Privacy Policy

AdPlug MCP ("AdPlug", "we", "us") is a hosted Model Context Protocol (MCP) platform that lets performance marketers connect their advertising accounts and manage them through AI tools such as Claude, ChatGPT, Cursor, and other MCP-compatible clients.

AdPlug is operated by MEANDATA IT S.R.L. Our website is adplug.app.

• To authenticate you and provide access to your MCP endpoint
• To execute API calls to your connected platforms on your behalf when requested by your AI tool
• To enforce usage limits based on your subscription tier
• To display your usage history and connected accounts in your dashboard
• To send you service-related emails (connection issues, usage alerts, billing)
• Where you have allowed it, to understand how AdPlug is used and to measure whether our own advertising works

We do not sell your data. We do not use the data in your connected accounts for advertising, benchmarking, or any purpose other than fulfilling your MCP tool requests.

Data minimisation. AdPlug only collects data from your context that is necessary to perform the function you have requested. We do not collect AI conversation content, even for logging purposes. The structured payloads returned by the platforms' APIs flow through AdPlug to your AI client and are not retained at rest, apart from the change previews and Search Console inspection results described below.

Requests from public authorities. We disclose personal data to a public authority only when the law requires it. We review every request for legality, challenge requests we believe are unlawful, disclose only the minimum data the request requires, and keep a record of each request.

We share data with these services only as needed to provide the product. For the full data-protection terms governing these sub-processors, including international transfer mechanisms, see our Data Processing Agreement.

• Supabase: Authentication and database hosting. Stores your profile, encrypted credentials, and usage logs. Located in US-East-2.
• Google Cloud (Cloud Run): Hosts our API server. Processes your MCP requests. Located in US-East-1.
• Vercel: Hosts the AdPlug web frontend (adplug.app).
• Resend: Sends transactional email (service notifications, billing receipts).
• Google Ads API / Google Search Console API / LinkedIn Ads API / Microsoft Advertising API / Meta Marketing API / HubSpot API / Reddit Ads API: we make API calls to these platforms using your OAuth tokens to fulfill your requests.
• Paddle: Payment processing and subscription management. Handles billing as merchant of record.
• Cloudflare: DNS for adplug.app, and TLS termination for our API (api.adplug.app).

The services below measure how AdPlug is used and how our advertising performs. What they receive from your browser depends on your cookie choices, described in section 13.

• PostHog: product analytics. Receives product events from our servers and, unless you turn analytics cookies off, page views and session replays from your browser. Located in the US.
• Google Tag Manager: loads the advertising tags below, unless you have turned advertising cookies off.
• Google Ads, LinkedIn and OpenAI: measure sign-ups and subscriptions that come from our ads. They receive nothing from your browser once you turn advertising cookies off.

AdPlug's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. See our full Google API Services Disclosure for details.

Specifically, AdPlug:

• Only uses Google user data to provide and improve the AdPlug service, specifically to execute Google Ads and Google Search Console API calls on your behalf when you make requests through your MCP-compatible AI tool
• Does not transfer Google user data to third parties, except as necessary to provide the service (e.g., making API calls to Google Ads or Google Search Console on your behalf), as required by law, or with your explicit consent
• Does not use Google user data for serving advertisements, including retargeting, personalized or interest-based advertising
• Does not allow humans to read Google user data unless: (a) we have your explicit consent, (b) it is necessary for security purposes (investigating abuse or security incidents), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized for internal operations
• Does not use Google user data to develop, improve, or train generalized or non-personalized AI and/or machine learning models. Data passed between your AI tool and Google's APIs is not retained by AdPlug (apart from change previews, kept for a day or two as described in section 10, and the Search Console URL inspection results described below), used for model training, or shared with any AI model provider for training purposes.

When you connect Meta Ads, Facebook asks you to approve the permissions below. AdPlug uses them only to carry out the requests you make through your AI tool.

• ads_management and ads_read: to read and manage the campaigns, ad sets, ads, audiences and reporting of the ad accounts you choose
• business_management: to find the ad accounts, Pages and catalogs in your business portfolios
• pages_show_list, pages_read_engagement and pages_manage_ads: to list your Pages, read the Page details an ad needs (such as its linked Instagram account), and create ads and lead forms for them
• catalog_management: to read and manage your product catalogs and product sets for catalog ads

We only access your Meta data when you make a request through your AI tool, and we do not run background syncs or scheduled jobs against your accounts. Ad data returned by Meta passes through AdPlug to the AI tool you connected (for example Claude by Anthropic or ChatGPT by OpenAI), which handles it under its own terms. We do not store it, sell it, share it with anyone else, use it for advertising, or use it to train AI models.

We store an encrypted access token, your app-scoped Facebook user ID and your Facebook name, so we can show the connection in your dashboard and match a deletion request to it. The token lasts about 60 days and is renewed while you keep using AdPlug. We keep these only while Meta Ads is connected.

To delete this data, disconnect Meta Ads on your Connections page, or remove AdPlug in your Facebook settings under Apps and Websites. Either way we delete the token and the connection straight away. Step-by-step instructions are on our data deletion page.

When you connect a HubSpot portal, HubSpot shows you the permissions AdPlug asks for. Read access to contacts, companies and deals is required. The rest are optional, and you can untick them before you approve. AdPlug uses them only to carry out the requests you make through your AI tool.

Apart from reading the portal's name and region when you connect it, we only access your HubSpot data when you make a request through your AI tool, and we do not run background syncs or scheduled jobs against your portals. Records and reports go from HubSpot through AdPlug to the AI tool you connected (for example Claude by Anthropic or ChatGPT by OpenAI), which handles them under its own terms. We do not keep a copy of them (change previews, below, are the one exception), and we do not sell them, share them with anyone else, use them for advertising, or use them to train AI models.

For each portal you connect, we store its Hub ID and name, the name you give it in AdPlug, its domain and data region, the HubSpot user ID and email address that connected it, the permissions it granted, and its tokens, encrypted. We keep these while the portal is connected.

When your AI tool prepares a change, such as updating a contact or creating a task, we save the change you asked for (for example which records, and the new values) as a preview. Once you approve it and it runs, we keep HubSpot's answer in its place. A daily clean-up deletes each preview a day or two after it was made. Our usage log records which HubSpot tool was called and the portal's Hub ID, never the records themselves.

To delete this data, choose Remove on the portal on your Connections page, then Confirm remove. We delete the portal's details, its tokens and any of its change previews that never ran straight away, and ask HubSpot to revoke AdPlug's login for that portal. Your other portals stay connected, and your HubSpot records stay exactly as they are. Deleting your AdPlug account in the dashboard does the same for every portal you connected, and deletes any change previews with it. Step-by-step instructions are on our data deletion page.

When you connect Reddit Ads, Reddit asks you to approve the permissions below. AdPlug uses them only to carry out the requests you make through your AI tool.

• adsread: to read your ad accounts, campaigns, ad groups, ads and reports
• adsedit: to create and change the campaigns, ad groups, ads, posts and audiences you approve
• adsconversions: to send the conversion events you ask us to send

We only access your Reddit data when you make a request through your AI tool, and we do not run background syncs or scheduled jobs against your accounts. Ad data returned by Reddit passes through AdPlug to the AI tool you connected (for example Claude by Anthropic or ChatGPT by OpenAI), which handles it under its own terms. We do not store it, sell it, share it with anyone else, use it for advertising, or use it to train AI models.

We store your Reddit tokens encrypted, plus your Reddit member ID, username and email address, so we can show the connection in your dashboard. We keep these only while Reddit Ads is connected.

To delete this data, disconnect Reddit Ads on your Connections page or delete your AdPlug account. Either way we delete the tokens and these details straight away and revoke AdPlug's access at Reddit. You can also remove AdPlug under authorized applications in your Reddit app preferences.

AdPlug supports OAuth 2.1 authentication for MCP clients (such as Claude Desktop and ChatGPT). When you authorize an MCP client:

• The client registers itself via Dynamic Client Registration (DCR)
• You see a consent screen showing the client name and requested permissions
• You can approve or deny the request
• If approved, the client receives a time-limited access token (JWT)
• You can revoke access at any time from your dashboard

We do not share your ad account data with MCP client developers. The MCP client acts as a conduit: it sends your requests to our server, and we return results directly to your AI conversation.

• Account data: retained while your account is active. Deleted within 30 days of account deletion.
• OAuth tokens, and the HubSpot portal details in section 7: deleted immediately when you disconnect a platform, remove a HubSpot portal, or delete your account.
• Change previews: when your AI tool prepares a change in Google Ads, Google Search Console or HubSpot, we keep the change and, once it runs, the platform's answer. A daily clean-up deletes each one a day or two after it was made, and deleting your account deletes them straight away.
• Usage logs: retained for the duration of your audit log period (7 days Free, 30 days Pro, 90 days Agency). Older logs are permanently deleted.

• All OAuth tokens are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256)
• All connections use HTTPS (TLS 1.3)
• MCP endpoint requires authentication on every request
• OAuth 2.1 with PKCE for MCP client authentication
• Row-Level Security (RLS) in the database: users can only access their own data
• Rate limiting on every endpoint to prevent abuse

In the event of a data breach affecting your Google account data or other personal information, we will notify you by email within 72 hours of discovery, describe the nature of the breach, and outline the steps we are taking in response.

You can:

• Access your data: view your profile, connections, and usage in the dashboard
• Delete your data: disconnect platforms or delete your account from the dashboard settings
• Revoke access: disconnect any ad platform at any time; we immediately delete the stored OAuth tokens
• Change your cookie choices in Cookie settings, found in the footer of any page and in section 13 below
• Export your data: contact us at privacy@adplug.app for a data export

If you are in the EU/EEA, you have additional rights under GDPR including the right to restrict processing and the right to data portability. Contact us to exercise these rights.

AdPlug stores three kinds of information in your browser. The first is always on. The other two are always on inside your account, and on our public pages unless you turn them off.

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Continued use of AdPlug after changes constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact us at: privacy@adplug.app

MEANDATA IT S.R.L.
Chișinău, Moldova