Privacy Policy

This Privacy Policy explains how Anesthesia Zone, LLC, a Delaware limited liability company doing business as Roasby ("Roasby", "we", "us"), collects, uses, shares and protects personal data when you visit roasby.com, join the waitlist, create an account, connect ad accounts or AI assistants, or otherwise use the Roasby service (the "Service").

Roasby lets you manage Google Ads, Microsoft Ads and ChatGPT Ads by talking to an AI assistant you choose (such as Claude, ChatGPT, Codex or Cursor) through our MCP server, and through our web dashboard.

Who is responsible for your data

• Controller. For your account, your workspace membership, billing, support, the website and the waitlist, Anesthesia Zone, LLC is the controller of your personal data.
• Processor. For the data in the ad accounts that you or your workspace connect (campaigns, ads, keywords, search terms, metrics and any personal data in them), we act as a processor on behalf of the customer that connected them, under our Data Processing Addendum. If you are a client of an agency that uses Roasby, contact that agency first about that data.

Contact: [email protected], or Anesthesia Zone, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

Data we collect

The categories below describe the main kinds of personal data we collect. They are examples, not a complete list: what we collect depends on how you use Roasby and may change as the Service develops, in line with this policy.

You give us:

• Account details: name, email address, password (stored only as a one-way hash), passkeys (public keys only), two-factor authentication secrets and recovery codes (encrypted), interface language.
• Google sign-in: if you choose "Continue with Google", Google shares your name, email address, whether it is verified, and a Google account identifier. We request only the openid, email and profile scopes for sign-in.
• Workspaces: workspace names, the members you invite (their email addresses and roles) and invitations.
• Waitlist: your email address, the page language and the date you joined.
• Support messages: anything you write to us and our replies.
• Billing: if you take a paid plan, your billing name, address, tax ID and plan. Payments are handled by Stripe; we never see or store full card numbers.

When you connect an ad account (Google Ads, Microsoft Advertising, ChatGPT Ads):

• Google Ads: when you connect Google Ads, we request the https://www.googleapis.com/auth/adwords scope. It lets Roasby read the ad accounts you connect and make the changes you confirm. The Google Ads API offers no narrower scope.
• OAuth access and refresh tokens, or the ad account's API key (ChatGPT Ads), stored encrypted.
• The account structure and settings: accounts, campaigns, ad groups, ads, assets, keywords, audiences, budgets and bids.
• Performance data: daily metrics such as impressions, clicks, cost and conversions, and search terms.
• Ad data can include personal data, for example customer lists or names in ad text. We process it only to provide the Service.

When you connect an AI assistant:

• The OAuth client the assistant registers (its name and redirect address) and the access tokens we issue to it.
• The tool calls it makes: which tool, when, for which workspace, and the result.
• We do not receive your conversations with your assistant. The assistant sees only the results of the tools it calls.

Generated as you use the Service:

• Change log: changes made to an ad account through Roasby, with the person or assistant that made it, the time, and the values before and after. It powers one-click revert.
• Audit log: security-relevant events (for example admin actions), with the actor, the time, and for people, the IP address and browser user agent.
• Email records: the emails we send you (recipient, subject, delivery status) and, for emails our team writes, their content.
• Technical data: server logs (IP address, requested URL, time, browser), and error reports (see Sentry below).
• Cookies: see Cookies and tracking.

We do not knowingly collect special categories of personal data, and you should not put them in ads or support messages.

How we use data, and our legal bases

We use personal data for purposes like the following, including other purposes that are compatible with them or that we tell you about when we collect the data:

We send product news only with your consent, and every such email has an unsubscribe link.

Google API Services: Limited Use

Roasby's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data we receive from Google APIs (Google sign-in and the Google Ads API):

• We use it only to provide and improve the user-facing features of Roasby that you ask for.
• We do not transfer it to others except as needed to provide those features, to comply with law, for security, or as part of a merger or acquisition with your notice.
• We do not use it for serving advertising, including retargeting or personalized ads, and we do not sell it.
• We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.
• Our staff do not read it unless you give us permission (for example in a support request), it is needed for security or abuse investigation, it is required by law, or it is aggregated and anonymized for internal operations.

We apply the same rules to data from Microsoft Advertising and ChatGPT Ads, in line with those platforms' terms.

AI and your data

• Your own assistant. When you connect an AI assistant, it receives only what the Roasby tools return for its request, for the workspace you authorized. For example, the "workspace members" tool returns members' names and email addresses. What the assistant does with that data is governed by your agreement with its provider (for example Anthropic or OpenAI).
• In-app AI. Some features (recommendations, alert triage, report summaries, support triage) send only the data the feature needs to OpenAI or, as a fallback, Anthropic, through their business APIs. Under their API terms, they do not use this data to train their models and keep it for no more than 30 days, for abuse monitoring.
• Recommendations. To suggest search terms to exclude, we send OpenAI each costly search term that brought no conversion, with the keyword it matched and the names of its ad account and campaign; to explain new recommendations, we send the same facts with their cost and clicks. Nothing changes in an ad account until a person approves it, or your own AI assistant does after you confirm.
• Anomaly alerts. To decide whether an unusual spend, cost per conversion or ad disapproval is worth an email and how severe it is, we send OpenAI only its numbers, the currency and the campaign type: no names of people, ad accounts, campaigns or ads. Alert emails go to the owner and admins of the workspace, who can turn them off in their account settings.
• Weekly reports. To write the short summary at the top of a workspace's weekly report, we send OpenAI (or, as a fallback, Anthropic) the week's figures per currency and platform and the names of the campaigns whose conversions rose or fell most: no names of people and no email addresses. Reports are emailed to the workspace's members, and anyone can stop them with the unsubscribe link in each email or in their account settings.
• Support triage. To spot spam, abuse reports and urgent requests, we send OpenAI the subject and text of support messages (with email addresses and phone numbers masked, never the sender's address) and, for each new account or waitlist signup, the name you gave and the domain of your email address (never the full address). The result only sorts the message or signup for our team; it never blocks or changes an account on its own.
• No training. We do not use your data or your ad account data to train AI models, ours or anyone else's.
• You stay in control. Roasby is designed so that AI does not change an ad account on its own: changes ask for your confirmation, new items start paused, and most changes can be reverted. These safeguards reduce risk but cannot rule out every error, so review what you confirm.

Who we share data with

We do not sell your personal data. We share it only with:

• Service providers (subprocessors) that host, deliver and support the Service under contracts that limit their use of the data: Hetzner (hosting), Cloudflare (network, email delivery, encrypted backups), Sentry (error monitoring), Stripe (payments), OpenAI and Anthropic (in-app AI), and, only with your consent, analytics and advertising providers. The full, current list with purposes and locations is at /subprocessors.
• The platforms you connect. When you ask Roasby to read or change an ad account, we send the request to that platform (Google, Microsoft or OpenAI) on your behalf.
• Your workspace. Members of a workspace see its ad accounts, change log and members according to their role.
• Professional advisers such as lawyers and accountants, under confidentiality.
• Authorities, when the law requires it or to protect the rights, property or safety of our users, the public or us. Where allowed, we tell you first.
• A buyer or successor if our business or the Service is sold, merged or reorganized, under this Policy's protections; we will tell you before your data becomes subject to a different policy.

Under some US state laws, using advertising pixels can be a "sale" or "sharing" of personal data for targeted advertising. We use them only after you consent, and you can opt out at any time (see below).

Cookies and tracking

We use cookies and similar technologies, such as local storage, to run and improve Roasby. Essential cookies are needed for the site to work and are always on. The tables below list the main cookies we use today, as examples; names and durations may change as the Service develops, and we keep this policy up to date with any new kind of cookie or purpose.

Optional cookies are set only after you agree in the cookie notice. While any of them is in use, Cookie preferences in the site footer lets you change your choice at any time:

• Analytics: Google Analytics 4 and Microsoft Clarity, to understand how the website and sign-up flow are used. Clarity records page interactions with text inputs masked.
• Marketing: the Google Ads tag, Microsoft Advertising UET, the Meta Pixel and the LinkedIn Insight Tag, to measure our own ad campaigns that promote Roasby.

If you withdraw consent, we delete the optional cookies we can reach and stop loading these tools; cookies set on the providers' own domains expire on their own schedule or can be deleted in your browser.

Optional tools are set up to run only on our public pages (home page, product, FAQ and guide pages, docs, legal and sign-in pages) and only while you are signed out. They are not loaded inside the signed-in app, which is designed to keep them away from your ad account data. On your first visit, a cookie notice tells you about our cookies; when optional tools are in use, it also asks for your choice.

We honor Global Privacy Control: if your browser sends it, we treat it as a refusal of marketing cookies. You can also block or delete cookies in your browser.

International transfers

Anesthesia Zone, LLC is based in the United States. Our servers are hosted by Hetzner in Germany and Finland. Authorized members of our team may access data remotely from Egypt for support and operations, under confidentiality and access controls. Our providers may process data in the United States, the European Union and other countries where they operate.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where a provider is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Contact [email protected] for a copy of the relevant safeguards.

How long we keep data

We keep personal data only as long as needed for the purposes above:

When you disconnect an ad account, we delete its tokens and stop syncing at once, and we permanently delete its synced data and change log. Weekly reports already created keep their totals until they expire, and the audit log records the disconnection. We may keep an account's data while Roasby support has it locked, and some data longer when the law requires it or to resolve disputes.

How we protect data

We use reasonable technical and organizational measures, including encryption in transit (TLS) and at rest for secrets and tokens, separation between workspaces, two-factor authentication and passkeys, least-privilege access, encrypted off-site backups and monitoring. No method of storage or transmission is completely secure, and we cannot guarantee that data will never be accessed, lost or changed without authorization. If a breach affects your personal data, we will notify you and the authorities as the law requires. Details are on our Security page.

Your choices and rights

Everyone can:

• see and correct your account details in Settings;
• disconnect ad accounts and AI assistants at any time;
• delete your account in Settings → Profile;
• change your cookie choices through Cookie preferences in the footer;
• unsubscribe from non-essential emails.

If you are in the EEA, the UK or Switzerland, you have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. You may also complain to your local data protection authority.

If you are a resident of a US state with a privacy law (such as California, Colorado, Connecticut, Virginia, Texas or Oregon), you have the right to know what personal data we hold about you, to access, correct and delete it, to obtain a portable copy, and to opt out of the sale or sharing of personal data and of targeted advertising. We do not sell personal data for money, and we do not use personal data for profiling with legal or similarly significant effects. We will not discriminate against you for exercising your rights. You may use an authorized agent; we may ask the agent for proof of authority and verify your identity. If we deny your request, you may appeal by replying to our decision; if the appeal is denied, you may contact your state attorney general.

To exercise a right, email [email protected] from the address on your account. We respond within 30 days (45 days where US state law allows, with notice). We may need to verify your identity first. For ad account data that a customer connected, we will pass your request to that customer and help them answer it.

Children

Roasby is a business service for people aged 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact [email protected] and we will delete it.

Changes to this policy

We may update this policy as Roasby changes. The date at the top shows the latest version. If a change is material, we will tell you by email or in the app at least 30 days before it takes effect, where possible, and ask for your consent again where the law requires it.

Contact

Anesthesia Zone, LLC (Roasby) 131 Continental Dr, Suite 305, Newark, DE 19713, United States Privacy: [email protected] · Support: [email protected] · Security: [email protected]