Legal
Plain English, not legalese. Here is what we collect, why we collect it, and what we do with it.
This policy applies to two things: the COREPPC website (coreppc.com) and the COREPPC audit tool, our PPC audit and reporting platform available at app.coreppc.com.
The audit tool connects to your Google Ads, Google Sheets, and Meta Ads accounts to run automated audits and export reports. Because it handles OAuth tokens and reads ad account data, it is the part of our system where data handling matters most. This policy explains exactly what we access, what we store, and what we do not.
Google Ads
When you connect Google Ads, we request access to your Google Ads account via OAuth. We use this access exclusively to retrieve data needed to generate audit reports: campaign structure, keyword lists, bidding settings, conversion tracking configuration, audience targeting, and budget information. We do not modify your campaigns. We do not access creative assets, customer match lists, or any data belonging to your end customers.
Your Google OAuth access and refresh tokens are stored server-side in an encrypted database (Turso, US East), associated with your COREPPC account, and used only to make Google Ads API calls on your behalf when you run an audit or refresh a report. Tokens are never exposed to client-side JavaScript and never shared with third parties. You can revoke our access at any time by visiting myaccount.google.com/permissions.
Google Sheets (via Drive)
If you choose to export an audit report to Google Sheets, we use the drive.file scope to create a new spreadsheet in your Google Drive and write the audit data into it. This scope limits our access to only files that your application creates or that you explicitly select - we cannot see, list, read, modify, or delete any other files in your Drive. We only create spreadsheets that you explicitly request through the Export button. The exported spreadsheet stays in your Drive after creation - we do not retain a copy.
Meta Ads
When you connect Meta Ads, we request read access to your ad accounts. We use this access to retrieve campaign names, ad sets, budget information, and basic performance metrics. We do not modify your campaigns, access creative assets, or read customer data. Your Meta OAuth tokens are stored server-side in the same encrypted database and used only to make Meta Graph API calls on your behalf.
Email address
If you sign in with email only (no Google account), we collect your email address to authenticate your session. Your email is stored in our database, which runs on Turso (a SQLite-based service hosted in US East). We use your email to send your audit report when it is ready, and to send team collaboration invitations if you choose to share access with colleagues.
Audit reports
When you run an audit, the results are stored in our database so you can access your report later and share it with others. Reports contain aggregated scores and findings derived from your ad account data. They do not contain raw campaign data, creatives, or customer information.
If you submit a contact form on coreppc.com, we receive your name, email address, and message. We use this information to respond to your inquiry. We do not add you to any mailing list without your consent.
We implement the following technical and organizational measures to protect sensitive data, including data received from Google APIs:
COREPPC's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We request the following Google OAuth scopes, each used exclusively for the purposes listed below:
https://www.googleapis.com/auth/adwords) - to read your Google Ads account structure, campaigns, ad groups, keywords, conversion settings, and performance metrics so we can generate automated audit reports. We do not create, modify, or delete campaigns, ads, or keywords through this scope.https://www.googleapis.com/auth/drive.file) - to create a new Google Sheets spreadsheet in your Google Drive and write audit report data into it, only when you click the Export button. This scope is limited to files created by our application or explicitly selected by you. We cannot access, list, or modify any other files in your Drive.We use Google API data solely to provide the COREPPC audit service to the user who authorized access. We do not transfer Google user data to any third party except as necessary to provide this service, and only with your prior consent. We do not use Google user data for advertising, and we do not sell Google user data.
We use httpOnly cookies to store your authentication session. These cookies are not accessible to JavaScript and cannot be read by third-party scripts. We do not use advertising cookies, tracking pixels, or third-party analytics on the audit tool.
The main website (coreppc.com) may load fonts from Google Fonts and analytics from standard web tools. No personally identifiable information is shared with these services.
Session cookies expire automatically: 30 days for Google sessions, 60 days for Meta sessions, 24 hours for report viewer sessions.
Audit reports are retained in our database indefinitely so you can access them. If you want your reports deleted, contact us at the address below and we will remove them.
If you connected via Google OAuth and later revoke access through your Google account settings, your access token becomes invalid. We will no longer be able to fetch data from your account.
You can revoke Google Ads access at any time by visiting myaccount.google.com/permissions and removing COREPPC from the list of connected apps.
You can revoke Meta Ads access by visiting facebook.com/settings/apps and removing the COREPPC app.
To request deletion of your account data, email us at [email protected]. We will confirm deletion within 10 business days.
For questions about this policy or to request data deletion, email [email protected].
This policy was last updated February 2026.