EH Nonprofit
Marketing Suite —
Privacy Policy
Last updated: 31 July 2026
This policy covers the EH Nonprofit Marketing Suite — the AI Ads Builder, GA4
Intelligence and EH Social Agent — operated by English & Hudson (“we”, “us”). It is
separate from the privacy policy for the
english-hudson.com website and our consulting services.
Throughout, “your organization” means the nonprofit or mission-driven organization that
uses the suite, and “you” means a member of its staff with an account.
1. Who we are and how to reach us
English & Hudson. Contact: rodney@english-hudson.com.
For questions specifically about data access or deletion, use the same address and put
“Data request” in the subject line.
2. Signing in — what Google and Microsoft tell us
You sign in with a Google or Microsoft account. We do not create or store passwords.
When you sign in with Google, Google sends us a signed identity token. We read exactly
two things from it:
- your email address, used to identify your account and match it to
your organization - your display name, used to show who approved a campaign or a post
We do not request or receive access to your Gmail, Drive, Calendar, Contacts, photos or
any other Google service. Sign-in requests only the basic identity permissions
(openid, email, profile).
After sign-in we set one cookie on your browser, which holds a signed session token and
expires after 30 days. It is HttpOnly, Secure, and same-site restricted. It exists to keep
you signed in and for nothing else. We do not use advertising or tracking cookies in the
suite, and we do not use third-party analytics inside the suite.
The suite is invite-only. Signing in with an address we have no account for grants us
nothing and creates no record beyond a refused-login event.
3. Google Ads data
How access works. Your organization’s Google Ads account is linked to
English & Hudson’s Google Ads manager account, the standard agency arrangement. The
suite reaches Google Ads through English & Hudson’s own API credentials under that
manager account. You do not connect a Google account to the suite for advertising,
and the suite never asks you to. Your organization grants the manager-account link
from within its own Google Ads account and can revoke it there at any time, independently
of us.
What we read. Campaign, ad group, ad, keyword and audience
configuration, and performance metrics — impressions, clicks, cost, conversions,
click-through rate, cost per action and similar figures — for accounts your organization
has linked.
What we write, and only on your instruction. The suite can create
campaigns and ad groups, write ad copy and assets, set and adjust bids and budgets, pause
and resume campaigns, and build remarketing audiences. Every one of these happens only when
a signed-in person reviews the specific proposed change and approves it. The suite does not
make autonomous changes to an advertising account and has no mode in which it does.
What we store. Campaign records your organization creates through the
suite, including UTM tags, campaign names, budgets, targeting settings and the approval
history of who changed what and when. Performance metrics are fetched from Google when a
page loads rather than warehoused, but campaign records and reports generated from them do
persist.
4. Google Analytics 4 data
If your organization uses GA4 Intelligence, someone with admin rights on your GA4
property adds our service account as a Viewer, from your own GA4 settings.
Viewer access is read-only: we can read reports, and we cannot change your analytics
configuration, create or delete properties, or alter your data.
We read aggregate reporting data — sessions, users, conversions, acquisition sources,
engagement rate, channel groupings, and conversion paths across campaigns. This is
aggregated reporting output, not individual visitor records.
Your organization can remove our service account’s access at any time from GA4 Admin →
Property Access Management, without involving us.
5. Google Search Console data
Where connected, we read search performance data — queries, impressions, clicks,
position — on a read-only basis, to inform keyword and content recommendations. We cannot
modify your Search Console property.
6. Meta and LinkedIn
Your organization connects its own Meta or LinkedIn ad account through that platform’s
standard authorization flow. Those access tokens are encrypted before they are
written to storage and are used only to serve the organization that granted them.
Disconnecting from within the suite deletes the stored token.
7. How we use AI, and what is sent where
The suite uses Anthropic’s Claude API to draft ad copy, social posts, campaign
recommendations and plain-language analytics summaries.
What we send to Anthropic: the campaign brief or question at hand, your organization’s
brand voice and audience settings, and the relevant performance figures needed to produce a
useful answer. What we do not send: your sign-in credentials, session tokens, or any
platform access tokens.
Data sent to the Claude API is not used to train models. Anthropic acts as our
processor and does not use this content for its own purposes.
8. Email
The suite sends performance digests and campaign alerts to addresses your organization
nominates. These are operational messages about your own accounts, not marketing. Tell us
to stop and we will.
9. Where data is stored, and who can reach it
Data is held in Google Cloud Platform in the United States — Cloud Storage for
organization records and Cloud Run for the applications. Access is restricted to English
& Hudson personnel who need it to operate and support the suite.
Each organization’s records are stored under a separate organization identifier and the
applications resolve which organization a request belongs to before reading or writing
anything. Platform access tokens are encrypted at rest.
10. What we do not do
- We do not sell your data, or Google user data, to anyone.
- We do not transfer it to third parties for advertising, marketing,
data brokerage, credit assessment or resale. - We do not use it to train, retrain or fine-tune machine learning
models, ours or anyone else’s. - We do not let humans read your data except where you have asked us
for support, where we need to investigate a fault or abuse, where security requires it, or
where law compels it. - We do not combine your data with data from other organizations to
build profiles or benchmarks that identify anyone. - We do not use one organization’s data to serve another.
Google API Services User Data Policy
Our use of information received from Google APIs adheres to the
Google API
Services User Data Policy, including the Limited Use requirements. We limit our use of
Google user data to providing and improving the features described on this page and in our
suite overview, and to the practices this
policy discloses.
11. Sub-processors
- Google Cloud Platform — hosting and storage
- Anthropic — AI text generation, as described in section 7
We will update this list before adding a sub-processor that handles your data.
12. How long we keep things
- Account records (email, display name) — while the account is active,
then deleted within 30 days of a deletion request or of your organization leaving. - Campaign records and approval history — retained while your
organization uses the suite, since they are the record of what was changed on your
advertising accounts. Deleted within 30 days of a deletion request, except where we must
keep a record to meet an advertising platform’s own requirements. - Platform access tokens — deleted immediately on disconnect.
- Google Ads and GA4 performance data — fetched on demand and not
retained as a separate copy, beyond figures embedded in reports your organization has
generated.
13. Your choices, and how to disconnect
You or your organization can, at any time:
- Revoke the Google Ads manager link — from your own Google Ads account.
We lose access immediately. - Remove GA4 access — delete our service account from your property’s
access list in GA4 Admin. - Disconnect Meta or LinkedIn — from Settings in the AI Ads Builder.
The stored token is deleted. - Revoke sign-in — at
myaccount.google.com/permissions. - Ask for a copy, correction, or deletion of your data — email
rodney@english-hudson.com. We respond
within 30 days.
Deleting your suite account does not delete anything inside your own Google Ads, GA4,
Meta or LinkedIn accounts. Those stay yours, along with any campaigns created through the
suite.
14. Security
Transport is encrypted (HTTPS). Platform access tokens are encrypted at rest with keys
held separately from the data. Session cookies are signed, HttpOnly and Secure. Access to
production systems is limited to personnel who need it. No system is perfect, and we do not
claim otherwise; if we discover a breach affecting your data we will tell you promptly.
15. Children
The suite is a workplace tool for staff at partner organizations and is not directed to
anyone under 18. We do not knowingly collect data from children.
16. International users
Data is processed in the United States. If your organization or its staff are in the
European Economic Area or the United Kingdom, contact us and we will put an
appropriate transfer mechanism in place before onboarding.
17. Changes
If we change how the suite handles Google user data, we will update this page and change
the date at the top before the new practice takes effect. Material changes will be emailed
to account holders.
English & Hudson · english-hudson.com ·
rodney@english-hudson.com