Privacy Policy

Last updated: October 13, 2026

This policy explains how RoyScout (“RoyScout”, “Roy”, “we”, “us”) handles personal data when you visit www.royscout.com or use the RoyScout app.

Who we are

RoyScout is operated by QuantumSpring.ai s.r.o., Pod hřbitovem 1155/16, Ruzyně, 161 00 Praha 6, Czech Republic, company ID (IČO) 23421380, registered in the Commercial Register kept by the Municipal Court in Prague, file C 426813. We are the controller of the personal data described here.

Contact for anything privacy-related: privacy@quantumspring.ai.

What RoyScout does

RoyScout is a PPC management assistant. After you connect your advertising and analytics accounts, Roy monitors your campaigns, investigates changes, finds opportunities and recommends optimizations. Roy makes changes to your accounts only when you ask for them or approve them.

Data we collect

Website visitors. If you join the waitlist, your email address (stored with our email provider, Loops). Google Tag Manager and Google Analytics collect usage data on the website.

Account data. Your name, email address, password (stored hashed), and the business details you give Roy, such as your website and goals.

Conversations. The messages you exchange with Roy and the analyses and recommendations Roy produces.

Data from accounts you connect. Only when you connect them, and only what the permissions you grant allow:

• Meta (Facebook and Instagram) via Facebook Login for Business. Your business portfolio and the ad accounts, Pages and catalogs you choose to share: campaigns, ad sets, ads, creatives, audiences, budgets, performance insights, Page details and catalog products. Permissions: ads_read, ads_management, business_management, pages_show_list, pages_read_engagement, pages_manage_ads, catalog_management.
• Google Ads. The accounts you can access, and their campaigns, ad groups, ads, keywords, budgets, conversions and performance reports. Scope: https://www.googleapis.com/auth/adwords.
• Google Analytics 4. Your properties and their configuration, and report data such as sessions, traffic sources and conversions. Scopes: analytics.readonly and analytics.edit.
• Access tokens that let RoyScout call these services on your behalf. They are encrypted at rest.

How we use data

• To provide RoyScout: analyze your campaigns and analytics, answer your questions, and prepare recommendations.
• To make changes you ask for or approve, such as creating or editing campaigns, ads, budgets, catalog products or Google Analytics settings. Roy does not change your accounts on its own.
• To run the service: authentication, security, troubleshooting, and service emails such as password resets.
• To tell waitlist subscribers about the launch.

We do not sell personal data, and we do not use data from your connected accounts for advertising, to build user profiles for others, or to train generalized AI models.

AI processing

Roy uses a large language model to understand your questions and analyze your data. To answer you, the relevant parts of your conversation and of the data from your connected accounts are sent to our AI model provider, Anthropic, PBC, which processes them on our behalf under its commercial terms. Anthropic does not use this data to train its models. Your data is used only to produce your own analyses and recommendations.

Google user data

RoyScout’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data from Google Ads and Google Analytics is used only to provide and improve the RoyScout features you use. It is not transferred to anyone except as needed to provide those features (for example, to our hosting and AI model providers), to comply with law, or as part of a merger or acquisition. It is not used for advertising, and no person at RoyScout reads it unless you ask us to (for example, for support), it is needed for security or to comply with law, or it is aggregated and anonymized.

Legal basis (GDPR)

• Performance of a contract (Art. 6(1)(b)): providing RoyScout to you, including processing data from the accounts you connect.
• Legitimate interests (Art. 6(1)(f)): security, preventing abuse and improving the service.
• Consent (Art. 6(1)(a)): the waitlist and website analytics. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): where the law requires us to keep records.

Who we share data with

We use these service providers (processors) to run RoyScout, under data processing agreements:

• Railway (Railway Corporation, USA): hosting and database.
• Anthropic (Anthropic, PBC, USA): AI model processing.
• Resend (USA): service emails.
• Tavily (USA): web searches Roy runs about your business’s public website and market.
• Loops (USA): waitlist emails.
• Google (Google Ireland Limited): website analytics and tag management.

Meta and Google receive the requests RoyScout makes to their APIs on your behalf, under their own terms and privacy policies. We may disclose data if the law requires it.

International transfers

Some providers process data in the United States. These transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

How long we keep data

• Connected-account data and tokens: while the connection is active. When you disconnect an account in RoyScout, we delete its tokens immediately and the data fetched from it within 30 days.
• Account data and conversations: while your account exists. We delete them within 30 days after you ask us to delete your account.
• Waitlist emails: until you unsubscribe or the waitlist ends.
• Backups and logs: up to 30 days, then overwritten.
• Records the law requires us to keep, such as invoices: for the period the law sets.

Security

Data is encrypted in transit (TLS). Access tokens for connected accounts are encrypted at rest. Access to production systems is limited to the staff who need it.

Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To exercise any of these rights, email privacy@quantumspring.ai. We answer within one month.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or with the supervisory authority in your country.

Disconnecting accounts and deleting your data

• In RoyScout: disconnect Meta, Google Ads or Google Analytics in your business’s connection settings.
• At Google: remove RoyScout at myaccount.google.com/permissions.
• At Meta: remove RoyScout in Facebook Settings → Business Integrations, or in Meta Business Settings → Integrations.
• To delete all your data: follow the steps on our Data Deletion page.

Children

RoyScout is a business tool and is not intended for anyone under 16.

Changes

We will post any changes on this page and update the date above. If a change is significant, we will also tell account holders by email.