VGS HubBack to site

Privacy Policy

Last updated: 13 August 2026

Operated by Vargas Digital SRL - Sat Vălișoara, Județul Cluj, Romania · CUI 41265668 · Reg. Com. J2019002466127 · EUID ROONRC.J2019002466127 · Contact: sales@vargasdigital.us · +40 747 356 468

1. Who we are & our two roles

This Policy explains how Vargas Digital SRL ("Vargas Digital", "we", "us") processes personal data in connection with the VGS Ad Performance Hub software ("VGS Hub", the "App", the "Service") available at vargasdigital.cloud. It does not cover the separate Vargas Digital agency websites (vargasdigital.ro / vargasdigital.us), which have their own policies.

Under the EU General Data Protection Regulation (GDPR), we act in two distinct roles:

• As a data controller - for the personal data of the people who register for and use the App (account holders, their team members, billing contacts). We decide how and why that data is processed.
• As a data processor - for the personal data contained in the advertising accounts you connect and for the website‑visitor / end‑user data collected through our Tracking module. Here you (our customer) are the controller and we process that data only on your instructions and to provide the Service. This relationship is governed by our Data Processing Agreement (DPA), which forms part of our Terms of Service.

2. What VGS Hub is

VGS Hub is a multi‑tenant SaaS platform that advertisers and agencies use to report on, measure and manage advertising across multiple platforms. Core functions include cross‑account performance dashboards, KPI / anomaly / ad‑disapproval alerting, AI‑assisted analysis, first‑party conversion tracking, lead‑form delivery, Merchant Center product and Shopping performance reporting (and, where you explicitly enable it, updates to your own product listings), and paused‑by‑default campaign‑building tools. Each account you access is one you explicitly authorize through the relevant platform's OAuth flow; we never access an advertising account without that grant.

3. Personal data we process

3.1 Account & billing data - we are the controller

• Identity & contact: name, work email, workspace / company name, role, and (for team invites) the inviter and invitee details.
• Authentication: hashed password and session tokens; optional password‑reset tokens.
• Billing: plan, billing contact and transaction records. Card details are entered directly with our payment processor, Stripe, on Stripe's own hosted checkout and billing pages; we never receive or store them.
• Usage & technical: IP address, device / browser type, pages used, timestamps, and diagnostic logs.

3.2 Data from connected advertising & analytics accounts - we are a processor

• Connection credentials: the OAuth access and refresh tokens issued when you connect a platform. These are encrypted at rest and used only to call that platform's API on your behalf.
• Advertising & measurement data: account and campaign names, performance metrics (spend, impressions, clicks, conversions, conversion value), search terms, aggregate demographics and geography, conversion actions, and ad‑review / disapproval status.

This data can include personal data of your own customers where you have configured it (for example, conversion events). We process it solely to provide the Service to you.

3.3 Website‑visitor / end‑user data via the Tracking module - we are a processor

If you deploy our first‑party Tracking on your website, we process, on your behalf and under your instructions, data about your website visitors in order to measure conversions and (where you enable it) send measurement events to the advertising platforms you have connected:

• Contact identifiers - email address and phone number, where your site provides them. We store these encrypted at rest, never in plain text, and we send them to an advertising platform only as SHA‑256 hashes.
• Name and address data - first name, last name or full name, and city, state / region, postal code and country, where your site provides them. These are stored encrypted at rest and are used to match your conversions. Names are sent to advertising platforms only as SHA‑256 hashes; city, region, postal code and country are sent in the form each platform's measurement specification requires, which for some platforms is unhashed.
• Advertising click identifiers - such as gclid, gbraid, wbraid, fbclid.
• Event & commercial data - page views, conversion events, order/value and currency, and a visitor identifier.
• Technical data - IP address (used for processing and geo/consent handling) and user agent.

Collection and onward transmission of this data is governed by each visitor's consent, captured and honored per your site's consent configuration, and by the DPA. You are responsible for the lawful basis and notices toward your own visitors.

3.4 Lead‑form data via Lead Workflows - we are a processor

If you enable Lead Workflows, we receive the leads generated by your own lead‑generation ad forms and, where you configure it, deliver them to the destinations you choose (for example email, a spreadsheet, a webhook or your CRM). This includes the contact details and the full set of answers the person submitted to your form - typically name, email address and phone number, together with any additional questions you asked. We process this data on your behalf and under your instructions; you remain its controller and are responsible for the lawful basis and the notices given on your form.

3.5 Merchant Center & Shopping data - we are a processor

If you connect a Google Merchant Center account, we read your product feed, listing and Shopping performance data to produce diagnostics and reporting, and - only where you explicitly enable listing edits - apply the product‑listing changes you request. Product and listing data is generally not personal data; where your feed or account contains personal data, we process it on your behalf and under your instructions.

4. Google user data & Limited Use

When you connect Google, VGS Hub requests only the scopes needed for the features you use:

5. Meta, TikTok, LinkedIn & Microsoft data

Where you connect Meta, TikTok, LinkedIn or Microsoft Advertising, we access and process data from those platforms' APIs only to provide the features you use (reporting, measurement, alerting and paused‑by‑default campaign building), and only for the accounts you authorize. Our processing of that data complies with each platform's developer terms and platform policies, including the Meta Platform Terms and Developer Policies. We do not use data received from these APIs to build or enrich any independent profile, and we do not repurpose or resell it.

6. Why we process data & legal bases

7. AI‑assisted features

Some features generate written analysis of your performance data using a third‑party AI provider (Anthropic). The data sent for this purpose is your advertising performance data; we design these features to send the minimum necessary and to avoid transmitting directly‑identifying personal data. Our AI provider processes the data under contract and does not use it to train its models on your behalf.

8. Sharing & sub‑processors

We do not sell personal data. We share it only with:

• The advertising / analytics platforms you connect - as the source of your data and, where you enable it, the recipient of the measurement events you choose to send.
• Sub‑processors who help us run the Service, under written contracts. Current sub‑processors include:

The current list is maintained in the DPA sub‑processors annex. We may also disclose data where required by law or to protect our rights.

9. International transfers

Some recipients are located outside the European Economic Area (notably the advertising platforms and certain sub‑processors in the United States). Where we transfer personal data outside the EEA, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses, and/or the EU‑US Data Privacy Framework, together with additional safeguards where appropriate.

10. Retention

• Account data: for the life of your account and then as needed for our legitimate interests and legal obligations.
• Advertising & performance data: detailed daily data is kept for your plan's window (approximately 13, 25 or 37 months depending on tier), after which it is reduced to thin monthly summaries.
• Tracking events: retained for up to 13 months, then deleted or aggregated.
• Aggregated / pseudonymized analytics: may be retained longer with salted‑hashed identifiers and no ad copy.
• Accounting records: retained for the periods required by Romanian fiscal law.

When you delete your account, connected‑account tokens are revoked and your data is deleted or anonymized, subject to the legal‑retention exceptions above.

11. Security

We apply technical and organizational measures appropriate to the risk, including:

• HTTPS/TLS in transit; encryption at rest for OAuth tokens and sensitive identifiers.
• Application secrets stored outside the web root with restricted permissions; never in source control.
• A fail‑closed per‑tenant isolation fence applied to every read and write, so one customer cannot access another's data.
• Role‑based access control and least‑privilege internal access.

No system is perfectly secure, but we work to protect your data and to notify you and the authorities of any qualifying breach without undue delay (and within 72 hours where required).

12. Your rights

Subject to GDPR, you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent at any time. To exercise any right, email sales@vargasdigital.us; we respond within 30 days. Where we act as a processor (data inside your connected accounts or Tracking), please direct the data subject's request to the relevant controller - our customer - and we will assist them.

You may also lodge a complaint with your local supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

13. Data & account deletion

You can disconnect any platform from within the App at any time, which revokes our access. To delete your account and associated data, follow Data & Account Deletion.

14. Children

VGS Hub is a business tool and is not directed to children. We do not knowingly process the personal data of anyone under 16.

15. California residents

If you are a California resident, the following applies in addition to the rest of this Policy. We do not sell your personal information, and we do not share it for cross‑context behavioural advertising, as those terms are defined by the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA"). We have not done so in the preceding twelve months.

Where we process personal information on behalf of a customer - the data in your connected advertising accounts, the data collected by our Tracking module, and lead‑form data - we act as that customer's service provider under the CCPA, on the terms set out in Section 8 of our Data Processing Agreement. If you are a consumer of one of our customers and wish to exercise a CCPA right over that data, please contact that business directly; we will assist them in responding.

For the personal information we hold as a business in our own right - your account, billing and usage data - you may request to know, delete or correct it, and you may use an authorized agent to make that request. Email sales@vargasdigital.us. We will verify the request against the information already associated with your account and will not discriminate against you for exercising any of these rights. We do not currently respond to browser "Do Not Track" signals, because we do not track individuals over time and across third‑party websites for our own purposes.

16. Changes to this Policy

We may update this Policy as the Service or the law evolves. The "Last updated" date at the top of this page always identifies the current version. When we make a material change, we post the revised Policy on this page at this same address, update that date, and notify account holders by email and through a notice in the App before the change takes effect, unless a change must take effect immediately to comply with law. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

17. Contact

Vargas Digital SRL · Sat Vălișoara, Județul Cluj, Romania
Email: sales@vargasdigital.us · Phone: +40 747 356 468
CUI 41265668 · Reg. Com. J2019002466127 · EUID ROONRC.J2019002466127