Leo

Privacy Policy

Effective: 5 June 2026

1. Overview

Leo helps small businesses find and stop wasted spend in their Google Ads accounts. This policy explains what data we collect, how we use it, and the rights you have over it.

By using Leo at useleo.ai, you agree to this policy.

2. Who we are

Leo is operated by Beech PPC, a sole-trader business owned by Chris Beechey, based in Australia. You can contact us about privacy questions at chris@beechppc.com.

3. Data we collect

From you directly

  • Account details: your email address when you sign up.
  • Billing details: handled entirely by Stripe. We never see or store your card number. We only receive a customer ID and subscription status from Stripe.

From Google (via OAuth)

When you connect your Google Ads account, we request these scopes:

  • https://www.googleapis.com/auth/adwords — read access to your Google Ads data, and (with your explicit confirmation per change) write access to add negative keywords.
  • Basic profile information (email, name) to identify your account.

Specifically, we read:

  • Search term reports for the last 7 days
  • Campaign and ad group structure
  • Existing negative keyword lists (to deduplicate suggestions)

We do not read or store:

  • Your ad copy
  • Your bidding strategy or budgets
  • Your customer match lists or remarketing audiences
  • Your billing or payment details from Google

Automatically

  • Standard server logs (IP address, browser type, pages visited) for security and operations.
  • Cookies necessary for authentication.

4. How we use your data

  • Search term data: to classify each term as wasteful or relevant and show you the result. We do not share, sell, or expose this data to anyone outside your account.
  • Email: to send you transactional notifications (scan results, billing confirmations, account alerts) and occasional product updates. You can unsubscribe from product updates anytime.
  • Billing data: to process your subscription via Stripe.

5. Google User Data — Limited Use

Leo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only use your Google user data to provide and improve the Leo service.
  • We do not use Google user data for advertising.
  • We do not transfer Google user data to others except as needed to provide or improve the service, comply with law, or as part of a merger or acquisition (with continued protection).
  • Humans (including Leo staff) do not read your Google user data except (a) with your explicit consent for a specific purpose, (b) for security purposes such as investigating abuse, (c) to comply with legal obligations, or (d) where the data has been aggregated and anonymised.

6. How we store and protect your data

  • Data is stored in Supabase (PostgreSQL) on managed infrastructure.
  • Connections are encrypted in transit via HTTPS.
  • Data at rest is encrypted by Supabase.
  • OAuth refresh tokens are encrypted before storage.
  • Access to production systems is restricted to authorised personnel.

7. Data retention and deletion

  • You can disconnect your Google Ads account at any time from the dashboard. When you do, we delete your OAuth tokens and stop fetching new data.
  • You can delete your Leo account at any time. When you do, we permanently delete your profile, authentication record, cached scan results, and stored search term data.
  • Billing records may be retained for 7 years to comply with Australian tax law.

8. Sharing data

We do not sell your data. We share data only with the following processors, who are bound by contract to handle it only for the purposes we direct:

  • Supabase — database hosting and authentication
  • Stripe — subscription billing
  • Vercel — application hosting
  • Resend — transactional email

We may disclose data if required by law (subpoena, court order) or to investigate fraud or abuse.

9. Your rights

You can:

  • Accessyour data — email us and we'll provide a copy.
  • Correct inaccurate data — most fields are editable in the dashboard.
  • Delete your account and data — via the dashboard or by emailing us.
  • Exportyour data — email us and we'll provide a portable copy.

The Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles govern how we handle personal information. If you have a complaint, contact us first. If unresolved, you can complain to the OAIC.

10. International transfers

Some of our service providers (Supabase, Stripe, Vercel, Resend) may store data in countries other than Australia, typically the United States and the European Union. These providers are required by contract to maintain protections equivalent to Australian standards.

11. Children

Leo is not intended for users under 18. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this policy from time to time. We'll notify active users by email of material changes at least 30 days in advance.

13. Contact

For privacy questions or to exercise your rights, email chris@beechppc.com.