Privacy Policy

01 Information we collect

We collect information in three ways: what you give us, what you connect, and what we observe automatically.

• Account & waitlist details — your name, email, and optionally company and role, provided when you join the waitlist or create an account.
• Customer Data — the data sources and datasets you authorize picoask to connect to and analyze.
• Usage & device data — log data, queries run, feature usage, IP address, and browser information collected automatically to operate and secure the Service.

You control what Customer Data you connect and what you enter into queries. Please don’t submit sensitive or special-category personal data (for example health, financial-account, or government-ID information) beyond what your analysis needs; where you do connect such data, you are responsible for having a lawful basis, as described in our Terms.

02 Our role

For Customer Data — the data sources and datasets you connect — we act as a processor and handle it only on your instructions to provide the Service. For account, waitlist, and usage data, we act as the controller, and this Policy describes how we handle it.

03 How we use information

We use information to provide, maintain, and improve the Service; to run analyses and generate results you request; to communicate with you about access, updates, and support; to secure the Service and prevent abuse; and to comply with legal obligations.

We do not sell your personal information, and we do not use your Customer Data to train foundation models without your explicit consent.

04 Connected advertising and analytics platforms

When you connect an advertising or analytics account, picoask reads data from that platform on your instruction and stores it in a warehouse schema belonging to your account.

Google user data. If you connect Google Ads, picoask accesses reporting data for the Google Ads accounts you have linked to picoask’s manager account — campaign and ad performance (spend, impressions, clicks, conversions and conversion value), ad tracking configuration, and click identifiers used to attribute a conversion back to the click that produced it. If you connect Google Analytics 4, picoask accesses reporting data for the properties you grant it. Google Ads and Google Analytics 4 access is read-only: picoask never creates, edits, pauses or manages Google campaigns or properties, and never writes to a Google account. The optional Actions capability described below is not available for Google Ads or Google Analytics 4.

We use this data solely to answer questions inside your own picoask account. We do not sell it, share it with other customers, use it for advertising, or use it to train machine-learning models. It is transmitted over TLS and stored in a schema isolated from other customers.

Actions (optional). picoask can also propose changes to a connected advertising account — for example, pausing an ad set that is spending without producing orders. This capability is off by default, is currently in private beta, and is not available for Google Ads or Google Analytics 4. Connecting a platform never enables it: you must separately grant write permission for each account, and that permission is stored apart from the read-only access described above. Each proposed change is shown to you together with the figures it was based on and waits for your approval, unless you have chosen to let a specific kind of change proceed automatically. We record every proposal and decision — including who approved it, when, and what changed — so the history can be reviewed in picoask. You can revoke write permission at any time, which takes effect immediately; the record of past proposals and decisions is retained for as long as your account is active, so that changes already made remain explainable.

Revoking access. You can disconnect a platform at any time in picoask, or revoke access from the platform itself — for Google Ads, by removing picoask as a manager in your own Google Ads account. Either stops all further reads immediately. On request we delete the data synced from that platform within three business days. Contact contact@picoask.ai.

05 Legal bases

Where required (for example, under the GDPR), we process personal data on the bases of performing our contract with you, our legitimate interests in operating and improving the Service, your consent, and compliance with legal obligations.

06 Sharing & subprocessors

We share information with vetted service providers (such as cloud hosting, model, and analytics providers) who process it on our behalf under contractual safeguards. We may disclose information if required by law or to protect our rights, and in connection with a merger or acquisition. We do not sell personal data.

07 Cookies & analytics

We and our analytics providers use cookies and similar technologies to operate, secure, and understand use of the Service. Our pages also load fonts from Google Fonts, which may receive your IP address when pages load. You can control or block cookies through your browser settings.

08 Data retention

We retain personal data for as long as your account is active or as needed to provide the Service, then delete or anonymize it within a reasonable period, unless a longer retention is required by law. You can request deletion at any time.

09 Security

We use administrative, technical, and physical safeguards — including encryption in transit and at rest and access controls — to protect information. No method of transmission or storage is fully secure, so we cannot guarantee absolute security.

10 Your rights

Depending on your location, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact privacy@picoask.ai.

If you are a California resident, you have additional rights under the CCPA/CPRA — including to know, delete, and correct your personal information and to opt out of its “sale” or “sharing.” We do not sell or share personal information as those terms are defined.

11 International transfers

We may process and store information in the United States and other countries. Where we transfer personal data across borders, we rely on appropriate safeguards such as standard contractual clauses.

12 Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

13 Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email, and the “last updated” date above will reflect the latest revision.