Privacy notice

Who we are

Tradecraft AI is a trading name of Pymax Ltd, company number 12507417. Pymax Ltd operates this website and is responsible for the personal information it handles through it.

Google user data: what we access

Our LLM Marketing Skills software lets you manage your own advertising accounts from an AI assistant. When you choose to connect a Google account, Google asks you to approve access. We request only these scopes: https://www.googleapis.com/auth/adwords (Google Ads) and, if you connect Display & Video 360, https://www.googleapis.com/auth/display-video and https://www.googleapis.com/auth/doubleclickbidmanager. We do not request your Google profile, name, email address, Gmail, Drive, Calendar or Contacts.

Through those scopes the software can read and, when you ask it to, change the advertising data in the accounts you authorised: account and customer IDs, campaigns, ad groups, ads, keywords, audiences, budgets, bids, settings, creatives and performance reports. It accesses this data only to carry out a request you make. It does not browse your accounts on its own.

Google user data: how we use it

We use Google user data only to provide and improve the user-facing features you requested, that is, reading and managing your advertising accounts on your instruction. We do not sell it, use it for advertising or to build advertising profiles, and do not use it to train generalised AI models.

Tradecraft AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our staff do not read your Google user data, except where you ask us for support and give permission, where it is needed for security or abuse investigation, or where the law requires it.

Google user data: who we share it with

Requests and responses pass between the software on your computer and Google's APIs through a relay that we operate on Google Cloud (Cloud Run). The relay handles your data in memory only to forward the request and does not store it. Our only other recipient is the AI assistant you choose to use: results are returned to the software running on your computer and shown to that assistant so it can answer you. That assistant is your own tool and is governed by its provider's terms, so review them before connecting sensitive accounts.

We do not share, transfer, sell or disclose Google user data to any other third party, except where the law requires it or to protect against fraud, abuse or security threats. Our own records (licence, installation and replay-protection records) hold no Google user data.

Google user data: data protection and security

We treat all Google user data, including OAuth tokens and the advertising account data the software accesses, as sensitive information. We protect it with the administrative, technical and physical safeguards described below.

Encryption in transit: all traffic between the software on your computer, our relay and Google's APIs is encrypted using HTTPS with TLS 1.2 or higher. Only short-lived access tokens are sent to the relay, in a protected header that the relay removes before forwarding.

Encryption at rest: your Google refresh token is stored only on your computer, in the operating system's encrypted credential store (macOS Keychain, Windows Credential Manager or Linux Secret Service), and is never sent to the AI assistant. For Display & Video 360, the relay exchanges authorisation codes and refresh tokens transiently and does not store them; the resulting tokens are saved in the same credential store on your computer. Our application secrets are held in Google Cloud Secret Manager, which encrypts them at rest. The relay stores no Google user data, so we hold none at rest on our servers.

Access controls: access to our production systems, including the relay on Google Cloud Run and Google Cloud Secret Manager, is restricted to authorised Tradecraft AI personnel, protected by multi-factor authentication and granted on a least-privilege basis.

Data minimisation and retention: we request only the advertising scopes listed above. The relay processes requests in memory only to forward them, and we keep no copy of your Google user data, so there is nothing for us to retain or delete on our servers. Application logs, monitoring and error reports are configured not to capture request or response bodies, headers, tokens or advertising data.

Request integrity: the relay forwards requests only to fixed Google hosts and checks a licence and a signed proof from your installation on every call, so it cannot be used to reach other services or to act for anyone other than you.

Monitoring and incident response: we monitor the relay for errors and misuse. If we become aware of a security incident affecting your Google user data, we will investigate it promptly, take steps to contain it and notify affected users, and the relevant authorities where the law requires, without undue delay.

Software security: we keep the software and the relay's dependencies up to date and release security fixes promptly.

Your control: tokens and results stay on your computer until you remove them. You can withdraw access at any time at myaccount.google.com/permissions, and you can delete the software's entries from your operating system's credential store. To ask us anything about this data, use the contact route under Your choices and rights below.

Information we receive

The site does not run its own contact form. The booking calendar is provided by Cal.com. If you book a call, Cal.com collects the details you enter and provides the booking information to us so we can arrange and hold the meeting.

If you accept advertising cookies, Google Ads may store or read identifiers used to connect an ad click with a completed booking. The confirmation event we send to Google does not include your name, email address or the information you entered into Cal.com.

Why we use it

We use booking information to provide the consultation you requested and to respond to any follow-up you ask for. We use Google Ads measurement only with your consent, to understand whether advertising leads to booked consultations.

Who receives it

Cal.com processes booking information for the scheduling service. Google processes advertising measurement data only when you accept the optional advertising cookies. Each provider may process data outside the UK under its own safeguards and privacy terms.

How long we keep it

We keep booking information only for as long as we need it to arrange the call, handle requested follow-up and meet legal or accounting duties. You can remove or change your advertising-cookie choice at any time through Cookie settings.

Your choices and rights

You can ask for access to, correction of or deletion of personal information we hold about you. Depending on the circumstances, you may also ask us to restrict its use, object to its use or provide a portable copy. You can withdraw advertising-cookie consent at any time.

To make a privacy request, use the booking calendar on the home page and state that the booking concerns privacy. You can also complain to the UK Information Commissioner's Office if you believe your information has been mishandled.