Privacy Policy

The data controller is Datashake (operated by Reviewshake, Inc.), 221 W 9th St, Wilmington, DE 19801, United States. Contact: contact@datashake.com Data Protection Officer: contact@datashake.com (privacy inquiries)

We collect the following categories of data: Account Data: email address, first and last name, hashed password, language preference. Workspace Data: workspace name, brand names, domain lists, rule configurations, member list. Google Ads Data: OAuth tokens (encrypted), account IDs, campaign status and bid data accessed via the Google Ads API. Scan Data: SERP scan results (ads found, positions, competitor domains), scan timestamps. Usage Data: pages visited, actions performed, timestamps, IP address (for security). Billing Data: managed by Stripe; we store only the Stripe customer ID and subscription status, not credit card numbers.

We process your data based on: - Contract performance: to provide the Service you subscribed to. - Legitimate interest: to improve the Service, prevent fraud, and ensure security. - Consent: for optional analytics cookies (see Cookie Policy). - Legal obligation: to comply with tax and regulatory requirements.

We use your data to: - Provide, maintain, and improve the Service - Process subscriptions and billing - Send transactional emails (verification, password reset, alerts) - Monitor competitor ads on your behalf via Google SERP - Execute automated campaign pause/reactivation rules via Google Ads API - Generate aggregated, anonymized usage statistics - Ensure security and prevent abuse

We do not sell your personal data. We share data only with: - Stripe: for payment processing (see stripe.com/privacy) - Resend or SMTP provider: for transactional emails - Bright Data: for SERP scanning (no personal data is shared, only search queries) - Google: via OAuth for Google Ads API access (with your explicit authorization) - Law enforcement: if required by law

Account data is retained as long as your account is active. Scan results are retained for up to 24 months. Upon account deletion, personal data is removed within 30 days. Backups containing personal data are purged within 90 days. Billing records are retained as required by tax law (typically 10 years in France).

We implement industry-standard security measures: - Passwords hashed with bcrypt (12 rounds) - OAuth tokens encrypted at rest (AES) - HTTPS enforced in production - Database access restricted to application services - Regular security audits and server hardening - Daily encrypted database backups

Under the GDPR, you have the right to: - Access your personal data - Rectify inaccurate data - Erase your data ("right to be forgotten") - Restrict processing - Data portability - Object to processing - Withdraw consent at any time To exercise these rights, contact us at contact@datashake.com. We will respond within 30 days.

We use essential cookies for authentication and session management. Optional analytics cookies are only set with your explicit consent. See our cookie banner for options. You can withdraw consent at any time.

Your data is primarily stored on servers located in France (OVH). Some sub-processors (Stripe, Resend) may process data outside the EU under appropriate safeguards (Standard Contractual Clauses).

The Service is not directed to individuals under 16. We do not knowingly collect data from children.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before they take effect.

For privacy-related inquiries: contact@datashake.com You also have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr

brand-saver's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We only access your Google Ads data (campaign status and bids) and Search Console data to provide the features you enable. We never use this data for advertising purposes, never sell it, and never transfer it to third parties except as necessary to provide the Service or comply with the law.