Privacy Policy - Up&running

Up&running ("we", "our", or "us") operates the campaign monitoring service available at app.upnrunning.studio. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

Account information. When you sign up, we collect your email address and any profile details you provide.

Monitoring configuration. Keywords, landing page URLs, form URLs, and the schedule settings you configure for your monitors.

Usage data. Pages visited, actions taken, and browser or device information collected automatically via server logs and analytics.

Billing information. Payment details are processed directly by Stripe. We store only the Stripe customer ID and subscription status — we never see or store full card numbers.

Google Ads OAuth tokens. When you connect Google Ads, we receive Google OAuth credentials that allow Up&running to read Google Ads data for the accounts you choose to connect. We persist an encrypted refresh token so we can refresh access and run scheduled monitors. We do not persist Google access tokens, and we do not share your OAuth credentials with third parties.

Google Ads account, campaign, keyword, URL, and metrics data. When you use the optional Google Ads integration, we access the Google Ads customer accounts available to your Google login, campaign IDs and names, campaign status and channel type, enabled keyword text, ad group IDs, final URLs, and campaign performance metrics such as impressions, clicks, click-through rate, average cost per click, cost, conversions, and cost per conversion. We store only the Google Ads data needed to show connected accounts, import campaign monitor setup details, run metric monitors, and display monitor history and alerts.

How we use your information

To run your monitors on schedule and deliver alerts.
To manage your account, subscriptions, and billing.
To communicate with you about your account, monitors, and service updates.
To improve the reliability and features of the service.
To comply with legal obligations.

We use Google Ads data only to provide and improve the user-facing Google Ads integration features you choose to use: connecting your ad accounts, importing campaign and keyword details into monitors, running scheduled metric checks, showing results in your workspace, and sending incident and recovery alerts. We do not use Google Ads data for advertising, retargeting, data brokerage, credit decisions, or unrelated profiling.

Third-party services

We share data with the following third parties only to the extent necessary to operate the service:

Supabase — database and authentication infrastructure.
Stripe — payment processing. Stripe's privacy policy governs data they collect.
Google — used to run search checks on your behalf and, when you connect Google Ads, to read campaign and account data through the Google Ads API.
Resend — transactional email delivery for alerts and account notifications.

We do not sell your data to third parties. We do not transfer raw or aggregated Google Ads data to advertising platforms, data brokers, information resellers, or third-party AI/ML model providers. Service providers process data only as needed to host, secure, deliver, monitor, or support Up&running.

Google API Services User Data Policy

Up&running's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use raw or derived Google user data to develop, improve, or train generalized AI or machine learning models.

Data retention

We retain your account data for as long as your account is active. Monitor results and run history are retained for 90 days. When you delete your account, we delete your personal data within 30 days, except where retention is required by law.

For Google Ads, we retain encrypted refresh tokens, selected account and campaign identifiers, monitor configuration, and metric run history while the integration or related monitors remain active. If you disconnect Google Ads, delete the related monitors, or delete your Up&running account, we stop scheduled Google Ads access and delete or de-identify the related Google Ads data within 30 days unless legal retention obligations require otherwise.

Your rights

You may at any time:

Access, correct, or export the data we hold about you.
Delete your account and associated data.
Object to or restrict certain processing activities.

To exercise these rights, contact us at privacy@upnrunning.studio.

Cookies

We use strictly necessary cookies to maintain your authenticated session. During Google Ads connection we may also use short-lived cookies to complete the OAuth flow safely. We do not use advertising or tracking cookies.

Security

We use industry-standard measures including encrypted connections (TLS), HTTP-only cookies, and access controls to protect your data. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Google OAuth refresh tokens and other sensitive integration secrets are encrypted at rest. Access to Google Ads data is limited to authorized users in your Up&running account and to service personnel or subprocessors only when necessary to provide, secure, troubleshoot, or comply with legal obligations for the service.

Children

Up&running is not directed at children under 16. We do not knowingly collect data from minors.

Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by posting a notice in the app. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Contact

Questions or requests regarding this policy should be sent to privacy@upnrunning.studio.