Last updated: 23 September 2026
This policy explains how Borealis Data Lab (“we”) handles personal data on borealisdatalab.com and in the Borealis application, in line with Brazil’s General Data Protection Law (LGPD, Law 13.709/2018).
Who we are
Borealis Data Lab is a brand of Borealis Data Intelligence LTDA (CNPJ 61.200.460/0001-58), a company registered in Brazil, which is responsible for the personal data described here. For any question or request about your data, including requests to our data protection contact, write to contact@borealisdatalab.com.
Information you give us on the website
When you request early access, we collect your name and email address, together with the date and time you gave consent and the page you were on.
- Purpose: to contact you about early access to Borealis and send you information about the product.
- Advertising measurement: if you accepted marketing cookies, your name and email — the email also in hashed (SHA-256) form — may be sent to Google Ads and Meta so they can match your request to the ad that led to it (Google “enhanced conversions” and Meta “advanced matching”). Without marketing consent this does not happen.
- Legal basis: your consent (LGPD, art. 7, I), which you can withdraw at any time.
- Retention: until you ask us to delete it, or 24 months after our last contact with you, whichever comes first.
Cookies and similar technologies
When you first visit, we ask which categories you accept. Until you accept, analytics and marketing tools do not set cookies on your device. You can change your choice at any time using Cookie settings at the bottom of every page.
- Necessary — always active. A cookie that stores your consent choice (
borealis_consent, 6 months). Without it we could not remember your decision. - Analytics — only with your consent. Google Analytics (Google LLC) measures visits and traffic sources. Microsoft Clarity (Microsoft Corporation) shows how pages are used — clicks, scrolling and navigation — so we can improve the site.
- Marketing — only with your consent. Google Ads (Google LLC) and the Meta Pixel (Meta Platforms, Inc.) measure the results of our advertising and help show relevant ads.
We use Google Consent Mode to pass your choice to Google’s tools, and the equivalent consent controls for Microsoft Clarity and Meta.
Your Borealis account
To use the application you create an account with your email address and a password. The password is stored only as a secure hash by our authentication provider; we cannot read it. Each account belongs to an organization, which holds its Google Ads connection and the ad account being monitored.
- Purpose: to sign you in and provide the monitoring service.
- Legal basis: performance of the contract you enter into by using the service (LGPD, art. 7, V).
- Retention: while your account exists. When you ask us to delete it, your account, organization, stored credential and monitored-account details are deleted.
The Borealis application and Google user data
Borealis Data Lab is a monitoring tool for paid advertising accounts. With your authorization, it reads performance data from your advertising accounts, analyses it for meaningful changes, and shows you what needs attention.
When you connect a Google Ads account, we access only aggregated advertising performance data through the Google Ads API:
- Account name, currency and reporting timezone
- Campaign and ad group names and identifiers
- Daily aggregated metrics: cost, impressions, clicks, conversions and conversion value
We do not access, request or receive personal data about the people who saw or clicked your ads. We do not access your Google account contents, contacts, email or files. The only OAuth scope requested is https://www.googleapis.com/auth/adwords.
That scope is the only one the Google Ads API offers, and it technically covers every operation, including changes — which is why Google’s consent screen lists editing permissions. Borealis Data Lab makes read requests only and never uses the scope to modify an account.
Advertising data is used solely to produce the analysis shown to you in the application: comparing current performance against the account’s own history, identifying significant changes, and explaining their likely cause. We never create, modify, pause or delete anything in your Google Ads account. We do not sell this data, do not share it with third parties, do not use it for advertising, and do not use it to train machine learning or generalised artificial intelligence models.
Advertising data is fetched from the Google Ads API when you use the application and analysed in memory. To keep the application fast it may be held in server memory for up to 10 minutes; it is never written to a database. When you connect Google Ads, Google issues an access credential (a refresh token). We store it in our database encrypted with AES-256, with a key kept separately from the database; it is never exposed to the browser, is sent only to Google, and is deleted when you disconnect Google Ads in the application, which also revokes it at Google. We also store the name, ID, currency and time zone of the ad account you choose to monitor. You can revoke access at any time at myaccount.google.com/permissions, which immediately and permanently ends our ability to read your data.
Borealis Data Lab’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sharing and international transfers
We do not sell personal data. We rely on service providers to run the website and the tools above: our website hosting provider (Hostinger), the application’s hosting provider (Vercel), our database and authentication provider (Supabase, with data stored in São Paulo, Brazil), Google, Microsoft and Meta. Some of them process data outside Brazil; these transfers follow the conditions of LGPD, art. 33.
Your rights
Under the LGPD (art. 18) you can ask us to confirm whether we process your data; access, correct or update it; anonymise, block or delete it; receive it in a portable format; know with whom it has been shared; and withdraw your consent. Write to contact@borealisdatalab.com and we will reply within 15 days. You may also file a complaint with Brazil’s National Data Protection Authority (ANPD).
Changes to this policy
If the way we handle data changes, this page is updated and the date at the top changes with it.