Who is responsible for the data
The administrator of the negativekeywords.com service is responsible for the personal data described in this policy. Contact [email protected] about privacy, access or deletion. This policy covers the website, accounts, support and connected reports.
The administrator determines processing purposes for account and website data. Your organization remains responsible for advertising data and permission to provide it. Where applicable, the administrator processes ad data on your instructions under relevant data processing terms. Enterprise includes a DPA.
Read the terms of service alongside this policy and the security information for access and change controls.
What information the service processes
We collect information to secure accounts, operate subscriptions and answer requests. Ad data enters the ongoing service after OAuth authorization, separately from the browser demo.
- Account email and a hashed password used for account access.
- Confirmation codes and related verification status, expiry and attempt records.
- Campaign source parameters, referral information and plan selection associated with signup.
- IP address, user agent and technical request information used for security and troubleshooting.
- Support messages and the information you choose to include.
- Subscription status and transaction or invoice records needed for billing and accounting.
- After OAuth connection, ad account identifiers, account context, search terms, clicks, cost, conversions, targeting and negative keyword or shared-list records needed for the service.
Search queries may contain personal information entered by searchers. Provide only data you are authorized to process and avoid including unrelated sensitive information in support messages. We do not need your ad platform password to connect an account.
Why the data is used
Where GDPR applies, each purpose has an appropriate legal basis. We do not use account data for unrelated advertising.
| Purpose | Legal basis where applicable |
|---|---|
| Create an account, verify email and provide access | Performance of a contract or steps requested before it |
| Process connected reports and manage approved negatives or rules | Performance of a contract, or customer instructions when acting as processor |
| Manage subscriptions and answer service requests | Performance of a contract |
| Maintain required accounting and legal records | Compliance with legal obligations |
| Protect accounts, prevent misuse and investigate technical issues | Legitimate interests in secure and reliable service |
| Understand signup source and service use from limited technical records | Legitimate interests in evaluating and improving the service |
| Handle disputes and enforce applicable terms | Legitimate interests in protecting legal rights |
We assess legitimate interests against the effect on your rights. Where consent is legally required for a separate activity, we request it and allow withdrawal. Withdrawing consent does not affect processing that was lawful before withdrawal.
Keep the demo report in your browser
The one-off demo processes pasted CSV or TSV reports in your browser. It never sends the report to the service and never stores it. Creating an account sends registration information; connecting an ad account authorizes a separate ongoing data workflow.
We use essential cookies only, for functions such as maintaining a secure session, account access and request protection. We do not use advertising cookies or optional tracking cookies. Limited source parameters supplied during signup are account records, not permission to track you across other sites.
Browser settings control cookies. Blocking essential cookies may prevent account access.
Limit disclosure to operating the service
Provider categories are the hosting provider, email delivery provider and payment processor. They process only the information necessary for their functions under applicable confidentiality and data protection arrangements. We do not list provider names in this policy.
We never sell or share search terms with advertisers, data buyers or unrelated workspaces. Restricted processing needed to host the service is not permission to reuse queries independently. Your authorized workspace members and recipients you choose for reports can see data you make available to them.
We may disclose information when legally required or necessary to establish or defend legal claims. Restricted international transfers use lawful mechanisms, such as approved contractual safeguards or an adequacy decision. Contact support for details relevant to your data.
Keep data only for the relevant purpose
Account and connected ad data are retained while needed to provide the service, maintain requested records and resolve support or security issues. Audit log retention is 30 days on Starter, 1 year on Growth, 2 years on Agency and unlimited with export on Enterprise, subject to applicable deletion rights and legal requirements.
Those plan periods do not set retention for every data category. Confirmation records remain only as needed for verification and abuse prevention. Billing and legal records remain for applicable legal retention periods. Source and technical records remain only while needed for their stated purposes.
Revoke OAuth access to stop further account access. Revocation does not itself delete stored records or remove negatives already added. Request deletion at [email protected]. We delete or anonymize data no longer needed, with limited exceptions for legal obligations, security and disputes.
Exercise the rights that apply where you live
Under GDPR, applicable rights include access, correction, erasure, restriction, portability and objection, including objection to processing based on legitimate interests. You can withdraw consent where used and complain to the competent data protection authority. The service does not make decisions producing legal or similarly significant effects about individuals solely through automated processing.
Depending on your US state and its applicable thresholds and exceptions, you may have rights to know or access personal information, correct it, delete it, receive a portable copy and appeal a denied request. Rights may also include opting out of sale, sharing, targeted advertising or certain profiling. We do not sell personal information, share it for cross-context behavioral advertising or use it for targeted advertising.
Send requests or appeals to [email protected]. We may verify identity and an authorized agent's authority without requesting unnecessary information. We respond within applicable legal time limits and do not discriminate for exercising privacy rights.
Stay informed about this policy
The service is for business use and is not directed to children. We do not knowingly collect children's personal information. Contact support if you believe a child has provided it so we can investigate and delete it where appropriate.
We update this policy when practices or legal requirements change and revise the date above. Material changes receive notice where required. Use the contact guidance for a privacy request, or review security and retention controls before connecting accounts.