Skip to main content

Data and security

How Hero Marketer handles the data you give it.

What we store​

Hero Marketer stores these categories of data:

Authentication​

  • Your Hero Marketer login. Your email, your name, and your Google sign in identity if you sign in with Google. You sign in with Google or with a six-digit code sent to your email, so Hero Marketer stores no password. Supabase manages sign in. Cloudflare Turnstile checks the email sign in form for bots.
  • OAuth tokens for Google Ads. Hero Marketer uses these only to make API calls to Google Ads on your behalf. Hero Marketer stores refresh tokens to keep the connection alive. Access tokens are short lived, and Hero Marketer refreshes them without any action from you. You can revoke the connection at any time (see Google Ads scopes, below).

Product information​

  • Product names and descriptions that you enter when you add a product, or before the first campaign of a product.
  • Product context. Hero Marketer writes this analysis when Anthropic's Claude reads your product website. You can edit it in Settings > Products.
  • Website URLs you configured.
  • Your logo, your ad styles, your ad images, and the images that you add to a batch in Create images. Hero Marketer also keeps a screenshot of your home page, the text of your home page, the headline and the product image that it cuts from your home page, the sample ads of your looks, and your reference ads. It keeps these files in the same private Cloudflare R2 store as Hero AI attachments. It deletes an ad image 30 days after it was made or last changed. It keeps an image that you add to a batch while an ad image uses it. When you delete the product, it deletes the logo, the screenshot, the parts cut from the home page, the sample ads, the reference ads, the styles, the ad images, and the images that you added. If that deletion fails, a scheduled cleanup deletes the ad styles, the logo, and the images later.

Campaign records​

  • Campaigns built through Hero Marketer. The campaign's targeting, keywords, ad copy, and creation date.
  • Drafts of campaigns in progress (the wizard saves your progress).

Hero AI conversation history​

  • Chat sessions and messages. Every saved chat (up to 10 per Google Ads account), including the full message history and cost data for each session. Each Google Ads account has its own list of chats.
  • Files that you attach in Hero AI. Images and PDFs. Hero Marketer keeps them in a private Cloudflare R2 store that only you can open. It deletes them when you delete the chat.
  • AI usage events. Per call audit records of how many tokens each AI model used and what credits Hero Marketer charged. Hero Marketer uses these records for billing accuracy and for the Activity page in Settings. Hero AI also uses them for the cost estimates that it shows before you send a message.

Dashboards, reports, alerts, and automations​

  • Dashboards and reports, with their AI summaries and AI briefs.
  • Alerts, your alert settings, and your custom rules.
  • Automation history. A record of each change that an automation or Hero AI made, with the value before and after the change.

Credits​

  • Your credit purchases and spend. Each purchase, each charge, and each refund.

What we do not store​

  • A copy of your Google Ads reports. Hero Marketer reads performance data from Google Ads when you open a page, and caches it briefly. Figures stay only where they show in a saved chat, an AI summary, a report brief, an alert, or an automation record.
  • Your Google Ads payment method or billing details. Google holds this.
  • Your Hero Marketer card details. Paddle, our billing provider, holds this. We see only what Paddle exposes (last four digits, expiration, billing address).
  • Anything outside Google Ads. We do not have access to your CRM, email, calendar, or other tools.

Where data lives​

  • Application database. Supabase (Postgres). We host it in US data centers.
  • Sign in. Supabase auth, with Google sign in or a six-digit email code. Cloudflare sends the code emails.
  • Hosting, file storage, PDF rendering, and alert email. Cloudflare. Hero AI attachments and the files of Create images are stored in Cloudflare R2. These files are your logo, a screenshot of your home page, the parts cut from your home page, the sample ads of your looks, reference ads, ad images, and images that you add to a batch.
  • AI providers. Hero Marketer sends your inputs to its AI providers for each request. Anthropic (Claude) does writing tasks: ad copy, landing page wireframes, sitelinks, the read of your product website, and the ad styles and the ideas and copy for ad images. Google (Gemini) does Hero AI analysis, recommendations, reports, AI summaries, and keyword grouping. Gemini also checks the headline and the logo on the first image of each ad image idea, so Gemini gets that image and your logo. Google's Nano Banana image model draws the ad images, their changes, and the sample ads of your looks. Our agreements with these providers govern how they handle your data.
  • Billing. Paddle handles cards, invoices, tax, and region specific compliance.
  • Product analytics and error reports. PostHog, in the app only.

We pick providers with strong privacy and security practices. Our main providers (Cloudflare, Supabase, Paddle, Anthropic, and Google) publish their own security certifications, such as SOC 2 Type II. You can request these reports through the normal channels of each provider.

Encryption​

  • In transit. All connections use HTTPS/TLS.
  • At rest. Supabase, our database provider, encrypts database storage at the disk level. Supabase restricts and logs access to the underlying data.

Access controls​

Internally:

  • Staff can view account data in an internal admin console when they investigate an issue. We log every admin action that changes your data.
  • No one else at Hero Marketer or outside it has access to your data without your consent.

One exception applies to shared reports and dashboards. Other Hero Marketer users who connect the same Google Ads account can see your saved reports, their AI briefs, and your named dashboards. They can make a copy. Only you can change or delete them. Your Hero AI chats and AI summaries stay private to you.

We do not sell, rent, or share your data with third parties for marketing purposes.

When you connect Google Ads, Hero Marketer requests a single OAuth scope: adwords. It is the standard scope for Google Ads API access, and it gives read and write access. Hero Marketer uses it to:

  • Read your account and keyword data.
  • Publish the campaigns that you build.
  • Create the sitelinks that you make with Write with AI in the campaign wizard.
  • Apply the Hero AI changes that you approve.
  • Run the automations that you turn on.
  • Pause or enable campaigns when you ask.
  • Undo or revert a change when you click Undo or Revert.

Otherwise, Hero Marketer changes nothing on its own. Google's consent screen lets you pick which account to connect.

Hero Marketer does not request access to Gmail, Drive, Calendar, or any other Google service.

You can revoke access at any time at myaccount.google.com/permissions. See Disconnect Google Ads.

Compliance​

  • GDPR. We comply with GDPR for EU users. We honor the right to access, the right to deletion, and data portability. To use these rights, email support@heromarketer.io.
  • CCPA. We comply with CCPA for California users. You get the same rights as GDPR, plus the right to opt out of the sale of personal information (we do not sell data anyway).
  • SOC 2. Our main providers publish their own SOC 2 Type II reports. Hero Marketer itself is not SOC 2 certified.

Data retention​

  • While your account is open. We keep your data.
  • After you close your account. Your data can stay for up to 30 days, so that you can come back. Then we delete or anonymize it.
  • After a deletion request. Hero Marketer removes your data within 30 days, including from backups.

Exporting your data​

You can request an export of:

  • Your products and their product context.
  • Your campaign records and metadata.
  • Your Hero AI conversation history.

To ask for an export, email support@heromarketer.io. We send the export as a JSON or CSV file.

Full performance data is not part of the export. Pull it from Google Ads with Google's report export tools. You can also use the CSV and PDF exports on reports and the PDF export on dashboards.

Deletion​

There is no button in the app to delete your account. Before you close your account:

  • Ask for a refund of unused credits that you bought in the last 90 days. Credits in your balance end when the account closes.
  • Turn off Auto top up in Settings > Billing. This cancels the yearly credit subscription.

To fully delete your account and data:

  1. Email support@heromarketer.io from your sign in email. Ask us to delete your account and data.
  2. We confirm by email and remove access immediately.
  3. We purge data from production systems within 7 days.
  4. Backups that contain the data expire within 30 days.

After deletion, no one can recover your data. To reactivate, you must start fresh.

Reporting a security issue​

If you believe you found a security vulnerability in Hero Marketer, email support@heromarketer.io. Start the subject with "Security:". We treat security reports as the highest priority. Do not post details publicly until we investigate and respond.

Data Processing Agreement (DPA)​

For customers who require a signed DPA (under GDPR or other regulations):

Email support@heromarketer.io and ask for the DPA template. We countersign and send back a signed copy.

Next​