Privacy policy

1. Who is responsible and how to contact us

The Salty Pistachio LTD is responsible for the personal information we process to operate kroosr. For privacy questions, access or deletion requests, contact javier@thesaltypistachio.com. Where a business uses kroosr to manage information about other people, that business determines the purposes of that processing; we process that workspace information on its behalf.

2. Information we collect

• Account and access information: name, email address, account identifier, organization membership, workspace permissions and authentication information.
• Workspace content: app details, research, keywords, reports, creative assets, uploaded files, instructions, messages and work records that you or your team provide.
• Connected service data: information you authorize from advertising, app store, attribution, email or other services. This can include account identifiers, campaign settings and performance, app analytics, and communications or contact details when you connect a communications feature.
• Operational information: request and error logs, IP address, browser or device information, timestamps, feature activity, change history and support correspondence.

Which data is processed depends on your connected services, permissions and enabled features. Avoid providing sensitive personal information that is unnecessary for your work.

App and market research may also use publicly available app store listings, developer contact details and advertising information, including information published by Apple and Google. Account details needed to authenticate you are required to provide workspace access; connecting an additional service is optional, but its connected features will not work without the relevant authorization.

3. Google account and Google Ads data

When you connect Google Ads, Google asks you to authorize access. We access the Google identity information returned by that authorization, including your email address and Google account identifier, and the advertising accounts available to that identity.

For authorized Google Ads accounts we access account and customer identifiers, campaign names and identifiers, campaign status, budgets, bidding targets, location targeting, conversion action settings, and reporting metrics such as spend, impressions, clicks, installs, conversions and conversion value. Geographic reports describe campaign performance by location; this integration is not a source of individual users’ live locations.

We use this information to connect the correct account to a workspace, display reports, analyze campaign performance, prepare recommendations and apply changes requested through the product. Features can update campaign budgets, bidding targets, status or supported location settings within the account permissions and safeguards configured in the workspace.

We store the connection identity, authorized scopes, an encrypted refresh token, account mappings, cached reports, settings and audit records needed for those features. Credentials are used to maintain the authorized connection and are not displayed in public reports.

kroosr’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising targeting, transfer it to data brokers, or use it to train general purpose artificial intelligence or machine learning models.

4. How we use information

We use information to provide and maintain the service, authenticate users, enforce workspace permissions, synchronize connected accounts, produce requested reports and creative work, perform configured workflows, answer support requests, prevent misuse and troubleshoot errors. Audit records help users review actions taken in their workspace.

We process personal information as necessary to provide contracted services, for legitimate interests in operating and securing the service, to comply with legal obligations, and with consent where consent is required. You may withdraw consent for a connected service by revoking its authorization.

5. Optional AI features

When an AI feature is enabled and used, relevant instructions, workspace content and selected data may be sent to the configured AI provider to produce the requested output. Google Ads analysis can include campaign identifiers, campaign settings, performance metrics, geographic summaries and your instructions. The Google Ads analysis context does not include your OAuth refresh token.

Depending on the feature and workspace configuration, processing may use providers such as OpenAI, Anthropic or Google, or a configured local model. Google user data is used only to provide the requested user facing analysis or assistance, subject to the Limited Use commitments above. Review your provider and fallback settings before using AI with confidential content.

6. Sharing and access

Workspace information is available to authorized members according to their permissions. We share information with hosting, storage, authentication, communications and other service providers as necessary to operate the features you use. Our infrastructure uses Google Cloud and Firebase. Connected platforms receive the API requests and changes needed to carry out your instructions; optional AI providers receive the context described above.

We may disclose information where required by law, to address fraud or security incidents, or to protect legal rights. Access by our personnel is limited to what is necessary for operations, support, security or legal obligations. Human access to Google user data is limited to circumstances permitted by Google’s Limited Use requirements, such as your consent to support access or a necessary security or legal investigation.

7. Storage, security and international processing

We use access controls, authenticated workspace permissions, HTTPS for service connections and encryption of stored Google Ads refresh tokens. No method of storage or transmission is completely secure. Protect your login details and grant access only to people you trust.

Information may be processed in countries where we or our providers operate, including outside your country. Where applicable law requires safeguards for international transfers, we use the appropriate contractual or other lawful transfer arrangements. Contact us for information about the safeguards relevant to your data.

8. Retention, disconnection and deletion

We retain information for as long as needed to provide the service, maintain your workspace, resolve disputes, protect security and meet legal obligations. Retention depends on the type of record and its purpose. Cached reports may be refreshed or replaced; audit and support records can remain after an integration is disconnected.

A workspace administrator can disconnect Google Ads in its connection settings. Disconnection removes the stored connection, account mappings and cached campaign and geographic reports, and attempts to revoke the refresh token with Google. You can also revoke access directly in your Google Account connections. Revocation prevents future authorized access but does not itself delete all previously stored workspace or audit records.

To request deletion of your account or stored connected service data, email javier@thesaltypistachio.com. We may verify your identity and authority over the workspace before acting. Information required for legal or security purposes may be retained for those purposes; backup copies are removed through the applicable backup lifecycle.

9. Cookies and browser storage

We use a session cookie to keep you signed in and browser storage for preferences such as appearance and workspace selections. These support authentication and the operation of the service. You can clear or block them in your browser; doing so may sign you out or reset preferences.

10. Your rights

Depending on applicable law, you may request access, correction, deletion or a portable copy of your personal information, restrict processing, object to processing based on legitimate interests, or withdraw consent. Contact us using the address above. If your organization controls the relevant information, we may direct the request to its administrator. You can also complain to your local data protection authority, including the UK Information Commissioner’s Office.

Right to object: you may object to processing based on our legitimate interests by contacting us at the email address above.

11. Children and other websites

kroosr is a business workspace for app operators and is not directed at children. This policy covers kroosr, not the separate consumer apps managed through it. Connected services and external websites have their own privacy policies.

12. Changes to this policy

We will publish changes on this page and update the effective date. We will give additional notice where required. If a change introduces a new use of Google user data, we will provide the required disclosure and obtain consent before using it for that new purpose.