Privacy policy

Last updated: 30 September 2026

What we collect

  • Google account identity: your Google account ID and email address, received when you sign in, with the date of your first and latest use. We use them to know who is using the service and to contact you about your account.
  • Google access token: the OAuth refresh token that lets the service read your Google Ads data on your behalf. It is stored encrypted at rest and is only sent over TLS. Google's Ads permission covers reads and writes, so the token itself could also change your account; read-only is enforced by our code, which never calls a change endpoint, and by the Read-only access level you can set on the Ads account.
  • Usage: how many tool calls you made each month, to apply the free plan limit.
  • Subscription status: whether you have an active paid plan, as reported by our payment provider.
  • Site visits: which pages of this site are opened, which links and buttons are clicked, when, from which country and referring site, and the browser name. No cookies are used and IP addresses are not stored: each visitor is counted with a code that changes every day and cannot be linked back to a person. We use it only to see how many real people visit and what they look for.
  • Early access requests: the email address you send through the early access form, used only to add your Google account and tell you when it is ready.

Google Ads data

When your AI assistant calls a tool, Ads MCP reads the requested report from the Google Ads API and returns it to your assistant. Report contents (campaigns, search terms, spend, conversions) are not stored by Ads MCP, with two exceptions, both only when you ask. If you ask for the dashboard, a temporary copy is kept behind a private link for 24 hours so the client can open it in a browser, then deleted. If you ask your assistant to remember search terms (for example "we sell this, never suggest it as a negative"), we keep a one-way fingerprint of each term, tied to your Google account and that Ads account, never the text of the term: it lets later reports recognise the term, and it cannot be read back without our server key. The service only reads: it never calls a change endpoint and never modifies your accounts (see "Google access token" above for what the permission itself allows).

Ads MCP's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell your data, do not use it for advertising, and do not use it to train AI models.

Who we share Google user data with

We share Google user data only with these parties, and only to run the service:

  • Your AI assistant (for example Claude): receives the report text you asked for, under that assistant's own privacy policy.
  • Cloudflare: hosts the service, stores the encrypted Google access token, and keeps technical request logs.
  • Polar: processes checkout, billing and taxes as merchant of record for the paid plan. Payment details go to Polar, not to us.
  • Google: sign-in and the Google Ads API, as required to read the reports.

We do not sell Google user data, do not share it with advertising platforms or data brokers, and do not use it for advertising or to train AI models.

How we protect it

  • In transit: all traffic uses TLS (HTTPS).
  • At rest: the Google access token is stored encrypted.
  • Access: only the server reads the token to call Google; humans do not browse your Ads data.
  • Reports: campaign, keyword and spend results are returned to your assistant and are not stored by us. Search terms you ask us to remember are kept only as keyed fingerprints, not as text.
  • Read-only: our code never calls a change endpoint, and we recommend granting the connected Google account the Read-only access level, which Google enforces.

How long we keep it

Your encrypted Google access is kept until you disconnect or revoke it. Your account ID and email, usage counts and subscription status are kept while you use the service and deleted on request. Early access requests are deleted once your account is added, or on request. Site visit records are deleted after 90 days. Remembered search term fingerprints are kept until you ask your assistant to forget them (one term or all of them for an account), or on request.

Your choices and rights

You can revoke Google access at any time from your Google account permissions. To access, correct or delete your data, write to support@adsmcp.dev. If you are in the EU or UK you also have the right to complain to your data protection authority.

Changes

We will update this page and its date when the policy changes.