Privacy Policy

Who this covers

This policy applies to SIRJ ROI ("we," "us"), the account holders who use our service (primarily marketing agencies and small businesses), and the connected accounts they authorize us to read on their behalf.

Information we collect

• Account information. Your name, email address, and the workspace and client records you create so you can sign in and organize your data.
• Data from services you connect. When you authorize an integration, we read data from that service to power your dashboard — for example, campaign spend and performance from ad platforms, leads from forms and CRMs, and payments from billing systems. We only read the specific fields needed for reporting and attribution.
• Authentication tokens. The access and refresh tokens that let us read a connected account on your behalf. These are stored encrypted and are never shown to other users.
• Usage and diagnostic data. Basic logs (such as sync times and errors) that let us keep integrations healthy and secure.

How we use information

We use the data solely to provide the service: to assemble your dashboards, compute return on ad spend by matching spend to downstream leads and revenue, send the weekly summaries you enable, and keep your integrations running. We do not sell your data, and we do not use it for advertising or to build profiles.

Google user data and the Google Ads API

When you connect a Google Ads account, we access it on a read-only basis. We read aggregate campaign reporting metrics only — campaign name, date, cost, impressions, and clicks. We use this data exclusively to show spend alongside the revenue it produced.

• We never create, edit, pause, or manage campaigns, budgets, keywords, or ads.
• We do not use the token for App Conversion Tracking or Remarketing.
• We do not transfer Google Ads data to others except as needed to provide the service you requested, and we never sell it or use it for advertising.
• Google Ads data is shown only to your account and to the client users you grant view-only access.

How we share information

We do not sell personal information. We share data only with the infrastructure providers that run the service on our behalf — such as our cloud hosting and database provider — under agreements that require them to protect it. Each workspace's data is isolated so one customer can never see another's.

How we store and protect it

• All traffic is encrypted in transit over HTTPS/TLS.
• Authentication tokens and credentials are encrypted at rest.
• Records are partitioned per tenant and enforced with database row-level security, so each account only ever sees its own data.
• Client (external) users receive strictly view-only access to their own workspace.

Retention and deletion

You can disconnect any integration at any time, which immediately stops all further data access from that service. You may request deletion of your data by contacting us, and we will remove it subject to any legal retention obligations. Disconnecting a Google account also removes SIRJ ROI's access; you can additionally review or revoke access from your Google Account permissions page.

Your choices

You choose which services to connect and can disconnect them whenever you like. You can access, correct, or delete your account information, and you can export your data at any time. If you have a request about your personal data, contact us and we will respond.

Changes to this policy

We may update this policy as the service evolves. When we make material changes, we will update the date above and, where appropriate, notify you.

Contact

Questions about this policy or your data can be sent to privacy@sirj.ai.