model provider solely to generate the requested output. We do not permit your Google Ads data to be used to train third-party models, and we apply per-plan usage limits to these features.

4. Data Storage and Security

Your Google user data — including Google Ads, Search Console, and Google Analytics data — is stored in secure databases to enable fast analysis and historical comparisons. We implement industry-standard safeguards, including:

• Encrypted data transmission using TLS;
• Access controls and OAuth 2.0 authentication for all Google API access — we never see or store your Google password;
• Server-side storage of OAuth tokens in an access-controlled database, never exposed to your browser;
• Restricted employee access to personal data;
• Regular review of our security practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. How We Share Information

5.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or Google Ads data for marketing purposes.

5.2 Limited Sharing

• Service providers (subprocessors): trusted vendors who help us operate the Service (such as hosting, payment processing, and AI model providers) under confidentiality obligations. Our current subprocessors are listed on our Subprocessors page. Business customers can request our Data Processing Agreement;
• Marketplace: if you engage a freelance account manager, the access and information you choose to share with them;
• Legal requirements: when required by law, regulation, or valid legal process;
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to you;
• Protection: to protect the rights, property, or safety of Keyword Ninja, our users, or others.

5.3 Fraud-Prevention Network (Ninja Shield)

Ninja Shield, our click-fraud protection feature, includes an optional shared fraud-prevention network. It is off by default. If you explicitly opt an account in, IP addresses that Ninja Shield automatically flags as fraudulent for that account (because they repeatedly clicked your ads without converting) are contributed to an aggregated, cross-customer reputation list - recorded only as a count of how many participating accounts independently flagged each address, together with that address. In return, your account can block addresses that multiple other participating advertisers have independently flagged, on the very first click. We share only these abuse signals for the purpose of preventing advertising fraud; we do not share your campaign data, performance data, or the identity of any visitor through this network, and we do not use the network for advertising. Our legal basis is the legitimate interest of Keyword Ninja and its customers in protecting advertising budgets from fraud. You can leave the network at any time from the Ninja Shield settings, which stops both contributing your data to, and consuming data from, the network; addresses you allowlist are never blocked, and entries fall off the list once they are no longer independently reported.

6. Google User Data

This section describes, in one place, how we handle "Google user data" — the data we receive from Google APIs with your authorization: your basic Google profile used for sign-in, and the Google Ads, Google Search Console, and Google Analytics data described in Sections 1.2–1.4.

6.1 What Google user data we access

We request only the narrowest OAuth scopes needed for the features you use, and each integration asks for your consent separately:

• Sign-in (openid, email, profile): your name, email address, and basic Google profile, used to create, identify, and secure your account;
• Google Ads (adwords scope): the campaign, keyword, search-term, ad, and performance data listed in Section 1.2, together with the account changes you explicitly ask us to make (for example adding keywords or negative keywords, pausing entities, or creating campaigns and ads);
• Google Search Console (webmasters.readonly scope): the read-only search-performance data listed in Section 1.3;
• Google Analytics (analytics.readonly scope): the read-only, aggregated reporting data listed in Section 1.4.

We never request write access to Search Console or Google Analytics, and we never request scopes for features you have not chosen to use.

6.2 How we use Google user data

We use Google user data solely to provide and improve the user-facing features of the Service that you request:

• Google Ads data powers your dashboards, wasted-spend analysis, insights, recommendations, alerts, automations, reports, and the account changes you explicitly request;
• Search Console data is displayed alongside your paid-search data so you can compare organic and paid performance for the sites you connect;
• Google Analytics data is displayed in analytics dashboards and alongside your Google Ads campaigns to show traffic quality (sessions, engagement, key events, revenue) per channel, campaign, and keyword, to check conversion-tracking health, and to alert you to anomalies.

We do not use Google user data for advertising or ad targeting, and we do not use it to develop, improve, or train generalized artificial-intelligence or machine-learning models. Where an AI-assisted feature you invoke processes your data, Section 3 applies: the relevant data is sent to the model provider solely to generate the output you requested and is not used to train third-party models.

6.3 How we share Google user data

We do not sell, rent, or trade Google user data, and we do not transfer it to third parties for advertising, market research, or creditworthiness purposes. It is shared or disclosed only:

• With the service providers (subprocessors) that host and operate the Service on our behalf, under confidentiality obligations — listed on our Subprocessors page;
• With AI model providers, only when you use an AI-assisted feature and only as described in Section 3;
• With a marketplace account manager you explicitly engage, to the extent of the access you grant them;
• When required by law or valid legal process, in connection with a business transfer (with notice to you), or to protect the rights, property, or safety of Keyword Ninja, our users, or others, as described in Section 5.

6.4 How we protect Google user data

• All data in transit between your browser, our servers, and Google APIs is encrypted using TLS;
• Access to your Google data is authorized exclusively through OAuth 2.0 — we never see or store your Google password;
• OAuth tokens (the sensitive credentials that grant access to your Google data) are stored server-side in our access-controlled production database, are never exposed to your browser, and are deleted when you disconnect the integration they belong to;
• Each integration (Google Ads, Search Console, Google Analytics) uses its own separate credential with the narrowest scope, so no integration ever gains access granted for another;
• Employee access to personal data is restricted to what is necessary, and we regularly review our security practices.

6.5 Retention and deletion of Google user data

• Google user data is retained while the relevant integration remains connected, to power historical analysis and comparisons (see Section 8);
• You can disconnect Search Console or Google Analytics at any time from the Service's settings: disconnecting immediately deletes the stored credential and stops all further collection, and you can choose to also delete all previously synced data, which is then removed from our systems;
• You can revoke Keyword Ninja's access entirely at any time from your Google Account permissions;
• Deleting your Keyword Ninja account deletes your stored Google user data, subject to the limited retention periods described in Section 8;
• You can also ask us to delete your Google user data at any time by emailing [email protected].

6.6 Limited Use disclosure

Keyword Ninja's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We only use Google user data to provide and improve the user-facing features described above;
• We do not use Google user data for advertising;
• We do not allow humans to read your data except with your explicit consent, where necessary for security or compliance, or to comply with law;
• We do not transfer Google user data except as needed to provide the Service, for security, or to comply with law.

7. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can:

• Access or export the personal data we hold about you;
• Correct inaccurate or incomplete information;
• Delete your account and associated data;
• Revoke Google access at any time via your Google Account permissions (find "Keyword Ninja" and remove access), or disconnect Search Console or Google Analytics individually from the Service's settings.

Revoking access stops further data collection but does not by itself delete previously stored data; to delete your data, delete your account or contact us.

8. Data Retention

• Account data: retained while your account is active and for a limited period after deletion;
• Google Ads performance data: retained to support historical analysis and deleted on account deletion;
• Search Console and Google Analytics data: retained while the integration is connected; when you disconnect you can choose to delete all synced data immediately, and it is deleted in any case when your account is deleted;
• Billing records: retained as required by law;
• Free-audit data: if you run a free audit without creating an account, we store only the aggregate savings figures; the raw keyword and search-term data is deleted as soon as your report is generated, and your Google Ads access token and audit data are deleted within 14 days unless you start a plan. You can delete it at any time from your audit results page;
• Usage and security logs: security and login logs, including IP address and device information, are retained for 90 days; other usage data may be retained for a limited period for security and debugging.

9. International Data Transfers

Your information may be processed in countries other than your own. Where it is, we take steps to ensure appropriate safeguards are in place to protect your data consistent with this Policy.

10. Children's Privacy

The Service is not intended for individuals under 18, and we do not knowingly collect their personal information. If you believe a child has provided us information, please contact us so we can remove it.

11. California Privacy Rights (CCPA)

If you are a California resident, you have the right to know what personal information is collected and whether it is disclosed, to access and delete your personal information, to opt out of any "sale" of personal information (we do not sell it), and to non-discrimination for exercising your rights.

12. European Privacy Rights (GDPR)

If you are in the European Economic Area or the UK, you have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Our legal bases for processing include performance of our contract with you, your consent, our legitimate interests in operating and improving the Service, and compliance with legal obligations.

13. Cookies

We use essential cookies to keep you signed in and secure the Service, and, with consent where required, optional cookies to understand usage. You can manage your choices through our on-site cookie settings and your browser settings; disabling some cookies may limit functionality.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page, update the "Last updated" date, and, for significant changes, provide additional notice. Please review this Policy periodically.

15. Contact Us

Keyword Ninja is operated by Yes, Please! Ltd (company no. 514444561), from Arye Shenkar St 1, Herzliya, Israel, which is the data controller for the personal data described in this Policy.

If you have questions about this Privacy Policy or our data practices, or wish to exercise your privacy rights, email [email protected] or contact us.