Virtual 360 ADS
Insights
English (US)
Join the waiting list

Privacy Policy

Version 3, updated on September 30, 2026

This policy describes how Virtual 360 ADS handles personal data on the website virtual360ads.com, on the waitlist, and on the Virtual 360 ADS platform, which is in pre-launch with access restricted to evaluation accounts authorized by us. It was written to be read in full and states exactly what we do, including what we do not do yet.

1. Who is responsible

The data controller is Virtual RL Especializada LTDA, CNPJ 52.197.772/0001-69, responsible for the Virtual 360 ADS product, based in Jundiaí, São Paulo, Brazil. The channel for privacy matters, including our data protection officer, is contact@virtual360ads.com.

2. Data you provide to us

  • Waitlist: the email address you enter, the page language, the date and time of sign-up, the source page and, when present, campaign parameters from the URL. We also keep a keyed code derived from your IP address (not the address itself), your browser identification, the version of this policy you accepted, and a unique unsubscribe code.
  • Platform account: name, email, password (stored only as a hash), optional phone, country, language and time zone, notification preferences and, when provided, your Brazilian tax number (CPF or CNPJ), stored encrypted and accompanied by a hash used only to prevent duplicate accounts and abuse of the trial period. If you sign in with your Google Account, we keep that account’s identifier and email.
  • Support and contact: the content of the messages you send us.

3. Data collected automatically

  • Security and audit records: IP address, browser identification, date and time, and the action performed, in login sessions, in the audit trail of operations made on the platform, and in abuse prevention records. These records exist to protect your account, to evidence operations, and to meet legal obligations.
  • Server logs: technical operating messages, without IP addresses, kept for seven days.
  • Cookies and local storage: as described in the Cookie Policy.

4. Data obtained from Google APIs, with your authorization

The platform only accesses Google data after you authorize each integration through Google’s own consent screen. You may connect one, several, or none. The list below states, for each permission, what we read, what we use it for, and what is stored.

Basic identification (openid, email). We read the identifier and the email of the Google Account used in the authorization. We use them to know which account was connected and to show it to you. We store both alongside the access credential, encrypted.

Google Ads (adwords). We read the ad accounts accessible to your Google Account and, for each account, campaigns, ad groups, ads, keywords, audiences, assets such as texts and images, budgets, bids, targeting, and performance metrics. We use this to display and manage your campaigns inside the platform. We store a copy of this data and of your ad images on our servers so the platform can respond without querying Google on every click. This permission also allows writing: creating, editing, pausing, enabling, and removing campaigns, ad groups, ads, keywords, audiences, assets, budgets, bids, and targeting. Every write happens only through an action you take on the platform, is recorded in the audit trail, and, when it has financial impact, asks for confirmation before being sent.

Google Analytics (analytics.readonly). From the Google Analytics 4 properties you choose, we read metrics aggregated by day, source, medium, and campaign: sessions, users, new users, page views, average duration, bounce rate, conversions, and revenue. We do not read individual visitor identifiers. We use this to show your website’s performance next to your campaigns. We store the aggregated series.

Google Search Console (webmasters.readonly). From the properties you choose, we read clicks, impressions, average position, and click-through rate by day, search query, and page. We use this to show your website’s organic performance. We store that series.

YouTube (youtube.readonly, yt-analytics.readonly, youtube.force-ssl). We read your channel data (name, description, image, subscriber, video, and view counts), daily channel metrics (views, watch time, subscribers gained and lost, likes, comments, shares), your most viewed videos and, on demand and without storing, reports on traffic sources, devices, countries, comments, and aggregated audience demographics. We use this to show the channel’s performance and to let you reply to comments and edit the title, description, and tags of your own videos. These two write actions happen only through an action you take and only on videos of the connected channel. We store the channel data, the daily series, the top videos, and the thumbnails of videos used in your ads.

PageSpeed Insights. This is not a permission over your Google Account. When you request a speed analysis, we send your website’s URL to Google using our own API key and store the result.

5. Limited Use of Google user data

Virtual 360 ADS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This means that Virtual 360 ADS does NOT transfer Google user data to third parties, except as necessary to provide or improve the user-facing features you see on the platform, with your consent, as part of a merger or acquisition, or as required by law or for security purposes; does NOT use this data to serve advertisements, including retargeting and personalized or interest-based advertising; does NOT allow humans to read this data, except with your explicit consent, for security purposes such as investigating abuse, to comply with law, or when aggregated and anonymized for internal operations; does NOT use this data to develop, improve, or train generalized artificial intelligence or machine learning models; does NOT sell this data; does NOT use it to determine creditworthiness or for lending purposes.

6. YouTube

By connecting YouTube you use the YouTube API Services and agree to the YouTube Terms of Service. The Google Privacy Policy describes how Google handles your data. The YouTube data we store is refreshed at each synchronization and deleted when you disconnect the integration or delete your account. You can revoke our access at any time on the permissions page of your Google Account.

7. Artificial intelligence

The platform has a support assistant and a marketing consultant based on Google’s Gemini model. The assistant receives only the message you type. The consultant receives, in addition to your message, a numeric summary of the dashboard you are viewing: aggregated indicators and, per channel, the channel name, spend, revenue, and return, plus the period and the currency. It does not receive your name, your email, your account identifiers, campaign names, or search terms. Conversations are kept only in server memory during the session, are not written to the database, and are not used to train models. You can clear the conversation at any time.

The platform also uses the Gemini model to translate technical notices automatically. When a connected advertising platform (currently Google Ads) returns a technical notice, such as the refusal of a change, Virtual 360 ADS shows that notice in the language set in the panel, and the sentence of the notice is translated by Google’s Gemini model, already mentioned in section 9. Before sending, the platform removes from the text any values in square brackets, web addresses, email addresses, numeric identifiers and technical identifiers, replacing each one with a neutral marker; only the generic sentence, with the markers, is sent to the provider. Neither the original text nor the removed values leave the platform through this path. The translation of the generic sentence is stored in the Virtual 360 ADS database so it can be reused when the same notice occurs again, in any account; the stored translation does not contain the removed values. The platform does not send your campaigns, metrics or reports for translation purposes, only the sentence of the technical notice, already without the values described above. The original text remains visible to you in the technical detail of the notice.

Providing the service you contracted or are evaluating (performance of a contract); notifying waitlist subscribers about the launch (consent); protecting accounts, preventing abuse, and evidencing operations (legitimate interest and legal obligation); billing and issuing tax documents when a contract exists (legal obligation); improving the product from aggregated data (legitimate interest).

9. Who we share data with

  • Hosting: the platform and website servers are located in a Newfold Digital (HostGator) data center in the United States. All data covered by this policy is stored there.
  • Google: the APIs listed in section 4, to which we send only the credentials you authorized and the queries needed; the Gemini model, as described in section 7; PageSpeed Insights, as described in section 4.
  • Stripe: processes payments when a contract exists. It receives your email and the chosen plan; card details are entered directly on Stripe and never pass through our servers. We keep only the card brand, the last four digits, and the expiry date.
  • Email: messages are sent by our own server, without a third-party provider.

We do not sell personal data and do not share it with advertisers or data brokers.

10. How long we keep data

  • Waitlist: until you unsubscribe. After unsubscribing we keep only the email and the date, so we do not write to you again; the other sign-up data is deleted.
  • Data obtained from Google APIs and ad images: while the integration is connected. When you disconnect an integration, we delete the credential, ask Google to revoke access, and delete the data and images synchronized from that integration. When you delete your account, everything is deleted.
  • Security and audit records: the IP address is removed from these records after twelve months; the remainder of the audit record, without personal data, may be kept to evidence operations.
  • Account data: while the account exists. Thirty days after the end of a trial period without a contract, integration credentials are deleted.
  • Tax and payment documents: for the period required by law.

11. How you control your data

  • Disconnect an integration: under Integrations, on the platform. This deletes the credential and that integration’s data.
  • Revoke through Google: on the permissions page of your Google Account. The platform loses access to the data immediately.
  • Delete your account: under Settings, on the platform, confirming with your password. Deletion removes the account and all data linked to it, including data obtained from Google.
  • Leave the waitlist: through the link in every message.
  • Exercise other rights: by writing to contact@virtual360ads.com.

12. Security

Integration credentials and tax numbers are stored encrypted with AES-256-GCM; passwords are stored as bcrypt hashes; two-factor authentication is enabled by default; all traffic uses TLS; server access is restricted and logged. No system is infallible, and in the event of an incident affecting your data you will be notified as required by law.

13. International transfers

The controller is in Brazil and data is stored in the United States. We apply the safeguards required by the Brazilian General Data Protection Law (LGPD) and, for users in the European Economic Area and the United Kingdom, standard contractual clauses with our providers.

14. Your rights

To confirm the existence of processing, access, correct, delete, obtain portability, withdraw consent, object to processing based on legitimate interest, and lodge a complaint with the data protection authority of your country. To exercise them, use the controls in section 11 or write to contact@virtual360ads.com. We respond within fifteen days.

15. Children

The platform is intended for professionals and businesses and is not directed at anyone under eighteen. We do not knowingly collect data from minors.

16. Updates

This is version 2, dated September 30, 2026. It replaces version 1, dated September 13, 2026, and now describes the platform in pre-launch, each Google permission individually, the use of artificial intelligence, retention periods, and the controls available. Material changes will be published on this page with a new date and version.