Privacy Policy

At PPCMax we respect the privacy of our Users and protect the Personal Data provided to us in connection with the use of the Service. This Privacy Policy (the "Privacy Policy") sets out the rules for collecting, using, disclosing and protecting Personal Data and the rights of the persons the data relates to.

This Privacy Policy applies to services provided by Catchy Media Sp. z o.o., Al. Grunwaldzka 56/113, 80-241 Gdańsk, Poland, tax ID (NIP): 9571150950 ("Catchy Media", "PPCMax", "we" or "us") in connection with the use of the PPCMax website, application and related online services.

We recommend reviewing this Privacy Policy regularly. The current version is always published online. In the case of material changes we may additionally notify the User by email or by a message in the application.

This document explains the rules for collecting, using and disclosing Personal Data when the Service is used. We do not share Personal Data with third parties other than in the cases described in this Privacy Policy and as permitted by applicable law.

We use Personal Data to provide, maintain, secure and develop the Service. Unless this Privacy Policy states otherwise, the terms used in this document have the meaning given to them in the PPCMax Terms of Service.

When the Service is used, we may collect or ask for data that identifies the User and allows us to contact the User, manage the Account and handle billing ("Personal Data").

Sign-in to the application uses a Google account.

In connection with Google sign-in we may process in particular:

• first and last name or profile name,
• email address,
• account identifier at the identity provider,
• authorization tokens and metadata,
• data required to maintain the session and keep the account secure.

In connection with the subscription and invoicing we may process:

• first and last name or company name,
• address details,
• tax ID (if provided),
• billing email address,
• optionally a phone number,
• subscription data and payment statuses.

We may collect technical and operational data, including in particular:

• IP address,
• user agent,
• session identifiers,
• timestamps,
• technical, diagnostic and security logs,
• application error data.

To provide PPCMax functionality we process data from the Google Ads, Google Merchant Center, Google Analytics 4 and Google Tag Manager accounts connected by the User, to the extent necessary to provide the Service, including campaign, product, analytics and tag configuration data.

We use data received from Google services to provide and secure the Service, operate the integrations, generate recommendations, carry out actions approved by the User and for diagnostics. We do not sell such data or use it for purposes unrelated to PPCMax functionality.

The User may connect a PPCMax account to a third-party AI assistant through the MCP server (the "MCP Client"). Connecting requires signing in to PPCMax and OAuth authorization. The MCP Client calls PPCMax tools on behalf of the User and within the permissions granted to it.

PPCMax receives from the MCP Client only the parameters of the tools it calls. We do not collect the content of conversations held in the MCP Client or data stored by the MCP Client.

In connection with the MCP server we process:

• MCP Client authorization and session data,
• data passed in tool parameters,
• data saved at the User’s request, such as memories, skills, notes and uploaded images,
• information about changes made after approval by the User,
• technical logs.

Tool results, including data from connected Google accounts, and the User’s name and email address shared during authorization, are delivered to the MCP Client chosen by the User and are processed under the terms of its provider.

We keep MCP server data for as long as the account is active or until the User deletes it. The MCP Client can be disconnected at any time in its settings.

We process data under Article 6(1) GDPR, in particular:

• point (b) (performance of the contract for the Service),
• point (c) (compliance with legal obligations, e.g. tax and accounting),
• point (f) (legitimate interests, including security, establishing and pursuing claims, and maintaining and developing the Service),
• point (a) (consent, where required, e.g. for certain marketing communications or cookie categories).

Cookies are small text files stored on the User’s device.

We use cookies and similar technologies to:

• make the Service work properly,
• maintain sessions and security,
• analyse how the Service is used,
• carry out marketing activities, where active and permitted by law.

The User can manage cookie settings in the browser. Restricting cookies may make some features of the Service unavailable.

We use third parties ("Service Providers") that help us provide the Service, including hosting, technical infrastructure, payments, error monitoring, analytics, communication and AI models. Service Providers process data only on our documented instructions and only to the extent necessary to perform the tasks entrusted to them.

We share data with third parties only in specific circumstances:

• when necessary to provide the Service,
• when required by law,
• when necessary to establish, pursue or defend claims,
• in corporate transactions (e.g. a merger, transformation or sale of the business), in compliance with the law.

We do not sell Users’ Personal Data.

We may use Personal Data to contact the User about:

• transactional and system matters,
• security and maintenance of the Service,
• organizational and legal matters,
• marketing, where a legal basis allows it.

The User may opt out of marketing communications by following the instructions in the message or by contacting us.

The security of Personal Data matters to us. We apply appropriate technical and organizational measures,.

No method of transmission over the Internet or method of electronic storage is fully secure. Therefore, despite appropriate safeguards, we cannot guarantee absolute security of data.

Data may be transferred outside the European Economic Area (EEA). In such cases we apply the transfer mechanisms required by the GDPR, including Standard Contractual Clauses (SCCs) or other adequate safeguards.

The Service may contain links, integrations or features that rely on independent third-party services. The use of such services is governed by the terms and privacy policies of those parties. We are not responsible for the content, availability or privacy practices of third-party services.

The Service is not directed at persons under 18 years of age. We do not knowingly collect children’s data. If we learn that data of a minor has been collected without the required legal basis, we will take appropriate action, including deleting such data.

We keep data no longer than necessary for the purposes described in this Privacy Policy, unless a longer period results from a legal obligation or a legitimate interest.

As a rule:

• account data is kept while the account is active,
• billing data is kept for the period required by tax and accounting law,
• backups are deleted according to the backup retention cycle of the infrastructure providers,
• technical and security logs are kept for as long as necessary for diagnostics, security and the defence of claims.

After the retention period, data is deleted or anonymised unless further processing is required by law.

We may update this Privacy Policy from time to time. We announce changes by publishing a new version of this document.

This Privacy Policy is governed by Polish law. Any disputes arising from this Privacy Policy are subject to the jurisdiction of the Polish courts, without prejudice to mandatory provisions of law.

To the extent provided by law, you have the following rights:

• the right of access to your data,
• the right to rectification,
• the right to erasure,
• the right to restriction of processing,
• the right to object,
• the right to data portability,
• the right to withdraw consent, where processing is based on consent,
• the right to lodge a complaint with a supervisory authority.

Requests to exercise these rights can be sent to [email protected]. As a rule we respond within 30 days of receiving a request. In complex cases this period may be extended by up to 2 further months, in which case we will let you know within the first 30 days.

To prevent disclosure of data to an unauthorized person, we may ask for additional information needed to verify your identity.

We do not use automated decision-making that produces legal effects for the User within the meaning of Article 22 GDPR, unless we expressly state otherwise and provide an appropriate legal basis.

The controller of Personal Data is Catchy Media Sp. z o.o., Al. Grunwaldzka 56/113, 80-241 Gdańsk, Poland, tax ID (NIP): 9571150950. Privacy contact: [email protected].

If the User believes that the processing of their data violates the law, they have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland or another competent supervisory authority. Regardless, we encourage you to contact us first so that we can resolve the matter amicably.