Privacy Policy

Swishiy is an independent marketing measurement service operated by Qudees Kiani. Contact: hello@swishiy.com.

Website: pages you visit, referral source, and anonymised device data via standard analytics.

Contact & audit forms: the email address and business URL you submit, plus the audit results generated from your Google Ads data.

Google Ads Auditor: when you sign in with Google we request read-only access to your Google Ads account (https://www.googleapis.com/auth/adwords) and read your Search Terms report for the last 90 days. We also receive your basic Google profile (name, email) so we can identify the session.

Google Ads data is used solely to generate your audit and display the results back to you in the browser. We do not use it to build advertising profiles, we do not sell it, and we do not share it with third parties beyond the infrastructure providers listed below.

Swishiy's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not allow humans to read it (except with your explicit permission for support, to comply with the law, or for security purposes), and we do not transfer it to third parties except as strictly necessary to provide the audit you requested.

When you sign in with Google we request the minimum scopes required to run the audit. Nothing else is requested, and no scope grants us the ability to modify your Google Ads account.

Creative Intelligence (swishiy.com/app) is used by the businesses we work with to analyse their Meta ads. A business connects a Meta ad account through Facebook Login for Business, which gives Swishiy a token for that business's portfolio rather than for a person, or through a System User token its owner provides. The business chooses which ad accounts and Pages Swishiy may use.

What we read

• The business portfolio's ID, to know which business granted access (business_management).
• The ad accounts the business shares (name, currency, time zone, status), and their campaigns, ad sets and ads with names, statuses and creatives: images, video thumbnails and frames, headlines, primary text, descriptions and calls to action. Daily performance per ad (spend, impressions, clicks, purchases, purchase value, frequency) and the attribution settings of the ad sets (ads_read).
• The Pages the business shares, by name, and a Page's name and profile picture to preview an ad before it is created (pages_show_list, pages_read_engagement).

What we write

Only when a buyer or owner of the workspace asks, and only with ads_management: a finished picture is added to the ad account's image library, and an ad can be created in an existing ad set, always paused, with its ad creative. Swishiy never turns an ad on, never changes a budget, campaign or ad set, and never publishes on a Page's timeline: the post behind such an ad appears only as that ad.

How we use it

Meta data is used only to show the business its own advertising performance, to tag its creatives by angle, format and style, and to build the reports its own team shares. Three features send part of it to Anthropic, and only when in use: tagging sends a creative's picture and copy, without account identifiers or ad names; a worded summary sends the figures Swishiy picked for that period; concept suggestions send the copy of the business's best-performing ads for one angle. Meta data is never sold, never used to build advertising profiles, and never shown to another business. Swishiy follows the Meta Platform Terms.

Storage, disconnecting and deletion

The token is encrypted (AES-256) on our servers and never shown to anyone, including the business's own team. Synced data is stored in our backend (Supabase, EU region) for as long as the workspace stays connected and its owners keep it. A business can end Swishiy's access at any time:

• in Creative Intelligence, under Settings, Data sources: Disconnect deletes the token, and Delete data from Meta also deletes everything that came from Meta;
• in Meta, under Business Settings, Integrations, Connected apps, by removing Swishiy. Meta then notifies us, and we delete the token and, on a deletion request, the data that came from Meta.

The data deletion page explains each way and shows the status of a request made through Meta.

Your Google OAuth refresh token is stored encrypted at rest in our backend (Supabase / Lovable Cloud, EU region) and is used only to fetch data during your session. All data in transit between your browser, our backend, Google's APIs, and our subprocessors is encrypted using HTTPS/TLS 1.2+. Sessions expire after 24 hours. Audit outputs are retained for 90 days so you can revisit results, then deleted.

You can revoke Swishiy's access at any time in two ways:

• Click Disconnect Google inside the Google Ads Auditor. This revokes the token server-side and deletes your session immediately.
• Or open myaccount.google.com/permissions and remove Swishiy from your list of connected apps.

Access to production systems that store Google user data (refresh tokens, audit outputs) is restricted to the Swishiy founder (Qudees Kiani) on a strict need-to-know basis, protected by unique accounts, strong passwords, and two-factor authentication. No third party, contractor, or automated system accesses Google user data except the subprocessors listed below acting on our behalf under contract.

We rely on: Supabase (backend & database, EU), Lovable (hosting), Anthropic (search-term classification, only search-term strings are sent, no account identifiers or metrics; and tagging of Meta ad creatives, only the picture and copy are sent), fal.ai (picture generation in Creative Intelligence, from the prompts and pictures a user chooses to send), Klaviyo (email delivery), HubSpot (CRM), Google (OAuth and Ads API) and Meta (Facebook Login for Business and the Marketing API).

Anthropic does not use this data to train its models. Requests are made under Anthropic's standard commercial API terms, not a consumer product, which prohibit training on customer inputs and outputs by default.

You may request access, correction, or deletion of your data at any time by emailing hello@swishiy.com. We respond within 30 days.

We may update this policy; material changes will be announced on this page with a new "last updated" date.