Privacy policy

What we collect

• Your account: email address and name, and a password hash if you signed up with one. Sign-in, sessions and password resets are handled by Clerk.
• Your organisation: its name, who belongs to it, and the invitations you sent. An invitation link is kept only as a hash and cannot be recovered from it.
• Your advertising connections: the access tokens Adjust, Amazon Ads, Apple Ads, LinkedIn Ads, Reddit Ads, Microsoft Advertising, Snapchat Ads, X Ads, RTB House, Meta Ads, Pinterest Ads, Google Ads, TikTok Ads, Search Console and Google Analytics 4 issue when you connect them, encrypted, together with the identifiers of the accounts you ticked as reachable. For RTB House, you can connect with your email and password instead; these credentials are also stored encrypted and deleted when you disconnect.
• Your alerts: rule settings, selected entity identifiers, observations, incident evidence and notification history for the monitoring you request.
• Your usage: a count of tool calls per month, which is what applies your plan's limit. It holds a count, never a query.
• What you save: a saved view, a brief on a client, a review. These exist only because you asked for them. Reviews hold report snapshots. How long each one lives is further down.
• Your ChatGPT plugin preferences: default client, reporting period, KPI focus and comparison.
• Campaign names for mentions: names, identifiers and statuses of the campaigns read for your organisation, so ChatGPT can suggest them when you type @. No figures.
• Automations: when you ask ChatGPT to act on an alert, a campaign launch or a Sheets export, the subscription its connection creates (the callback address, an encrypted signing secret, what it follows) and the events waiting to be sent to it. Each event carries the alert, launch or export it is about, with the figures the alert observed.
• Client memory and journal, on Team and Enterprise: what your team recorded about a client, with who wrote it; the changes made through Get MCP Ads with their reason; notes; and the changes made directly in Meta and Google, archived every day.
• Data API: requested queries, hashed API keys, access grants, encrypted Google destination tokens, schedules, usage, job history and audit records. Important changes include the actor, workspace, account and available before/after state. Audit history is kept for 7 days on Free and Pro, 30 days on Team and 365 days on Enterprise. Extraction results are stored temporarily for one to seven days. Deliveries send the results to the Google destination you choose.

What we never do

• We do not sell or rent your data. Optional Reddit and X advertising measurement runs only with your separate consent. We never send the contents of connected advertising accounts to Reddit or X for this purpose.
• Unsaved interactive MCP answers pass from the platform to your assistant without persistent report storage. Saved reviews and requested Data API extractions follow their separate retention rules below.
• We do not save reports on your behalf. A view, a brief or a review exists only because you asked for it, and deleting it deletes it. The other records on this page are kept only while the feature that needs them is in use, for the periods given below.
• Alerts do not change your campaigns. An assistant does so only when you asked it to act on an alert, within what you asked, through the same tools as in a conversation. Pausing the alert, asking the assistant to stop, or disconnecting it ends the automation.
• We never hand your advertising tokens to the assistant. It calls this gateway, and the gateway calls the platform. No tool returns a token and none is written to a log.

How your tokens are protected

Advertising access tokens are encrypted with AES-256-GCM before they are written to the database. The encryption key is not stored alongside them, so a copy of the database on its own gives no access to your advertising accounts.

Disconnecting a platform deletes the row rather than marking it revoked, and you can withdraw the access separately from that platform's own security settings at any time.

Data that leaves the European Union

7 of the 9 service providers and advertising partners below work outside the European Union, in the United States: Reddit, X Ads, Vercel, Neon, Cloudflare, Clerk and Stripe. In practice that means the database is hosted in Virginia, the functions that render this site and the dashboard run in Virginia, and your sign-in is handled from the United States.

The rest is served closer. Requests reach the site through an edge location in Paris, the MCP gateway answers from the Cloudflare location nearest to you and requests from Europe are served in Europe, and transactional email is sent from Ireland.

This is a transfer of personal data outside the European Union, and it is written here because a list of processor names on its own lets you assume everything stays in Europe. Each provider's own privacy policy is linked from the table.

How long we keep it

Alerts retain rule configuration, observations and incident history to provide the monitoring you request. Unsaved interactive MCP answers are not retained as reports. Saved reviews keep their snapshots until deleted. Requested Data API extractions temporarily store results for one to seven days; delivered files follow the retention settings of your destination.

Performance alerts

Rule configuration, selected entity identifiers, latest observations, incident evidence and delivery history remain with the organisation. Pausing or archiving stops monitoring but preserves history. Unreferenced technical runs are removed after 30 days; runs referenced by incidents are retained. Organisation deletion removes its alerts and related records. Contact us for other deletion requests.

Reddit and X advertising measurement

Matching identifiers are held until consent expires (at most six months) or is withdrawn. Click IDs are used for 28 days. Pending conversions retry for at most 47 hours. Delivery records are kept for 30 days. Withdrawal stops future collection and pending delivery; data already received by Reddit or X follows the respective provider’s policy and deletion process. Contact us to request deletion there.

Your account and organisation

For as long as the account exists. Deleting the account removes them, and an organisation left with nobody in it is removed with it.

Advertising access tokens

Until you disconnect the platform, or the platform revokes them. Disconnecting deletes the row rather than marking it revoked.

Private service administration

We retain first-party operational request metadata (user and organisation identifiers, client type, tool name, platform, outcome and duration) for up to thirteen months to operate the service. We do not store prompts, arguments or response contents in these records. Our restricted owner dashboard also stores daily account-level advertising spend, currency and collection status for currently connected, explicitly selected accounts; disconnected account records are removed by the next daily cleanup when no active connection grants access. Historical aggregate organisation and plan counts do not identify individual users. These administration records are not sent to advertising networks or PostHog.

Unsaved interactive MCP answers

Never stored as report results. These answers are read from the platform on demand and passed straight to your assistant. Saved reviews and Data API extractions have the separate retention rules below.

Data API extractions and Google destinations

Requested extractions temporarily store report rows in private Cloudflare R2 objects for one to seven days, depending on the plan, then deny access and queue physical deletion. Query definitions, destination settings and job history remain with the organisation. Usage and audit records are retained for up to thirteen months. Google destination tokens are encrypted until disconnected. API keys are stored only as hashes. Files delivered to a customer's Google Sheet, BigQuery dataset or Cloud Storage bucket follow that customer's retention settings.

Advertising data you deliberately save

Kept until you delete it. Three things can be saved, and only the third holds figures. A saved view keeps your settings: which account, which dates, which metrics, and no results. A brief keeps your own notes about a client. A review keeps a frozen snapshot of a report, and that one does hold ad names, identifiers and their figures, because a review whose numbers changed after the fact would be worthless. These three are saved only when you ask for them.

ChatGPT plugin preferences

Your default client, reporting period, KPI focus and comparison, kept for you in each organisation until you change them. They are deleted when you leave the organisation or are removed from it, when your account is deleted, and with the organisation.

Campaign names for mentions

The names, identifiers and statuses of the campaigns Get MCP Ads read for your organisation, so ChatGPT can suggest them when you type @. No figures. A name not seen again for 90 days is deleted, and all of them are deleted with the organisation.

Automations and their deliveries

When you ask ChatGPT to act on an alert, a campaign launch or a Sheets export, its connection subscribes to those events: the subscription keeps the callback address ChatGPT gave, an encrypted signing secret and the alert, launch or export it follows, and the events waiting to be sent. Events are sent only to that callback address, which belongs to the assistant connection that asked for them (for ChatGPT, OpenAI), and only while that connection still has access. A subscription lasts at most seven days unless the assistant renews it. Stopping it, its expiry, disconnecting the assistant, losing access to the account, leaving the organisation or deleting it removes the subscription, its secrets and its pending events at once, and nothing already queued is sent afterwards. Sent or abandoned deliveries are kept for seven days, the proof that a callback address belongs to the connection for seven days, and a replaced signing secret for ten minutes.

Client memory and journal

On Team and Enterprise. The client sheet holds what someone in your organisation, or their assistant at their request, recorded about a client: objectives, rules, context and lessons, each line with the name of the person who wrote it. It is kept until someone deletes its lines. The journal records the changes made through Get MCP Ads with the reason given, the events your team noted, and the changes made directly in Meta and Google, archived every day. Changes and archived history are deleted after 400 days; notes stay until deleted. Everything goes with the client workspace or the organisation.

A review you chose to share

A shared review is readable at a secret address, without signing in, until it expires. Seven days by default, thirty at most. It carries the ad names and the figures of that review, never the account, your private notes or the media files. The link is stored only as a hash: revoking it, or deleting the review, closes the page immediately.

Invoices

Held by Stripe for as long as accounting rules require, and they outlive the account. A closed account still needs its receipts.

Usage counters

Thirteen months, so a year-on-year comparison is possible. They hold a count, not a query.

Invitations

Kept as a record of who was invited and when. The link itself is stored only as a hash and is never recoverable.

Your rights

BENLY HLG is the controller of this data. Under the GDPR you may, at any time:

• Ask what we hold about you, and get a copy.
• Correct anything that is wrong.
• Delete your account. It removes the account, the organisations nobody else is in, the advertising tokens and everything you saved. Invoices already issued stay with Stripe, because a receipt is an accounting record and you keep needing it after you leave.
• Object to a processing, or ask that it be restricted.
• Complain to your supervisory authority. In France that is the CNIL.

Write to hello@getmcpads.com and we will answer within one month. If the answer does not satisfy you, the CNIL takes complaints at cnil.fr.

Changes to this page

The date at the top is the date this page last changed. The two tables are generated from the record this service runs on, and a test refuses the build if a processor is named here that the code does not call, or if the code calls one that is missing. A machine-readable copy of this page is at /privacy.md.