Modular Casebook Privacy Policy

Overview

Modular Casebook (the “Application”) is an internal application operated by WBI Consulting Group, a Nevada S Corporation with its principal place of business in Oviedo, Florida, USA. It has two components. The advertising operations component is used by WBI's own authorized personnel to manage and report on the Google Ads accounts of WBI's clients under a signed services agreement. The content-planning component is used by authorized WBI personnel, and by named staff of client organizations WBI is engaged with, to organize client content stored in Google Drive.

The Application is not distributed, licensed, resold, or offered to the public. There is no public sign-up: sign-in is limited to authorized WBI personnel and to named client staff using a Google account on an approved organizational domain. This policy explains what information the Application accesses, how it is used, and the choices available to the users and account owners whose data it touches.

Information we collect

User account information

When an authorized user signs in with Google, the Application receives basic profile information from that Google Account: name, email address, and profile picture. This is used solely to identify the user, confirm authorization, assign the user's role, and attribute entries in the audit log.

Google API data

With the user's explicit consent, the Application requests access to the following Google services in order to perform its core functions:

• Google Ads API (adwords scope): read access to campaign, ad group, keyword, and search-term performance metrics (spend, impressions, clicks, conversions), and write access to create or adjust campaigns, budgets, and negative keywords. Access is limited to client accounts linked to the WBI manager (MCC) account with the client's approval.
• Google Analytics (read access): session and conversion event data for the client properties WBI is engaged to measure, joined to ad performance for outcome measurement and tracking diagnostics.
• Google Drive (drive.file scope) and Google Docs (documents scope): used by the Application's content-planning component to create and edit the files and documents that hold client content. Access is limited to the specific files and folders the Application creates, or that a user explicitly opens through it. The Application cannot see or access any other files in the user's Google Drive.

Content-planning data

The content-planning component stores the application data users create in it, such as projects, content sections, comments, and priority votes.

Credentials

The Application stores the OAuth tokens (access and refresh tokens) needed to maintain each user's connection to Google. For the advertising operations component, these are held together with the Google Ads developer token in a restricted local user directory. For the content-planning component, they are held in the Application's access-controlled database. Credentials are not sold or shared with any third party other than the infrastructure providers listed below, and are not committed to source control.

How we use this information

• Authenticate users and confirm they are authorized to use the Application.
• Retrieve advertising and analytics performance data for the client accounts WBI is engaged to manage.
• Create and adjust campaigns, budgets, and negative keywords in those accounts, subject to human approval and configured safety limits.
• Produce advertising performance reports that are reviewed by WBI staff and delivered to the client the data belongs to.
• Create, read, and update the content-planning files users work with in Google Drive and Google Docs.
• Enable content-planning collaboration features such as comments, priority voting, and version tracking.
• Maintain an audit log of every operation, including dry-runs, for accountability.
• Maintain, secure, and improve the Application.

No automated decisions are applied to a client account without human review.

Limited Use disclosure

The Application's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google APIs is used only to provide and improve the Application's user-facing features. We do not transfer or sell this data to third parties, do not use it for advertising, do not use it to build or enrich any commercial dataset, and do not allow humans to read it except where required for security, compliance, or to provide support at the account owner's request, or as required by law.

Client segregation

Data is stored and processed per client. Performance data from one client account is never surfaced to, benchmarked against, or used to optimize another client's campaigns, and is never aggregated into any cross-client or commercial dataset.

Data sharing

We do not sell personal information. Retrieved data is shared only with the client it belongs to, in the form of the reports and content the Application produces, and with Google in order to perform the actions the user requests. Where the Application relies on infrastructure providers to host reporting or supporting services — Vercel (application hosting) and Neon (database hosting) — those providers process data on our behalf under their own security and privacy commitments.

Scope minimization

The Application requests only the scopes required to perform the functions described above. It does not request access to Gmail, contacts, calendars, or any Google service outside those listed, and it does not scrape or collect competitor data.

Data retention and deletion

Reporting extracts are retained only as long as the client engagement requires. They are deleted on client request, or at the end of the engagement, along with the removal of the manager-account link. Content-planning account information and application data are retained for as long as the user's account is active or the client engagement requires, and are deleted on request.

A user may revoke the Application's access to their Google Account at any time via their Google Account permissions page. A client may remove WBI's manager-account link from within their own Google Ads account at any time, which immediately ends the Application's access to that account. To request deletion of data held about your account, contact us at the address below.

Security

Advertising operations credentials are stored in a restricted local directory with filesystem permissions limited to the operator. Content-planning tokens and application data are stored in access-controlled storage and transmitted over encrypted connections (HTTPS). Access to the Application is limited to named WBI personnel who are under contract and bound by confidentiality terms, and to named client staff signing in with an approved organizational Google account.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.

Contact

Questions about this policy or requests regarding your data can be sent to bbell@wbicg.com.