Security
Your assistant never holds an ad token.
The connected assistant never holds an ad platform token: it talks to the gateway, the gateway talks to the platforms. Everything below is a fact about the shipped gateway, stated once and published in three formats.
- 9
- Sub-processors
- 7
- Outside the EU
- 14
- Stored items
- 2026-09-07
- Last reviewed
Tokens
- At rest
- Ad platform tokens are encrypted at rest with AES-256-GCM and never leave the server.
- Assistant exposure
- The connected assistant never holds an ad platform token: it talks to the gateway, the gateway talks to the platforms.
- Revocation
- Revoking an assistant's access happens in the dashboard and does not require rotating any platform credential.
Authentication
- Protocol
- OAuth 2.1 with PKCE (S256), dynamic client registration (RFC 7591), protected resource metadata (RFC 9728).
- API keys
- The MCP surface uses OAuth. The separate Data API uses hashed, scoped API keys with expiry, rotation and revocation.
Account scoping
The property most reviews come here to check: connecting a manager account does not expose the accounts under it.
- Model
- Per ad account, not per connection. Only accounts explicitly ticked in the dashboard are reachable.
- Enforcement
- Server side, on every call, including calls routed through run_tool. Nested account identifiers in arguments are checked too.
Safe Writes
- Preview
- Every write returns a description of the change and stops. Applying it requires a second call with confirm set to true.
- Creation
- Campaigns are always created paused. There is no option to create them active.
- Free plan
- The Free plan announces no write tool and refuses any write call.
Data
Nothing you read is stored. What you save is kept until you delete it, the card never reaches our servers, and everything that is stored is listed in full.
- Advertising data
- Unsaved interactive MCP answers stream from the platform APIs to the assistant without persistent report storage. Requested alerts retain configuration, latest observations and incident history until organisation deletion; unreferenced technical checks expire after 30 days. What you deliberately save, including review snapshots, is kept until you delete it. Data API extractions you request temporarily store report rows in private R2 objects for one to seven days. Delivered files remain in your chosen Google destination under your retention settings.
- Payment
- Card details are typed on Stripe's own page and never reach our servers. We hold a customer identifier and the plan, never a card number.
| Name | Kind | Why | Kept |
|---|---|---|---|
| gma_analytics_v2 | cookie | Remembers your analytics choice across the website and application. | Six months |
| gma_analytics_visitor | cookie | Links consented website and product events to a pseudonymous visitor and, after sign-in, your account. | Until analytics consent expires, at most six months |
| gma_ads_consent | cookie | Remembers your separate advertising measurement choice across our website and application. | Six months, then we ask again. |
| gma_ads_visitor | cookie | Connects consented browser activity with server conversions and keeps advertising attribution across our subdomains. | Until consent expires, at most six months; cleared on withdrawal. |
| _rdt_uuid, _rdt_cid, _rdt_em, _rdt_pn | cookie | Reddit Pixel identifiers for advertising attribution. Only loaded after advertising consent. | Reddit controls the Pixel lifetime; these cookies are cleared locally on withdrawal. |
| _twclid, _twpid | cookie | X Pixel advertising identifiers, only after explicit advertising consent including X. | X controls its Pixel cookie lifetime; we clear these locally on withdrawal and use server click attribution for 28 days. |
| gma_data_oauth | cookie | Verifies that a Google destination authorization was started by this signed-in browser. | Ten minutes, or until the connection completes. |
| __session, __client_uat | cookie | Keeps you signed in, so the dashboard does not ask again on every page. | Until you sign out. |
| gma_org | cookie | Remembers which organisation you are looking at, when you belong to more than one. | One year. |
| oauth state | cookie | Ties an advertising platform's authorisation response to the request you started. Without it, the flow cannot be verified. | The duration of the connection flow. |
| sidebar:state | cookie | Remembers whether you collapsed the sidebar. | One year. |
| theme | local storage | Remembers whether you chose light or dark. | Until you clear your browser data. |
| gma_consent | local storage | Remembers your answer about analytics, so we do not ask again. | Six months, then we ask again. |
| gma_ref | cookie | Carries the referral you followed from the link to the sign-up form. It is what puts 200 free tool calls on your own allowance when you create your account, and it credits the person who shared the link at the same time. Nothing is read from it unless you sign up, and it grants no access on its own. | Thirty days, or until you sign up. |
| What | How long |
|---|---|
| Performance alerts | Rule configuration, selected entity identifiers, latest observations, incident evidence and delivery history remain with the organisation. Pausing or archiving stops monitoring but preserves history. Unreferenced technical runs are removed after 30 days; runs referenced by incidents are retained. Organisation deletion removes its alerts and related records. Contact us for other deletion requests. |
| Reddit and X advertising measurement | Matching identifiers are held until consent expires (at most six months) or is withdrawn. Click IDs are used for 28 days. Pending conversions retry for at most 47 hours. Delivery records are kept for 30 days. Withdrawal stops future collection and pending delivery; data already received by Reddit or X follows the respective provider’s policy and deletion process. Contact us to request deletion there. |
| Your account and organisation | For as long as the account exists. Deleting the account removes them, and an organisation left with nobody in it is removed with it. |
| Advertising access tokens | Until you disconnect the platform, or the platform revokes them. Disconnecting deletes the row rather than marking it revoked. |
| Private service administration | We retain first-party operational request metadata (user and organisation identifiers, client type, tool name, platform, outcome and duration) for up to thirteen months to operate the service. We do not store prompts, arguments or response contents in these records. Our restricted owner dashboard also stores daily account-level advertising spend, currency and collection status for currently connected, explicitly selected accounts; disconnected account records are removed by the next daily cleanup when no active connection grants access. Historical aggregate organisation and plan counts do not identify individual users. These administration records are not sent to advertising networks or PostHog. |
| Unsaved interactive MCP answers | Never stored as report results. These answers are read from the platform on demand and passed straight to your assistant. Saved reviews and Data API extractions have the separate retention rules below. |
| Data API extractions and Google destinations | Requested extractions temporarily store report rows in private Cloudflare R2 objects for one to seven days, depending on the plan, then deny access and queue physical deletion. Query definitions, destination settings and job history remain with the organisation. Usage and audit records are retained for up to thirteen months. Google destination tokens are encrypted until disconnected. API keys are stored only as hashes. Files delivered to a customer's Google Sheet, BigQuery dataset or Cloud Storage bucket follow that customer's retention settings. |
| Advertising data you deliberately save | Kept until you delete it. Three things can be saved, and only the third holds figures. A saved view keeps your settings: which account, which dates, which metrics, and no results. A brief keeps your own notes about a client. A review keeps a frozen snapshot of a report, and that one does hold ad names, identifiers and their figures, because a review whose numbers changed after the fact would be worthless. These three are saved only when you ask for them. |
| ChatGPT plugin preferences | Your default client, reporting period, KPI focus and comparison, kept for you in each organisation until you change them. They are deleted when you leave the organisation or are removed from it, when your account is deleted, and with the organisation. |
| Campaign names for mentions | The names, identifiers and statuses of the campaigns Get MCP Ads read for your organisation, so ChatGPT can suggest them when you type @. No figures. A name not seen again for 90 days is deleted, and all of them are deleted with the organisation. |
| Automations and their deliveries | When you ask ChatGPT to act on an alert, a campaign launch or a Sheets export, its connection subscribes to those events: the subscription keeps the callback address ChatGPT gave, an encrypted signing secret and the alert, launch or export it follows, and the events waiting to be sent. Events are sent only to that callback address, which belongs to the assistant connection that asked for them (for ChatGPT, OpenAI), and only while that connection still has access. A subscription lasts at most seven days unless the assistant renews it. Stopping it, its expiry, disconnecting the assistant, losing access to the account, leaving the organisation or deleting it removes the subscription, its secrets and its pending events at once, and nothing already queued is sent afterwards. Sent or abandoned deliveries are kept for seven days, the proof that a callback address belongs to the connection for seven days, and a replaced signing secret for ten minutes. |
| Client memory and journal | On Team and Enterprise. The client sheet holds what someone in your organisation, or their assistant at their request, recorded about a client: objectives, rules, context and lessons, each line with the name of the person who wrote it. It is kept until someone deletes its lines. The journal records the changes made through Get MCP Ads with the reason given, the events your team noted, and the changes made directly in Meta and Google, archived every day. Changes and archived history are deleted after 400 days; notes stay until deleted. Everything goes with the client workspace or the organisation. |
| A review you chose to share | A shared review is readable at a secret address, without signing in, until it expires. Seven days by default, thirty at most. It carries the ad names and the figures of that review, never the account, your private notes or the media files. The link is stored only as a hash: revoking it, or deleting the review, closes the page immediately. |
| Invoices | Held by Stripe for as long as accounting rules require, and they outlive the account. A closed account still needs its receipts. |
| Usage counters | Thirteen months, so a year-on-year comparison is possible. They hold a count, not a query. |
| Invitations | Kept as a record of who was invited and when. The link itself is stored only as a hash and is never recoverable. |
Sub-processors
9 services touch personal data. 7 of them process it outside the European Union, and each one says where.
| Service | Role | Data | Region |
|---|---|---|---|
| PostHog | Optional product and audience analytics, only after analytics consent. | Pseudonymous visitor and account identifiers, safe page categories, campaign tags, feature and connector usage, normalized failures, plan and subscription events, and payment amount and currency. No prompts, report contents, connected account names, files or access tokens. Session replay is not enabled. | European Union (EU PostHog Cloud project). |
| Optional measurement and attribution of our Reddit advertising, only after your advertising consent. | Website and product milestones, purchase value and currency, Reddit click and browser identifiers, IP address, user agent, screen size, and hashed email and account identifier. No connected advertising account contents, assistant prompts or tokens. | United States and other locations described in Reddit’s privacy policy.outside EU | |
| X Ads | Optional advertising measurement after an explicit choice including X. | Allowlisted website and product milestones, event time, safe page path, purchase value and currency, X click identifiers, IP address and user agent, and SHA-256 hashed email for signed-in visitors. No prompts, file contents, connected account data or credentials. | Locations described in X's privacy policy, including the United States.outside EU |
| Vercel | Hosts the website and dashboard; provides optional, consent-based Web Analytics. | Request metadata and signed-in sessions. With analytics consent: page views, referrers, coarse location, device and browser information. | Edge in Paris, functions in Virginia (iad1).outside EU |
| Neon | PostgreSQL database. | Account, organisation, memberships, invitations, encrypted advertising and destination tokens, hashed API keys, grants, saved query definitions, job checkpoints, alert rules and incident evidence, usage and audit records. | AWS us-east-1, Virginia.outside EU |
| Cloudflare | Runs the MCP and Data APIs, background exports, private result storage and DNS. | Request metadata, presented credentials and report data processed by the gateway. Requested Data extraction results are temporarily stored in private R2 objects. | Cloudflare global network. R2 placement and processing depend on the configured storage location and execution region; no EU-only processing guarantee.outside EU |
| Clerk | Sign-in, sign-up, password reset and session management. | Email address, name, password hash, session and device metadata. | United States.outside EU |
| Stripe | Takes payment, holds the card, and issues the invoices. | Email address, name, the organisation's name and its identifier. Card details are typed on Stripe's own page and never reach our servers. | Ireland for the European contract, with processing in the United States.outside EU |
| Resend | Sends transactional email: invitations, welcome messages and requested alert notifications. | Recipient email address, and the content of the message. | AWS eu-west-1, Ireland. |
What an agent is never allowed to do
These are not exposed as agent capabilities at all: the boundary is architectural, not advisory.
Human only
- Granting OAuth consent on an advertising platform.
- Choosing which ad accounts to expose.
The four guarantees
The same four the product is sold on, stated here where they can be quoted.
Your assistant never holds an ad token
It talks to the gateway; the gateway talks to Google, Meta, TikTok and Pinterest. Ad platform credentials are encrypted at rest with AES-256-GCM and never leave the server, so a leaked chat transcript is not a leaked ad account.
Exposure is per account, not per connection
A Google MCC or a Meta Business Manager can sit over dozens of client accounts. Connecting one does not expose them all. The gateway answers only for the account IDs you explicitly ticked, and returns nothing for the rest.
Safe Writes: every change previews first
Every write tool returns a description of the change and stops. Applying it takes a second call with confirm set to true. An assistant that picked the wrong campaign shows you the wrong campaign instead of pausing it. Campaigns are always created paused.
OAuth 2.1, not an API key in a config file
The client registers itself dynamically, PKCE is required, and the code is bound to the redirect URI it was issued for. Revoking an assistant's access does not mean rotating a secret across your team.
Found something this page does not answer, or something it answers wrongly? Write to us. The privacy policy carries the legal detail behind these facts.