Privacy Policy

1. Who we are

Vector is operated by vboom (“we”, “us”). We provide analysis software to marketing agencies. We do not run advertising campaigns and have no commercial interest in the results of any advertiser whose data we process.

Contact for privacy enquiries: privacy@vboom.io.

2. Our role

For data about your own users — the people at your agency who log in — we are the controller.

For the advertising performance data we read from your connected Google Ads accounts, we are a processor acting on your instructions, and generally a sub-processor to your own clients. We process that data only to provide the service, and never for our own purposes, for training models, or for resale.

3. What we collect

Account and user data, which you provide:

• Name, work email address and role
• Agency name and the client names you enter
• Authentication data — password hashes and two-factor secrets, never plaintext passwords
• Product usage: pages viewed, findings acted on, exports performed

Advertising data, which we read from Google Ads with your authorisation:

• Account, campaign, ad group, keyword and budget structure
• Performance metrics — impressions, clicks, cost, conversions, conversion value
• Conversion action configuration and daily conversion volumes
• Search terms that triggered your ads
• Change history for the accounts you connect

4. Access is read-only

Vector never modifies your Google Ads accounts. Google does not offer a read-only variant of the Ads API scope, so this is enforced on our side: the client library we build is constructed without mutation methods, and an automated check fails our build if a mutation call is introduced anywhere in the codebase.

5. Search terms

Search terms are free text typed by members of the public and can occasionally contain identifying information. We treat them as the most sensitive category we hold: encrypted at rest, excluded from application logs, never sent to third-party language models beyond aggregated counts, and retained in readable form for 90 days.

6. Automated analysis

Detection, scoring and prioritisation are performed by deterministic software, not by a language model. A language model is used only to turn an already-computed finding into readable prose, from a fixed payload of aggregated metrics that contains no personal data. Every figure in the generated text is checked against that payload before it is stored.

No decision that produces a legal or similarly significant effect on any individual is made automatically. Vector recommends; a person at your agency decides.

7. Where data is held

All infrastructure is located in the European Union. A current list of sub-processors, what each one does and where it operates is published at /sub-processors.

8. How long we keep it

• Raw provider responses — 400 days, for audit and to re-run analysis over history
• Aggregated account and campaign metrics — for as long as your account is active
• Keyword and ad group metrics — 24 months
• Search term text — 90 days
• Findings, recommendations and their outcomes — for as long as your account is active
• Security and access audit logs — 24 months

On termination we delete all customer data and archived payloads within 30 days, retaining only the minimal records we are legally required to keep for accounting purposes.

9. Security

• Tenant isolation enforced in the database itself through row-level security, not only in application code
• Access to each client scoped by explicit grants, with an auditable record of who granted what and when
• Conflict walls: access that would breach a declared conflict between competing clients is blocked
• OAuth refresh tokens encrypted with envelope encryption; never logged, never returned by the API
• Encryption in transit throughout; TLS on every public endpoint
• Support access by our staff is time-boxed, requires a stated reason, and is written to your own audit log so you can see when it happened

10. Your rights

Where we act as controller you may request access, correction, erasure, restriction, portability, or object to processing. Where we act as processor we will assist you in responding to requests from your own clients. Write to privacy@vboom.io; we respond within 30 days.

You may also lodge a complaint with your local supervisory authority.

11. Cookies

We use a single session cookie required to keep you signed in. We do not use advertising or cross-site tracking cookies, and we do not embed third-party analytics that profile visitors. Fonts are served from our own domain rather than a third-party CDN, so visiting this site does not disclose your IP address to a font provider.

12. Changes

We will notify account owners by email at least 30 days before any change that materially reduces protections, and the effective date at the top of this page will always reflect the current version.