Privacy policy and data protection.

Who we are

Cosmo Californie Media is a sales and marketing consultancy that manages search advertising, analytics and marketing systems for businesses. We operate from Montpellier, France and Richmond, Virginia, United States.

Cosmo Californie Media is the data controller for information about our website visitors, prospects and client contacts. Where we process data on behalf of a client, such as advertising account data or the client's own customer records, we act as that client's processor or service provider and follow the client's instructions.

Cosmo Ads Reporting is an internal application used only by our team. It connects to the Google Ads API so that we can report on, analyse and optimise the advertising accounts our clients have engaged us to manage. It is not offered to the public.

Information we collect

• Contact and enquiry details: name, email address, phone number, company and message, when you submit a form, book a call, email us or become a client.
• Client account information: billing details, contracts, project communications and access we are granted to your marketing platforms.
• Advertising and analytics data: campaign, performance and configuration data from platforms such as Google Ads, Microsoft Advertising and Google Analytics, accessed with your authorisation.
• Website usage data: pages visited, device and browser type, approximate location and referral source, collected through cookies and similar technologies (see section 11).

We do not collect special category data (such as health information) about website visitors, and we ask clients not to send us such data except where a written agreement covers it.

Google user data we access

When an authorised member of our team signs in with Google and grants Cosmo Ads Reporting access, the application requests the following permission:

We only access Google Ads accounts that the account owner has linked to our manager account or otherwise granted us access to. We do not access Gmail, Google Drive, Google Calendar or any other Google service through Cosmo Ads Reporting.

How we use Google user data

We use Google user data only to provide and improve the advertising management services our clients have engaged us for. Specifically, we use it to:

• produce performance reports and dashboards for the client whose account the data belongs to;
• monitor accounts against agreed goals such as cost per conversion and return on ad spend, and alert our team to problems;
• analyse search terms, keywords, audiences, ads, budgets and bidding to identify improvements;
• make optimisation changes in the client's account, such as adjusting bids, budgets and targeting, adding keywords and negative keywords, creating or updating ads and assets, and maintaining conversion tracking;
• check the account for issues such as disapproved ads, billing problems or campaigns that are not spending.

Limited Use commitment

Cosmo Ads Reporting's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not:

• sell Google user data, or transfer it to data brokers or information resellers;
• use Google user data for serving advertisements, including retargeting or personalised advertising, or to build or improve user profiles unrelated to the service;
• use Google user data to determine creditworthiness or for lending purposes;
• use Google user data to develop, train or improve generalised artificial intelligence or machine learning models;
• allow humans to read the data except where needed to deliver the service to the client, for security purposes, to comply with law, or with the client's consent.

Data from one client's account is never used to benefit another client, and is only shared with the client who owns the account.

Sharing and disclosure

We share personal information and Google user data only in the following circumstances:

• With the client who owns the data, for example in reports, dashboards and account reviews.
• With members of our team and contractors who work on the client's account and are bound by confidentiality obligations.
• With service providers that host or process data on our behalf, such as cloud hosting, spreadsheet and reporting tools, communication tools, and AI-assisted analysis services. These providers act on our instructions, may use the data only to provide their service to us, and are contractually prohibited from using it to train their own models.
• Where required by law, to respond to valid legal process, or to protect the rights, safety and security of our clients, our team or the public.
• In a business transfer, such as a merger or acquisition, where the recipient agrees to protect the data in line with this policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Client customer data and conversion uploads

Some clients ask us to measure which ads produce leads or sales. To do this we may process records from the client's own systems, such as a CRM, booking tool or lead tracking sheet, and upload conversion events to the client's Google Ads account, for example as offline or enhanced conversions.

Where we do this, we act as the client's processor. The client is responsible for having a lawful basis and giving any notices required to its own customers. Email addresses and phone numbers sent to Google for conversion matching are normalised and hashed (SHA-256) before upload, as Google requires, and are used only for conversion measurement in that client's account.

Storage and security

We protect data with measures appropriate to its sensitivity, including:

• encryption in transit (TLS) for all connections to Google APIs and our service providers;
• API credentials and access tokens stored in restricted, access-controlled locations, never in shared documents or messages;
• access limited to team members who need it for client work, with two-step verification on Google accounts;
• read-only access by default, with account changes made only for clients who have engaged us to manage their account.

No method of transmission or storage is completely secure, but we review our safeguards regularly and will notify affected clients and authorities of a personal data breach where the law requires it.

Retention and deletion

Google Ads data remains in the client's own Google Ads account. We keep copies, such as reports and analysis exports, only for as long as needed to deliver our services and meet our reporting obligations to the client.

• Google user data: deleted or anonymised within 90 days after our engagement with the client ends, or sooner on request.
• OAuth access tokens: deleted when access is revoked or no longer needed.
• Client and contact records: kept for the duration of the relationship and up to 6 years afterwards where needed for accounting, tax or legal purposes.
• Enquiries from people who do not become clients: deleted within 24 months of the last contact.

To ask us to delete data we hold, email [email protected]. We will confirm deletion within 30 days.

Revoking access

You can withdraw our access to Google data at any time:

• remove Cosmo Ads Reporting from the Google account at myaccount.google.com/permissions; or
• unlink your Google Ads account from our manager account, or remove our users, under Admin → Access and security in Google Ads.

Once access is revoked, Cosmo Ads Reporting can no longer retrieve data from or make changes to the account. Data already retrieved is handled as described in section 9.

Cookies and analytics

Our websites use cookies and similar technologies to keep forms and booking tools working, measure visits, and understand which marketing channels bring visitors to us. We may use tools such as Google Analytics, Google Ads conversion tracking and our website and CRM platform for this purpose.

Where the law requires consent, non-essential cookies are only set after you agree. You can withdraw consent or block cookies in your browser settings, and you can opt out of Google Analytics using Google's browser add-on.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict certain processing.

To exercise a right, email [email protected]. We may need to verify your identity, and we will respond within the time the law requires, normally 30 days. If we hold your data on behalf of a client, we will pass your request to that client.

International transfers

Our team and service providers are located in several countries, including the United States, the European Union and countries outside the EU and UK. Where personal data from the EU, EEA or UK is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

Children

Our services are for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The current version is always published on this page with its "last updated" date. If we change how we use Google user data, we will update this policy and, where required, ask for renewed consent before applying the change.

Contact us

For any question about this policy, our use of Google user data, or a privacy request, contact: