Privacy Policy & Data Protection Notice

Data controller: Opus Growth is a trading brand of Talat KOÇ, a sole proprietorship registered in Türkiye (Gökalp Tax Office). Contact: support@opus-growth.com

Opus Growth ("Company", "we", "us") acts as the data controller for the personal data processed through Opus Growth. This notice explains what data we collect, how we use it, whom we share it with, and your rights. It also serves as our privacy policy.

1. Data We Process#

• Identity & contact: name, email (from Google Sign-In), and billing details.
• Account & authorization: the OAuth authorizations for the platforms you connect — Google (Google Ads, Search Console, Analytics 4, YouTube, Tag Manager, Business Profile), Microsoft Advertising, LinkedIn, TikTok and Meta (Facebook/Instagram) access tokens (all stored encrypted) and the related account IDs. ChatGPT Ads (OpenAI) connects with an Ads API key you create in OpenAI Ads Manager; that key is stored encrypted as well.
• Advertising & measurement data: campaign and performance data retrieved from the Google Ads API, the Microsoft Advertising API, the LinkedIn Marketing API, the TikTok Marketing API, the Meta Marketing API and the OpenAI Ads API (ChatGPT Ads) — plus Search Console, Analytics 4, YouTube and Tag Manager data to the extent you authorize it — only at your request, solely to provide the service.
• Data Studio (Looker Studio) reports: if you use our Data Studio connector, Data Studio connects with the same Opus Growth sign-in you use in Claude or ChatGPT, without a key. The connector keeps its sign-in token in your own Google account; on our side the connection is recorded like any AI app connection and listed under Connected AI apps in your panel, where you can remove it. We also keep the report branding you set (name, logo, colour). Report data is read from your connected accounts when Data Studio asks for it, kept in a short cache of up to 30 minutes and delivered to Data Studio under your own Google account. For older connections made with a connector key, we keep only a one-way summary (hash) of that key.
• SEO & AEO data: when you use the SEO Intelligence add-on, your queries (domain, keyword, competitor) and the results returned are stored against your account for up to 30 days. The purpose is so that repeating the same query does not mean buying the same data twice: the stored result is returned to you without spending credits, and we tell you when it was taken. You can run a fresh query at any time. This data belongs to your account only and is never shared with or combined across other customers.
• Usage & technical data: audit logs, service-usage records, IP address, cookies.
• Payment data: your card details are never stored by us; payments are processed entirely on Paddle's infrastructure.
• Community forum: if you use the forum, your display name, posts, IP address and moderation records. Details are in section 12.

2. Purposes & Legal Bases#

We process your data to provide the service and perform our contract with you, to comply with our legal obligations, to establish or defend legal claims, and for our legitimate interests — for the purposes of account management, billing, security, support, and service improvement.

3. Sharing#

We share data with Paddle for payment processing, with our hosting provider Hetzner (servers in Germany, backups in Finland) and our network provider Cloudflare, and — only with your authorization — with the ad platforms you connect: Google (Google Ads, Search Console, Analytics 4, YouTube and Tag Manager APIs), Microsoft (Advertising API), LinkedIn (Marketing API), TikTok (Marketing API), Meta (Marketing API) and OpenAI (Ads API, for ChatGPT Ads), strictly to the extent required to deliver the service and under contractual safeguards. AI functionality is processed on Anthropic (Claude) or OpenAI (ChatGPT) infrastructure, depending on the assistant you use. If you use our Data Studio (Looker Studio) connector, the report data you request is delivered to Google (Data Studio) under your own Google account. Measuring our own advertising: when you sign up, start using Opus Growth or subscribe, we report that event to the ad platforms we advertise on, Meta, TikTok and OpenAI (ChatGPT Ads), so we can measure our own campaigns. We send only one-way summaries (SHA-256 hashes) of your email address and, for Meta, of your Opus Growth account number, never the plain values, together with the event name and, when you arrived from one of our ads, that platform's click identifier. Opus Growth team and test accounts are never reported, and no data from the ad accounts you connect is used for this. You can object to this at support@opus-growth.com. All of the recipients listed above are located outside Türkiye; transfers are made only to the extent necessary to perform the service and under contractual safeguards.

If you use Opus Growth to process personal data on behalf of your business or your clients, our Data Processing Agreement applies to that data and forms part of our Terms of Service.

4. Retention & Security#

We keep each category of data only for the periods below. Deleted data also leaves our encrypted backups as they rotate, within at most 12 months.

• Account and profile data (name, email, language, settings): while your account is active. After you ask us to delete your account, it is deleted within 30 days.
• Platform authorizations (access and refresh tokens, API keys, connected account IDs): until you disconnect the platform or delete your account. Disconnecting deletes the stored token immediately.
• Data Studio connector: the connection and your report branding until you remove them or delete your account; report data cached for Data Studio for up to 30 minutes.
• Advertising and measurement data: read from the platform when you or your AI assistant asks for it and not kept as a full copy. We keep only what a feature needs: the latest summary of each report for your panel, report links you choose to share, and daily Instagram follower counts for growth reports. These are kept while your account is active and deleted with it.
• SEO Intelligence results: 30 days.
• Click protection records (IP address, click ID and browser of clicks on your own website, if you install our click protection tag): 90 days.
• Activity log of the actions taken in your connected accounts: while your account is active, so you can review them. Deleted with your account.
• Service health data (tool name, error code, duration; content masked): 13 months.
• Website analytics (pages visited, session data): 13 months.
• Support conversations and feedback: 2 years. Resolved support issues: 1 year.
• One-time sign-in codes and links: deleted 30 days after they are created; each can be used once; codes you request are valid for 15 minutes.
• Payment and invoice records: for the period required by Turkish tax and commercial law (up to 10 years). They are detached from your account when the account is deleted.

All platform authorization tokens (Google, Microsoft, LinkedIn, TikTok, Meta, OpenAI) are stored encrypted (Fernet) and access is restricted through authorization controls.

Data received through AI assistants: when you use Opus Growth from ChatGPT, Claude or another AI assistant, we receive only the requests the assistant sends to our tools (the tool name and its inputs, for example an account ID, a date range or a budget amount) and we return the result. We do not receive or store your conversation history. Inputs are processed to perform the request; actions that change your accounts are written to your activity log described above.

5. Your Rights#

You have the right to access, correct, and delete your personal data, to learn how it is processed, and to object to processing. You can disconnect any platform instantly from the Customer Panel (the stored token is deleted). For other requests, write to support@opus-growth.com; we will respond within 30 days at the latest.

6. Google User Data & Limited Use#

Opus Growth accesses your Google account only with your OAuth authorization and only for the accounts you authorize (Google Ads, Search Console, Analytics 4, YouTube, Tag Manager and Business Profile). Data obtained from Google APIs is used solely to provide the user-requested analysis and advertising-management features we offer. We do not use this data for advertising, we do not sell it, and we do not transfer it to third parties; human access occurs only for security, to comply with the law, or with your explicit request for support, in accordance with applicable rules.

Marketing and contact limitation: No data from your connected ad accounts — including any contact details contained within an account (e.g. a phone number in a call extension) — is used for the Company's own marketing, sales, or promotional activities, or to contact you outside of the service. We contact you only via the email address you registered with, and only about service-related matters.

Opus Growth's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Opus Growth's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. LinkedIn Data#

The LinkedIn Ads connection is established only with your OAuth authorization and only for the ad accounts you authorize. Data obtained from the LinkedIn Marketing API (ad accounts, campaigns, performance metrics) is used solely to provide the analysis and ad-management features you request; it is not used for advertising, not sold, and not transferred to third parties. Our processing complies with the LinkedIn API Terms of Use. Your access token is stored encrypted; you can revoke the connection at any time from the Customer Panel or your LinkedIn account settings.

8. Meta (Facebook/Instagram) Data#

The Meta Ads connection is established only with your Facebook Login authorization and only for the ad accounts you share. Data obtained from the Meta Marketing API (ad accounts, campaigns, ad sets, performance metrics, your Page list) is used solely to provide the analysis and ad-management features you request; it is not used for any other purpose, not sold, and not transferred to third parties. Our processing complies with the Meta Platform Terms. Your access token is stored encrypted; you can disconnect from the Customer Panel, or remove the app in your Facebook settings and send a data deletion request — Meta's data-deletion callback is wired to our systems, and all stored Meta authorization data is permanently deleted the moment the request arrives.

9. Microsoft Advertising Data#

The Microsoft Advertising connection is established only with your OAuth authorization and only for the ad accounts you authorize. Data obtained from the Microsoft Advertising API (ad accounts, campaigns, ad groups, keywords, performance metrics, UET tags and conversion goals) is used solely to provide the analysis and ad-management features you request; it is not used for advertising, not sold, and not transferred to third parties. Our processing complies with the Microsoft Advertising Agreement. Your access token is stored encrypted; you can revoke the connection at any time from the Customer Panel or your Microsoft account settings.

10. TikTok Ads Data#

The TikTok Ads connection is established only with your authorization and only for the ad accounts you authorize. Data obtained from the TikTok Marketing API (ad accounts, Business Center details, campaigns, ad groups, creatives, audiences, pixels and performance metrics) is used solely to provide the analysis and ad-management features you request; it is not used for advertising, not sold, and not transferred to third parties. Our processing complies with the TikTok Business Products (Data) Terms. Your access token is stored encrypted; you can revoke the connection at any time from the Customer Panel or your TikTok Business Center settings.

11. ChatGPT Ads (OpenAI) Data#

The ChatGPT Ads connection uses the Ads API key you create in OpenAI Ads Manager and give to Opus Growth; each key belongs to one ad account. The key is checked against that account before it is saved, stored encrypted and never shown back. Data obtained from the OpenAI Ads API (ad account details, campaigns, ad groups, ads, context hints, pixels and conversion event settings, spend limits and performance metrics) is used solely to provide the analysis and ad-management features you request; it is not used for advertising, not sold, and not transferred to third parties. You can disconnect at any time from the Customer Panel or by asking your assistant, which deletes the stored key immediately, and you can also revoke the key in OpenAI Ads Manager.

12. Community Forum#

When you use the forum at forum.opus-growth.com, we process the following data:

• Public data: the display name you choose, the topics and posts you share, the likes you receive, your level and your badges. Anyone can see these, and they can appear in search engines. Your email address is never shown.
• Security data: the IP address stored with your posts and rate-limit records, used to prevent spam and abuse through multiple accounts. To stop one person from opening several accounts, we also keep a protected summary of the device and network you use the forum from: a security cookie of our own (ogf_d), the country, the browser type and whether the connection comes from a VPN or hosting network. This summary contains no raw IP address or device identifier, only an encrypted value used for comparison; it is never shown to other members and is deleted after 180 days. The system groups accounts that look linked, automated review only looks at how those accounts behave on the forum, and any removal is always decided by the Opus Growth team.
• Moderation records: the result of the automatic check on each post and its reason, reports you make and reports about you, and warning and suspension records.
• Private messages and follows: the members you follow and who follow you, members you block, the members and messages of your private conversations, and read and online status. Private messages are visible only to the members of the conversation. Messages are reviewed automatically for spam and abuse; our team sees a message, with the few messages before it for context, only when it is flagged or reported.

Purpose and legal basis: running the forum and publishing your posts (performance of a contract), keeping the forum safe and preventing abuse (legitimate interest), and meeting our legal obligations.

Processing with AI: posts are checked automatically on Anthropic (Claude) infrastructure before they are published. When a reader asks for a translation, the post is translated on the same infrastructure and the translation is stored for reuse. This transfer is made with the safeguards described in section 3. Automated review can only hold a post or send it to our team for approval; removals, warnings and suspensions are decided by the Opus Growth team. We email you every decision with the reason, and you can appeal any decision.

Retention: your posts and forum profile are kept until you delete them or delete your account. When you delete your account, your forum profile, posts, the topics you started, and your likes and reports are deleted too. Deleted data also leaves our backups as described in section 4.

You can exercise the rights described in section 5 for your forum data at support@opus-growth.com.