How we protect your account access, your data, and the systems that touch them.
Blync connects to your Google Ads account to run diagnostics and apply approved changes. That means the security of your connection — and of the data we derive from it — is the most important thing we do. This page describes how that protection works, what we keep, and what controls you have over it.
We connect to Google Ads exclusively through Google's OAuth 2.0 flow. You sign in with Google and authorize Blync to access the specific scopes we request — we never see, request, or store your Google password.
We request the following Google scopes:
https://www.googleapis.com/auth/adwords — read account structure, metrics, and conversion data, and (only on user confirmation) apply mutations.https://www.googleapis.com/auth/content — required to discover and read Google Merchant Center accounts when you opt into Merchant Center support.email — used to identify which Google account authorized the connection (so you can manage multiple connected identities).We do not request access to Gmail, Drive, Calendar, Contacts, or any other Google product.
We store the smallest amount of Google Ads data needed to deliver the service. Specifically:
We do not store raw ad creative, campaign mutations performed outside Blync, billing details from Google Ads, or any data unrelated to the authorized scopes above.
The Blync service runs entirely on Google Cloud Platform in the United States.
When more than one person on your team needs access to a single Google Ads account, Blync supports three roles:
Role changes are restricted to Owners. Mutation actions (“Apply Fix”, chat-driven changes) check the caller's role at execution time, not just at proposal time.
You can delete your Blync account and every record we hold about you at any time, from Workspace Settings → Danger zone → Delete my account. The deletion is immediate and irreversible: it cascades through every table that references your user, cancels any active Stripe subscription, and removes the OAuth tokens that let us reach Google on your behalf. Logs from before the deletion are retained for up to 30 days for security incident review, then purged.
You can also revoke our Google Ads access independently of deleting your Blync account via myaccount.google.com/permissions. When you do that, our scans for that account will start failing and you'll see a re-connect prompt on the dashboard.
For California (CCPA), Virginia (VCDPA), and similar state privacy requests, contact us at the address below and we will process the request within the timeline required by the applicable law.
We are not currently SOC 2 attested. We have adopted the controls a Type I audit will measure against — least-privilege IAM, encrypted backups, audit logging on mutation paths, vendor management, and a written incident-response runbook — in advance of beginning a formal audit. If you need a vendor security questionnaire completed ahead of a procurement decision, email security@blyncdigital.com and we will respond within five business days.
If you believe you have found a security issue affecting Blync, please email security@blyncdigital.com with reproduction steps and any supporting evidence. We will acknowledge receipt within two business days and keep you informed of remediation progress. We do not currently run a paid bug-bounty program, but we will recognize researchers who report valid issues responsibly.