Privacy Policy

1. Introduction

This Privacy Policy explains how Digituary ("we", "us", "our") collects, uses, stores, and protects personal data when you use our products — Sensor, our cookieless B2B analytics tool, and Captain, our AI Google Ads budget-allocation tool — and their associated services.

By using Sensor or Captain, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Who We Are

Digituary is a digital marketing and technology company. For the purposes of the EU General Data Protection Regulation (GDPR), Digituary acts as the data processor on behalf of our clients (the data controllers) when processing end-user data through Sensor and Captain. When you interact directly with our website or create an account, we act as the data controller.

3. Data We Collect

We collect and process the following categories of data:

3.1 Account & Billing Data

When you create a Digituary account, we collect your name, email address, company name, billing address, and payment information. Payment processing is handled by third-party providers — we do not store credit card numbers on our servers.

3.2 Google Ads Account Data (via Captain)

When you connect your Google Ads account to Captain, we access campaign, ad group, keyword, and performance data through the Google Ads API. This includes impressions, clicks, conversions, cost data, quality scores, impression-share metrics, and keyword-level performance history. This data is used solely to provide budget-allocation recommendations and automated budget management.

3.3 Behavioural Data (via Sensor)

If you deploy Sensor, a lightweight cookieless script collects anonymized behavioural signals from visitors on your website. This includes page views, scroll depth, click patterns, session duration, engagement signals, and referral sources. Sensor does not collect personally identifiable information (PII) from your website visitors. Every visitor is represented as an anonymous daily fingerprint that resets each day, so no individual can be tracked over time — by anyone, including us.

3.4 Usage Data

We collect information about how you use Sensor and Captain, including feature usage, dashboard interactions, login timestamps, and API calls. This helps us improve the products and provide technical support.

3.5 Technical Data

We automatically collect IP addresses, browser type, device information, and operating system when you access our platform.

4. How We Use Your Data

We use the data we collect for the following purposes:

Purpose	Data Used
Providing the Sensor & Captain services	Account data, Google Ads data, behavioural data
Budget allocation & keyword scoring (Captain)	Google Ads performance data
Intent classification & attribution (Sensor)	Anonymized behavioural signals
Account management & billing	Account data, payment data
Product improvement	Usage data, technical data (aggregated)
Customer support	Account data, usage data
Legal compliance	All data as required by law

5. Lawful Bases for Processing (GDPR)

Under the GDPR, we process personal data based on the following lawful bases:

• Contractual necessity — Processing required to deliver the Digituary products you have subscribed to.
• Legitimate interest — Product improvement, fraud prevention, and security. We conduct balancing tests to ensure our interests do not override your rights.
• Consent — Where required, for marketing communications and optional analytics. You may withdraw consent at any time.
• Legal obligation — Processing necessary to comply with applicable laws and regulations.

6. Google Ads Data (Captain)

Captain connects to your Google Ads account via the Google Ads API using OAuth 2.0 authentication. We access your data in read-only mode for analysis and in read-write mode for automated budget allocation (only when you explicitly enable automation features).

We do not sell, rent, or share your Google Ads data with third parties for their own purposes. Your Google Ads data is processed exclusively to provide you with budget-allocation services.

7. Behavioural Data (Sensor)

The Sensor product collects behavioural data from visitors to your website (our client's website). As such:

• You (our client) are the data controller for your website visitors' data.
• We (Digituary) act as the data processor, processing this data on your behalf under our Data Processing Agreement (DPA).
• Because Sensor is cookieless and collects no personal data, it is designed to operate without a consent banner. You remain responsible for ensuring your overall use of Sensor complies with the privacy laws that apply to your site.

Sensor data minimization

Sensor is designed with privacy-by-design principles. It collects engagement signals (scroll, click patterns, dwell time) without collecting form inputs, keystrokes, or personally identifiable information. Raw event data is purged within 24 hours of processing.

8. Cookies & Tracking Technologies

The Digituary application (the Sensor and Captain dashboards) uses cookies and similar technologies for:

Cookie Type	Purpose	Duration
Essential	Authentication, session management, security	Session / 30 days
Functional	User preferences, dashboard settings	1 year
Analytics	Platform usage patterns (aggregated)	1 year

We do not use advertising or marketing cookies on our platform. Sensor is cookieless by design — the script we deploy on client websites sets no cookies on visitor devices and uses an anonymized daily fingerprint that resets every day, so it never tracks visitors across sessions or domains.

9. Data Sharing & Third Parties

We share data with the following categories of third-party service providers, solely to deliver our services:

• Cloud infrastructure — Hosting, storage, and computing (data remains within the EU or regions with adequate data protection unless otherwise specified).
• Payment processors — Billing and subscription management.
• Google — API access to your Google Ads account, for Captain (authorized by you).
• Analytics tools — Aggregated usage analytics for product improvement.

All third-party processors are bound by Data Processing Agreements (DPAs) and are required to implement appropriate security measures. We do not sell personal data to any third party.

10. International Data Transfers

Digituary is based in Ukraine. When data is transferred outside the European Economic Area (EEA), we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where applicable.
• Supplementary measures including encryption in transit and at rest.

11. Data Retention

Data Type	Retention Period
Account data	Duration of active subscription + 90 days
Google Ads performance data (Captain)	Rolling 365-day window (configurable)
Sensor raw events	24 hours (purged after processing)
Sensor session scores	180 days
Usage/analytics data	12 months (aggregated)
Billing records	As required by applicable tax law (typically 7 years)

Upon termination of your subscription, we delete your data within 90 days unless retention is required by law. You may request earlier deletion by contacting us.

12. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access controls and the principle of least privilege.
• Regular security audits and vulnerability assessments.
• Incident response procedures with 72-hour breach notification (GDPR Article 33).
• Data processing infrastructure with redundancy and automated backups.

13. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate data.
• Erasure — Request deletion of your data ("right to be forgotten").
• Restriction — Request that we limit processing of your data.
• Portability — Receive your data in a machine-readable format.
• Objection — Object to processing based on legitimate interests.
• Withdraw consent — Where processing is based on consent, withdraw at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or as required by applicable law). You also have the right to lodge a complaint with your local data protection authority.

14. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know — What personal information we collect and how it is used.
• Right to delete — Request deletion of your personal information.
• Right to opt-out — Of the sale or sharing of personal information. We do not sell personal information.
• Right to non-discrimination — We will not discriminate against you for exercising your rights.
• Right to correct — Inaccurate personal information.
• Right to limit use of sensitive personal information — Where applicable.

To submit a request, email [email protected] with the subject line "CCPA Request".

15. Children's Privacy

Sensor and Captain are B2B enterprise products and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Digituary platform at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:

For EU-specific enquiries, you may also contact your local supervisory authority. See also our Terms of Service.