Flightstory AI - the Paid Search Team is an internal tool built and operated by Flight Story Limited. It is not a product, it is not sold or licensed, and there is no public sign-up. It is used by authorised Flight Story personnel to plan, build, audit and manage Google Ads campaigns in advertising accounts that the account owner has expressly authorised Flight Story to manage.
This policy explains what data the tool accesses, why, on what lawful basis, who it is shared with, how long it is kept, and the rights available to individuals under the UK GDPR. It also sets out, expressly, how the tool complies with the Google API Services User Data Policy, including the Limited Use requirements.
Last updated: 12 September 2026.
Flight Story Limited ("Flight Story", "we", "us") is a company registered in England and Wales, company number 13441974, with its registered office at 73 Cornhill, London, EC3V 3QQ. Flight Story operates a marketing agency arm under the name Momentum.
Flightstory AI - the Paid Search Team (the "Tool") is software built and operated by Flight Story for its own internal use and the use of a small number of named client and partner individuals who have been granted written access.
Questions about this policy, or any request to exercise data protection rights, can be sent to it.services@flightstory.com, or by post to the registered office above marked for the attention of the Head of IT. Our website is flightstory.com.
Flight Story has not appointed a Data Protection Officer, as it does not meet the criteria in Article 37 of the UK GDPR that would require one. The contact point above is responsible for data protection queries, and data protection is owned at director level.
This policy covers:
This policy does not cover the wider Flight Story or Momentum websites, or Flight Story's services generally, which are covered by the privacy information published at flightstory.com.
The Tool is an internal multi-agent system. It plans, builds, audits and manages paid search campaigns in Google Ads accounts that Flight Story has been authorised to manage. Typical work includes keyword and search term analysis, competitive review, campaign and ad group structure, writing responsive search ads, building campaigns, auditing account settings, and reporting on performance.
The Tool connects to Google Ads using OAuth 2.0, with API credentials issued to Flight Story. It can only reach Google Ads accounts where the account owner has granted Flight Story access, and only for as long as that access is in place.
The clients whose accounts are managed in this way are typically small companies with monthly advertising budgets between £1,000 and £30,000.
The Tool does not act autonomously on live spend. Every campaign it creates is created in a paused state. Setting a campaign live, and any change to conversion actions, bidding strategies or budgets, and any deletion, requires a decision and action by a person.
Through the Google Ads API, and from information clients give us, the Tool accesses:
The Tool does not process individual end-customer identifiers. It does not access, upload, build or use customer lists or Customer Match audiences. It does not receive individual-level conversion records, and it does not attempt to identify the individual people who saw or clicked an advertisement. Conversion information reaches the Tool only in aggregate form.
This section is the disclosure Google requires of applications that access Google user data.
Flightstory AI - the Paid Search Team's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice this means:
We do not use data received from Google APIs, and we do not permit any third party to use it, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.
The Tool uses third-party AI models in order to operate. Those models are used to generate and evaluate campaign work for the account the authorised user is working on at that moment. Data sent to those providers is sent under contractual terms that prohibit its use for training or improving their models. Flight Story does not train, fine-tune or otherwise build any model of its own on data received from Google APIs.
The Tool keeps a record of the decisions it has made and the outcomes that followed, so that its future recommendations for the same account and for similar work are better informed. What is stored is aggregate performance patterns and decision records: for example, that a particular campaign structure or match type approach produced a given cost per conversion. These records do not contain personal data, and they are not used to train generalised machine learning models.
The great majority of the data the Tool handles is commercial account data rather than personal data. The personal data involved is as follows.
We do not knowingly process special category data under Article 9, and the Tool is not designed to handle it. We do not knowingly process the personal data of children.
Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that the processing is limited, expected in a business-to-business advertising context, and not overriding of the interests or fundamental rights of the individuals concerned. A copy of that assessment is available on request.
The split is as follows.
Where Flight Story acts as a processor, the third-party providers listed below act as our sub-processors, engaged under written terms that impose equivalent data protection obligations.
We share data only where it is necessary. The categories of recipient are:
We do not sell personal data, and we do not share it with anyone for their own marketing purposes.
The Tool runs on Flight Story-controlled systems. Some of the third-party providers named above process data outside the United Kingdom, including in the United States.
Where personal data is transferred outside the UK, we rely on one or more of the following safeguards under Chapter V of the UK GDPR: transfer to a country covered by UK adequacy regulations; the International Data Transfer Agreement issued by the Information Commissioner; or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by a transfer risk assessment. A copy of the relevant safeguard is available on request from the contact point in section 1.
The specific locations of processing for each provider are: Anthropic, OpenAI and Google model APIs process data in the United States; Cloudflare serves and processes data across its global edge network; Google Workspace processes data in Google's global infrastructure. Transfers outside the UK are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. .
When an advertising account owner withdraws Flight Story's access, the Tool can no longer reach that account. Data already held in working copies is deleted in line with the periods above, or sooner on request, unless we are required to keep it.
OAuth access and refresh tokens are revoked and deleted when access is withdrawn, when an authorised user's access ends, or when they are no longer needed.
Access to the Tool is restricted to named individuals. Authentication is by OAuth 2.0 against Google, using credentials issued to Flight Story, and credentials are held on Flight Story-controlled systems. Actions taken in the Tool are logged. Access is reviewed and is removed when a person leaves or their role changes. The human approval steps described in section 3 are themselves a control: the Tool cannot put spend live or change budgets, bidding or conversion tracking without a person doing so.
We take appropriate technical and organisational measures under Article 32 UK GDPR. Further detail on our security measures is available to clients on request.
The Tool generates recommendations and draft campaign work automatically. It does not make decisions producing legal effects concerning any individual, or similarly significantly affecting any individual, within the meaning of Article 22 UK GDPR. Decisions that commit money or change what runs are taken by a person.
Individuals whose personal data we process as controller have the following rights under the UK GDPR:
Requests can be made to the contact point in section 1. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you and explain why. There is no charge unless the request is manifestly unfounded or excessive.
Where Flight Story acts as processor for a client, we will pass the request to that client, who is the controller, and assist them in responding.
Providing personal data is not a statutory requirement. For an individual to be granted access to the Tool, providing their name, work email address and Google account identifier is a necessary condition of that access being granted; without it, access cannot be given.
An individual can withdraw the Tool's access to their Google account at any time through their Google Account security settings, at myaccount.google.com/permissions. A Google Ads account owner can withdraw Flight Story's access to their advertising account at any time from within Google Ads.
If you are unhappy with how we have handled your personal data, please raise it with us first using the contact point in section 1. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. The ICO can be reached at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or at ico.org.uk/make-a-complaint.
[COOKIES AND ANALYTICS ON THIS SITE - STATE WHETHER THIS PAGE SETS ANY COOKIES OR USES ANALYTICS, AND IF SO, WHICH, AND HOW CONSENT IS OBTAINED. IF THE PAGE SETS NO COOKIES AND USES NO ANALYTICS, SAY SO PLAINLY.]
The Tool itself has no public interface and no end-user accounts.
We review this policy when the Tool changes and at least annually. The date of the current version is shown at the top. Material changes will be notified to authorised users and to affected clients directly.
Flight Story Limited, 73 Cornhill, London, EC3V 3QQ. Email it.services@flightstory.com. Website flightstory.com.