SearchAds Radar is an AI agent for Apple Ads, operated by AppNest Technologies (“we”, “us”). This policy explains what data we collect when you use searchadsradar.com, the SearchAds Radar app, our MCP server and the SARKit SDK, what we do with it, who we share it with, how long we keep it, and the choices you have.
We do not sell personal data, we do not use it for advertising, and we do not use your data to train AI models. Questions about this policy go to [email protected].
1. Our role
For your account, billing and website data, we decide how the data is used, so we act as the controller.
For data that comes from your own apps and their users (through RevenueCat, the SARKit SDK or Apple's attribution APIs), we process it on your instructions to provide the service, so we act as your processor. You remain responsible for telling your app's users about that collection, for example in your own privacy policy and your App Store privacy details.
2. What we collect
Your account
- Name and email address.
- Your password, stored only as a bcrypt hash, or, if you sign in with Google, the profile Google shares with us (name, email address and profile image). We use Google only to sign you in: we do not ask for access to your Google account and we do not keep Google's access tokens.
- Answers you give during onboarding, such as your role, budget range and experience with Apple Ads.
- Workspaces, team memberships, roles and invitations you send or receive.
- Your analytics cookie choice and when you made it.
- Security records: failed sign-in attempts, including the email address used and the IP address they came from.
Billing
Paid plans are billed through Stripe. We send Stripe your email address, your workspace identifier and, if you accepted analytics cookies, your Google Analytics client ID so we can measure which visits lead to a subscription. Card details go directly to Stripe and never reach our servers.
Apple Ads
- The credentials you connect: an API key we generate for you, or the tokens Apple issues when you sign in with Apple. These are encrypted at rest.
- Your Apple Ads user and organization identifiers.
- Campaign, ad group, keyword, ad, search term, budget, bid and performance data from your Apple Ads account, and a history of the changes made through SearchAds Radar.
RevenueCat
- Your RevenueCat API key and, if you add one, a dashboard token, both encrypted.
- Subscription data about your app's customers: the app user ID you assign in RevenueCat, transactions, products, prices, currency, taxes and commissions, store, country, subscription status, cancellation reasons and Apple Ads attribution details.
- Raw webhook deliveries from RevenueCat, including the sending IP address and user agent.
The SARKit SDK
If you add SARKit to your iOS app, it sends us, for each install of your app: device and anonymous identifiers generated by the SDK, any user ID you choose to set, your bundle ID, SDK version, device model, OS version, locale, timezone, app version and build, Apple's AdServices attribution token, StoreKit transactions, sessions and any custom events and properties you choose to send. Our server also records the IP address each request comes from. We send attribution tokens to Apple's AdServices API to find out which campaign and keyword drove the install.
The AI agent and MCP
- Your chat messages, the agent's replies, generated insights, reports and plans, and traces of the prompts and tool calls behind them.
- Every call made through the MCP server, including its arguments and results, and the access tokens and OAuth clients you create. Access tokens are stored hashed.
- Questions typed into the “Ask” box on our home page. For rate limiting we keep a salted hash of the visitor's IP address, not the address itself.
Notifications
If you connect your own Telegram bot for reports and alerts, we store its token encrypted and the chat it posts to.
Website analytics and server logs
Only if you accept analytics cookies, we use Google Analytics 4 to understand how visitors use the site, such as pages viewed and buttons clicked. With the same consent, our servers also report sign-ups, sign-ins and subscription changes to Google Analytics, tagged with your internal user ID. Until you accept, all Google consent signals stay set to denied and nothing is sent. See Cookies.
Like most websites, our web server logs each request's IP address, the page requested and the browser's user agent.
3. How we use it
- To run the service: sync your Apple Ads and revenue data, join spend to revenue, answer your questions, and produce insights and reports.
- To make the changes to your Apple Ads account that you, or a token you created, ask for. In the app, a change happens only after a person approves it. Over MCP, a token with write access makes changes immediately, without a separate approval step.
- To sign you in, keep accounts secure and investigate abuse.
- To bill paid plans and enforce plan limits.
- To send service email: a welcome message, password resets (or, for Google accounts, a note that you sign in with Google) and team invitations. We do not send marketing email from the product.
- To debug problems, monitor quality and improve the product.
- To meet legal obligations.
Where the GDPR applies, our legal bases are: performing our contract with you; our legitimate interests in securing and improving the service; your consent, for analytics cookies; and legal obligations, such as keeping billing records.
4. AI processing
The agent runs on Anthropic's Claude models. To answer a question or generate an insight, we send Anthropic the relevant parts of your data, such as campaign metrics, revenue figures and your message. Anthropic processes this under its commercial terms, which do not allow it to train models on that data. We do not train any AI models on your data.
We keep your conversations and the traces behind each answer in our own database, so you can return to past conversations and so we can investigate wrong or poor answers. Deleting a conversation in the app removes its messages. The traces behind its answers are kept until your account is erased.
AI output can be wrong. Treat the agent's analysis as a recommendation and review proposed changes before approving them.
6. Where data is stored
Our servers and backups are in Germany. Some of the providers above, including Anthropic, Stripe, Google, Resend and Cloudflare, are based in the United States or process data there. Where data leaves the European Economic Area, we rely on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses.
7. How long we keep it
These are deleted automatically:
- Dismissed or expired insights: 90 days after they expire.
- Background job and sync logs: after 90 to 180 days.
- Web server logs: after 14 days. Application logs are rotated by size.
- Database backups: deleted data can remain in backups for about 14 days before they roll over.
Everything else has no automatic expiry today and is kept until your account is erased (see Your rights). That includes your account and workspace data, Apple Ads data, RevenueCat and SARKit data (including the IP addresses they record), conversations, AI traces and prompts, MCP call logs, failed sign-in records and questions typed into the Ask box. If we introduce shorter limits, we will update this section.
Deleting an app from your workspace removes it from SearchAds Radar, but today it does not erase every historical record linked to that app. Erasing your account does.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to withdraw consent. In the app you can:
- Manage team members and their app access in Account settings.
- Disconnect Apple Ads, RevenueCat or Telegram at any time.
- Delete individual conversations, and export your customer data as CSV.
- Change your analytics cookie choice by clearing this site's cookies and choosing again in the banner.
For anything else, including erasing your account, email [email protected] from the address on your account. We will confirm the request comes from you and respond within the time the applicable law allows, which is generally one month.
What erasing your account does
- We delete your account and sign-in details, the workspaces you own with all of their apps and data, and your conversations, AI traces and MCP activity in any workspace.
- If you own a workspace other people use, we check with you first, because erasing it removes it for them too. A paid subscription has to be cancelled first.
- Records you created in someone else's workspace, such as a change you approved to its campaigns, stay in that workspace's history without your name or ID.
- We keep billing records, such as invoices and payments, with Stripe for as long as accounting and tax law requires.
- Copies in backups are gone within about 14 days.
If you use an app that uses SearchAds Radar
If your data reached us through someone else's app, that app's developer controls it, so please contact them first. When the developer asks us to, we delete your data from their app.
You also have the right to complain to your local data protection authority.
10. Security
Apple Ads credentials, RevenueCat keys and Telegram bot tokens are encrypted at rest with AES-256. Passwords are hashed with bcrypt, MCP access tokens are stored as hashes, and we do not keep Google sign-in tokens. Each workspace's data is isolated from every other workspace's, and traffic to our site is encrypted in transit. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you as the law requires.
11. Children
SearchAds Radar is a business tool for people 18 and over. We do not knowingly collect data from children. Data about your app's own users comes to us on your instructions, as described in Our role.
12. Changes to this policy
We will post any changes on this page and update the effective date. If a change is significant, we will also tell signed-in users by email or in the app before it takes effect.
13. Contact
AppNest Technologies, operator of SearchAds Radar. Email [email protected]. See also our Terms of Service.