Sukidoo App Privacy Policy
Last updated: August 25th 2026
This Privacy Policy explains how Sukidoo collects, uses, shares and protects personal information when you use the Sukidoo application at https://app.sukidoo.com (the "Service") and when you visit our marketing website at https://www.sukidoo.com (the "Website").
Most of what follows concerns the Service, because that is where we handle the most information. Where something applies only to the Website, it says so.
1. Who we are
Sukidoo is a brand of Neopsis Pte. Ltd.
Address: 2 Venture Drive, #19-18, Vision Exchange, Singapore 608526
Email address for privacy requests: contact@sukidoo.com
If you have any questions about this Privacy Policy or how we handle your personal information, contact us at contact@sukidoo.com. We have designated a Data Protection Officer as required by the Singapore Personal Data Protection Act; their business contact information is published in accordance with that Act, and any request sent to the address above will reach them.
2. Our two roles: controller and processor
We handle two different kinds of information, and our role differs for each.
We are the controller of the information that identifies you and your organization as our customer: your account details, your workspace and team members, your billing records, and the technical and security logs generated when you use the Service. We decide why and how that information is processed, and this Privacy Policy is our notice to you about it.
We are a processor for the Google Ads data we access on your behalf. You — or the advertiser whose account you manage — remain the controller of that data. We process it only on your instructions, which you give by connecting an account and configuring the Service, and as described in our Terms of Service. A Data Processing Addendum is available on request at contact@sukidoo.com.
3. Information we collect
Information you provide directly
• Name and email address
• Company name, profile type (brand, freelancer or agency), and the number of Google Ads accounts you manage
• Account credentials (passwords are handled by our authentication provider and are never visible to us in readable form)
• Email addresses of colleagues you invite to your workspace, and the role you assign them
• Workspace settings, including timezone and per-account optimization preferences
• The content of any message you send us by email or through support
Billing information
Payments are processed by our payment provider, which acts as merchant of record and is identified to you at checkout. We never receive or store your full payment card number. From that provider we receive and store a customer identifier, your subscription status and plan, your billing country, the card brand and last four digits, and a record of invoices paid or refunded — so that we can show you your subscription in the Service.
Google account and Google Ads data
When you connect a Google Ads account, we receive through Google's OAuth flow:
• your Google account email address and Google user ID;
• an OAuth refresh token, which we store encrypted at rest and use only to obtain short-lived access tokens for the Google Ads API.
Using that authorization, we read from your Google Ads accounts:
• account details (customer ID, account name, currency, targeted languages and countries);
• campaign, ad group and asset group structure and names;
• account, campaign and ad group settings, including status, campaign type, targeting and bidding configuration;
• keywords, ad copy, sitelinks, callouts and other ad assets;
• search terms — the queries typed by people who saw your ads;
• the placements where your ads appeared;
• performance metrics such as impressions, clicks, cost, conversions and conversion value;
• product feed data, where a Merchant Center feed is linked.
We also fetch pages from the public website you advertise, and its sitemap, for context.
Search terms are queries typed by members of the public. They occasionally contain personal information that the person chose to type. We do not seek that information, we do not use it to identify anyone, and we process it only as part of analyzing your advertising.
Information collected automatically
When you use the Service, we and our providers collect:
• IP address, browser type and version, device type and operating system;
• pages viewed, actions taken, and date and time of activity;
• diagnostic information when something goes wrong, including error messages and stack traces;
• session recordings — our error-monitoring provider records a sample of application sessions, and sessions in which an error occurs, so that we can reproduce and fix faults. These recordings can include the pages you viewed and the actions you took inside the Service, and are associated with your account identifier.
If you visit our marketing website
You can browse the Website without giving us anything. If you fill in a contact, demo, waitlist or newsletter form, we collect what you put into it — typically your name, email address, company name, job title, a phone number if you choose to give one, and the content of your message.
We also collect the usual technical and usage information from Website visits: IP address and the approximate location derived from it, browser and device type, operating system, referring site, pages viewed, time spent, and the date and time of the visit.
Information from third parties
We receive information from the categories of provider listed in section 9 — for example subscription events from our payment provider, email delivery and bounce events from our email provider, and bot-detection signals from our bot-protection provider.
4. How we use your information
We use personal information to:
• create and administer your account, workspace and team-member access;
• provide the Service — analyzing your connected Google Ads accounts, generating optimization suggestions, and applying the changes you have authorized;
• process your subscription, payments and invoices, and enforce plan limits;
• send you transactional and lifecycle emails, such as sign-in links, invitations, and optimization recaps;
• provide customer support and respond to your requests;
• monitor, debug, secure and improve the Service;
• detect, prevent and investigate fraud, abuse and security incidents;
• comply with legal obligations and enforce our agreements.
We do not sell personal information, and we do not use your Google Ads data or your Customer Data for advertising, profiling or any purpose other than providing the Service to you.
5. Artificial intelligence and your data
Parts of the Service use a large language model, provided by a third-party AI provider under contract, to analyze advertising content. We are deliberate about what reaches it: what we send is drawn from your advertising content and from publicly available web content.
What we never send:
• your personal and account information — your name, your email address, your workspace name, or any Sukidoo login information;
• your account identifiers — the identifiers of your Google Ads account and of the items inside it;
• credentials of any kind — OAuth tokens, refresh tokens or API keys.
Nothing that identifies you, your organization, or any individual is sent to our AI provider.
Our AI provider processes this content only to return a result to us. Under the commercial terms we have with them, they do not use it to train their models, and they are bound by contract to the same confidentiality and security obligations we owe you. Prompt content may be cached on their systems for a short period, to make repeated requests faster and cheaper.
Not all of our processing involves an AI provider.
6. Google user data and Limited Use
Sukidoo's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
• we use Google user data only to provide and improve the features you have asked for;
• we do not transfer Google user data to third parties except as necessary to provide the Service, for security purposes, or to comply with applicable law;
• we do not use Google user data for advertising, and we do not sell it;
• we do not allow humans to read Google user data except with your explicit consent, to resolve a specific support issue you have raised, for security purposes, to comply with applicable law, or where the data has been aggregated and de-identified.
YouTube API Services
The Service uses YouTube API Services. By using the Service you agree to be bound by the YouTube Terms of Service, and Google's handling of the data it receives is described in the Google Privacy Policy.
We access only publicly available YouTube data, through a server-side API key. We do not request access to your YouTube account, and we neither read nor store YouTube account data belonging to you or to anyone else.
Revoking access
You can revoke Sukidoo's access to your Google account at any time — from within the Service by disconnecting the account, or from your Google Account permissions page. Revoking access stops all further analysis and all automated changes.
7. Legal bases for processing
We are established in Singapore, and our processing is governed by the Personal Data Protection Act 2012 (PDPA). We collect, use and disclose personal data with your consent, or where the PDPA permits us to do so without consent — including where processing is necessary to conclude or perform a contract with you, and where we rely on the legitimate interests exception for security, fraud prevention and the proper operation of the Service.
Where EU or UK data protection law also applies, we rely on the following legal bases:
• Performance of a contract — to create your account, provide the Service, process your subscription, and provide support;
• Legitimate interests — to secure, debug and improve the Service, to prevent fraud and abuse, to keep business records, and to send service-related communications. We balance these against your rights and interests;
• Consent — where you opt in to non-essential communications. You may withdraw consent at any time;
• Legal obligation — where we must retain or disclose information by law, for example for tax and accounting.
Where we act as a processor for Google Ads data, the legal basis for that processing is determined by you as controller, not by us.
8. Automated processing
The Service analyzes your advertising accounts automatically, and — where you have enabled automation — applies changes to your Google Ads account without a person reviewing each one. This automated processing operates on advertising data and does not produce legal or similarly significant effects concerning any individual. You choose whether to enable automation, you set the level of confidence required before anything is applied, and every automated change is recorded in the Service's history for you to review and reverse.
9. How we share information
We share personal information with the categories of service provider below. Each processes it only on our instructions, under a written contract, and for no purpose of its own.
• Hosting and infrastructure — running the application and its scheduled jobs — application traffic and request data
• Database and authentication — storing and securing your account and advertising data — stored account data, credentials and Google Ads data
• AI provider — analyzing advertising content — only the content described in section 5
• Google (Ads API, OAuth, YouTube Data API) — reading and updating the advertising accounts you connect — access tokens, account identifiers, queries and change requests
• Email delivery — sending transactional and lifecycle email — recipient email address, subject and message content
• Payments — processing your subscription; our payment provider acts as merchant of record, is identified to you at checkout, and is the party named on your card statement — checkout and subscription data
• Error monitoring — diagnosing faults and keeping the Service secure — diagnostic data, account identifier, session recordings
• Bot protection — protecting sign-in and sign-up forms from automated abuse — browser and challenge signals
A complete list of our subprocessors, naming each provider and the country in which it processes data, is available to customers on request at contact@sukidoo.com, and forms part of our Data Processing Addendum.
We may also disclose personal information:
• to professional advisers such as lawyers, accountants and auditors;
• to law enforcement, regulators or courts where required by law or to protect our rights, our users or the public;
• to a buyer, investor or successor entity in connection with a merger, acquisition, financing or sale of assets, subject to this policy continuing to apply.
We do not sell personal information, and we do not share it for advertising purposes. We have never done so, and none of the recipients above receives it for any purpose of its own.
10. International data transfers
We are established in Singapore. Our application and database infrastructure is hosted in the European Union, as is our email provider. Our AI, payments, error-monitoring and Google integrations may process data in the United States and other countries.
Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses with our providers. You can request details of the safeguards applied by writing to contact@sukidoo.com.
11. Security
We use technical and organizational measures designed to protect personal information, including:
• encryption in transit (TLS) and at rest;
• row-level security in our database, so that each workspace's data is isolated from every other workspace's;
• OAuth refresh tokens held encrypted and never exposed to the browser or to any client-side code;
• role-based access within your workspace, and restricted internal access on a need-to-know basis;
• CAPTCHA protection on authentication forms, and error monitoring to detect anomalies.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Data retention
We keep personal information only as long as necessary for the purposes described in this policy.
• Account, workspace and membership records — for the life of the account, and afterwards as needed for records, disputes and legal obligations
• Billing and payment records — as required by tax and accounting law
• Optimization suggestions and their history — 12 months from creation, then permanently deleted
• Optimization data of a disconnected account — the suggestions, analysis and settings we held for it, permanently deleted 10 days after the account is disconnected or access is lost
• Google OAuth credentials — deleted when you disconnect the account or when the member holding them is removed from the workspace
• Email send records — 12 months from sending, then permanently deleted
• Email suppression list (unsubscribes, bounces, complaints) — retained indefinitely, because we need it to keep honoring your opt-out
• Diagnostic logs and session recordings — for the retention period of our error-monitoring provider
Where we no longer need information, we delete it or aggregate it so that it no longer identifies anyone.
13. Your privacy rights
Under the Singapore PDPA, you have the right to request access to the personal data we hold about you and information about how it has been used or disclosed in the past year, and to request correction of anything inaccurate or incomplete. You may also withdraw consent for any purpose, on reasonable notice, though doing so may mean we can no longer provide the Service.
Depending on where you live, you may have further rights, including the right to:
• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of your information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• request portability of your information;
• opt out of marketing communications;
• opt out of the sale or sharing of personal information, where applicable.
To exercise any of these rights, contact us at contact@sukidoo.com. The Service does not currently provide a self-service account-deletion button — send us a request and we will action it, and we will confirm when it is done.
We will respond within the period required by applicable law. We may need to verify your identity before acting on a request. Where we act as a processor rather than a controller, we will refer your request to the relevant controller, or assist that controller in responding.
If you are in the EU or the UK, you also have the right to complain to your local data protection authority. If you are in Singapore, or are unsatisfied with how we have handled a request, you may raise the matter with the Personal Data Protection Commission.
Where a data protection law applies to us that is not named here, we will honor the rights it gives you.
14. Cookies and local storage
The Service uses cookies and browser storage that are strictly necessary to operate it:
• an authentication session, so that you stay signed in;
• a stored preference for your active workspace and your light or dark theme;
• security and bot-protection signals on authentication forms.
The Service does not use advertising cookies, and it carries no third-party advertising or marketing analytics trackers. The diagnostic and session-replay processing described in section 3 is carried out by our error-monitoring provider for the purpose of keeping the Service working and secure.
On the Website we also use cookies to remember your preferences, understand how visitors use the site, and measure how our marketing performs. Where the law requires it, we ask for your consent before placing any non-essential cookie, and you can change your choice at any time through our cookie banner or your browser settings.
The Website links to third-party sites we do not control. We are not responsible for their privacy practices, and we encourage you to read their own notices.
15. Marketing communications
Most email we send is transactional — sign-in links, invitations, billing notices and optimization recaps — and is part of providing the Service. You cannot opt out of essential transactional email while your account is active, though you can unsubscribe from recurring recap emails.
If you opt in to product updates or marketing email, you can unsubscribe at any time using the link in any such message, or by contacting contact@sukidoo.com.
16. Children's privacy
The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the "Last updated" date above. Where changes are material, we will notify you by email or in the Service before they take effect.
18. Contact us
If you have questions, requests or complaints regarding this Privacy Policy or our data practices, contact:
Neopsis Pte. Ltd.
2 Venture Drive, #19-18, Vision Exchange, Singapore 608526
contact@sukidoo.com