AdPlug MCP

Privacy Policy

Last updated: April 15, 2026

1. What We Are

AdPlug MCP ("AdPlug", "we", "us") is a hosted Model Context Protocol (MCP) platform that lets performance marketers connect their advertising accounts and manage them through AI tools such as Claude, ChatGPT, Cursor, and other MCP-compatible clients.

AdPlug is operated by MeanData IT SRL. Our website is adplug.app.

2. Data We Collect

Account data

When you sign up, we collect your email address and name. If you sign in with Google, we receive your Google profile information (name, email, profile photo).

Ad platform credentials

When you connect Google Ads or LinkedIn Ads, we receive an OAuth refresh token from that platform. This token allows us to make API calls on your behalf. We encrypt all tokens at rest using AES-256 (Fernet) encryption. We never store your ad platform passwords.

Usage data

We log each MCP tool call you make (tool name, ad platform, account ID, success/error status, response time). This data powers your usage dashboard and helps us enforce subscription limits. We do not log the content of your AI conversations.

Payment data

Payments are processed by Paddle, our merchant of record. We do not store credit card numbers or bank details. Paddle handles all payment data under their own privacy policy.

3. How We Use Your Data

  • To authenticate you and provide access to your MCP endpoint
  • To execute ad platform API calls on your behalf when requested by your AI tool
  • To enforce usage limits based on your subscription tier
  • To display your usage history and connected accounts in your dashboard
  • To send you service-related emails (connection issues, usage alerts, billing)

We do not sell your data. We do not use your ad account data for advertising, benchmarking, or any purpose other than fulfilling your MCP tool requests.

4. Third-Party Services

We share data with these services only as needed to provide the product:

  • Supabase — Authentication and database hosting. Stores your profile, encrypted credentials, and usage logs. Located in US-East.
  • Google Cloud (Cloud Run) — Hosts our API server. Processes your MCP requests. Located in US-East.
  • Google Ads API / LinkedIn Ads API — We make API calls to these platforms using your OAuth tokens to fulfill your requests.
  • Paddle — Payment processing and subscription management. Handles billing as merchant of record.
  • Cloudflare — DNS and TLS termination for adplug.app.

5. OAuth 2.1 and MCP Client Access

AdPlug supports OAuth 2.1 authentication for MCP clients (such as Claude Desktop and ChatGPT). When you authorize an MCP client:

  • The client registers itself via Dynamic Client Registration (DCR)
  • You see a consent screen showing the client name and requested permissions
  • You can approve or deny the request
  • If approved, the client receives a time-limited access token (JWT)
  • You can revoke access at any time from your dashboard

We do not share your ad account data with MCP client developers. The MCP client acts as a conduit — it sends your requests to our server, and we return results directly to your AI conversation.

6. Data Retention

  • Account data — retained while your account is active. Deleted within 30 days of account deletion.
  • OAuth tokens — deleted immediately when you disconnect a platform or delete your account.
  • Usage logs — retained for the duration of your audit log period (7 days Free, 30 days Pro, 90 days Agency). Older logs are permanently deleted.

7. Security

  • All OAuth tokens are encrypted at rest (AES-256 / Fernet)
  • All connections use HTTPS (TLS 1.3)
  • MCP endpoint requires authentication on every request
  • OAuth 2.1 with PKCE for MCP client authentication
  • Row-Level Security (RLS) in the database — users can only access their own data
  • Rate limiting to prevent abuse (60 requests/minute per IP)

8. Your Rights

You can:

  • Access your data — view your profile, connections, and usage in the dashboard
  • Delete your data — disconnect platforms or delete your account from the dashboard settings
  • Revoke access — disconnect any ad platform at any time; we immediately delete the stored OAuth tokens
  • Export your data — contact us at privacy@adplug.app for a data export

If you are in the EU/EEA, you have additional rights under GDPR including the right to restrict processing and the right to data portability. Contact us to exercise these rights.

9. Cookies

We use essential cookies only for authentication (Supabase session cookies). We do not use tracking cookies, analytics cookies, or advertising cookies.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Continued use of AdPlug after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions or requests, contact us at: privacy@adplug.app

MeanData IT SRL
Bucharest, Romania