AdPlug

Privacy Policy

Last updated: October 6, 2026

1. What We Are

AdPlug MCP ("AdPlug", "we", "us") is a hosted Model Context Protocol (MCP) platform that lets performance marketers connect their advertising accounts and manage them through AI tools such as Claude, ChatGPT, Cursor, and other MCP-compatible clients.

AdPlug is operated by MEANDATA IT S.R.L. Our website is adplug.app.

2. Data We Collect

Account data

When you sign up, we collect your email address and name. If you sign in with Google, we receive your Google profile information (name, email, profile photo).

Ad platform credentials

When you connect Google Ads, LinkedIn Ads, Microsoft Ads, or Meta Ads, we receive an OAuth token from that platform (for Meta, an access token that lasts about 60 days). This token allows us to make API calls on your behalf. We encrypt all tokens at rest using AES-128-CBC + HMAC-SHA256 (Fernet) encryption. We never store your ad platform passwords.

Usage data

We log each MCP tool call you make (tool name, ad platform, account ID, success/error status, response time). This data powers your usage dashboard and helps us enforce subscription limits. We do not log the content of your AI conversations.

Payment data

Payments are processed by Paddle, our merchant of record. We do not store credit card numbers or bank details. Paddle handles all payment data under their own privacy policy.

Analytics data

Unless you turn analytics cookies off, PostHog records which pages you open and which features you use, along with your browser, device type and the approximate location of your IP address. It can also record a replay of a visit: what was on the screen and where you clicked, with anything typed into a form hidden. Once you sign in, this is linked to your account and email address, so we can tell which customers a problem affects.

Separately, our servers record product events such as an ad platform being connected or a plan changing. These do not use cookies.

Advertising data

Unless you turn advertising cookies off, Google Ads, LinkedIn and OpenAI learn that you visited, and whether a visit from one of our ads led to a sign-up or a subscription. To match a sign-up to the ad that led to it, OpenAI also receives a SHA-256 hash of your email address, and of the email address, phone number or name you type into a form on our site. The hash is made in your browser, so OpenAI does not receive the details themselves.

This does not run on the pages where you enter other people's details, such as the page for inviting teammates.

3. How We Use Your Data

  • To authenticate you and provide access to your MCP endpoint
  • To execute ad platform API calls on your behalf when requested by your AI tool
  • To enforce usage limits based on your subscription tier
  • To display your usage history and connected accounts in your dashboard
  • To send you service-related emails (connection issues, usage alerts, billing)
  • Where you have allowed it, to understand how AdPlug is used and to measure whether our own advertising works

We do not sell your data. We do not use your ad account data for advertising, benchmarking, or any purpose other than fulfilling your MCP tool requests.

Data minimisation. AdPlug only collects data from your context that is necessary to perform the function you have requested. We do not collect AI conversation content, even for logging purposes. The structured payloads returned by ad platform APIs flow through AdPlug to your AI client and are not retained at rest.

Requests from public authorities. We disclose personal data to a public authority only when the law requires it. We review every request for legality, challenge requests we believe are unlawful, disclose only the minimum data the request requires, and keep a record of each request.

4. Third-Party Services

We share data with these services only as needed to provide the product. For the full data-protection terms governing these sub-processors, including international transfer mechanisms, see our Data Processing Agreement.

  • Supabase — Authentication and database hosting. Stores your profile, encrypted credentials, and usage logs. Located in US-East-2.
  • Google Cloud (Cloud Run) — Hosts our API server. Processes your MCP requests. Located in US-East-1.
  • Vercel — Hosts the AdPlug web frontend (adplug.app).
  • Resend — Sends transactional email (service notifications, billing receipts).
  • Google Ads API / LinkedIn Ads API / Microsoft Advertising API / Meta Marketing API: we make API calls to these platforms using your OAuth tokens to fulfill your requests.
  • Paddle — Payment processing and subscription management. Handles billing as merchant of record.
  • Cloudflare — DNS for adplug.app, and TLS termination for our API (api.adplug.app).

The services below measure how AdPlug is used and how our advertising performs. What they receive from your browser depends on your cookie choices, described in section 11.

  • PostHog: product analytics. Receives product events from our servers and, unless you turn analytics cookies off, page views and session replays from your browser. Located in the US.
  • Google Tag Manager: loads the advertising tags below, unless you have turned advertising cookies off.
  • Google Ads, LinkedIn and OpenAI: measure sign-ups and subscriptions that come from our ads. They receive nothing from your browser once you turn advertising cookies off.

5. Google API Services — Limited Use Disclosure

AdPlug's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. See our full Google API Services Disclosure for details.

Specifically, AdPlug:

  • Only uses Google user data to provide and improve the AdPlug service — specifically, to execute Google Ads API calls on your behalf when you make requests through your MCP-compatible AI tool
  • Does not transfer Google user data to third parties, except as necessary to provide the service (e.g., making API calls to Google Ads on your behalf), as required by law, or with your explicit consent
  • Does not use Google user data for serving advertisements, including retargeting, personalized or interest-based advertising
  • Does not allow humans to read Google user data unless: (a) we have your explicit consent, (b) it is necessary for security purposes (investigating abuse or security incidents), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized for internal operations
  • Does not use Google user data to develop, improve, or train generalized or non-personalized AI and/or machine learning models. Data passed between your AI tool and the Google Ads API is not retained by AdPlug, used for model training, or shared with any AI model provider for training purposes.

Scope of Google data access

When you connect your Google Ads account, we request access to the following scopes:

  • Google Ads API (adwords) — to read and manage your Google Ads campaigns, ad groups, keywords, ads, and reporting data on your behalf
  • OpenID & Email (openid email) — to identify your Google account and display your connected email address in the dashboard

We only access your Google Ads data when you explicitly make a request through your AI tool. We do not run background syncs, automated scans, or scheduled jobs against your Google Ads account.

Token storage and revocation

Your Google OAuth refresh token is encrypted at rest using AES-128-CBC + HMAC-SHA256 (Fernet) encryption and stored in our database with Row-Level Security. You can revoke AdPlug's access at any time by disconnecting Google Ads from your dashboard, which immediately deletes the stored tokens. You can also revoke access from your Google Account permissions page.

6. Meta Platform Data

When you connect Meta Ads, Facebook asks you to approve the permissions below. AdPlug uses them only to carry out the requests you make through your AI tool.

  • ads_management and ads_read: to read and manage the campaigns, ad sets, ads, audiences and reporting of the ad accounts you choose
  • business_management: to find the ad accounts, Pages and catalogs in your business portfolios
  • pages_show_list, pages_read_engagement and pages_manage_ads: to list your Pages, read the Page details an ad needs (such as its linked Instagram account), and create ads and lead forms for them
  • catalog_management: to read and manage your product catalogs and product sets for catalog ads

We only access your Meta data when you make a request through your AI tool, and we do not run background syncs or scheduled jobs against your accounts. Ad data returned by Meta passes through AdPlug to the AI tool you connected (for example Claude by Anthropic or ChatGPT by OpenAI), which handles it under its own terms. We do not store it, sell it, share it with anyone else, use it for advertising, or use it to train AI models.

We store an encrypted access token, your app-scoped Facebook user ID and your Facebook name, so we can show the connection in your dashboard and match a deletion request to it. The token lasts about 60 days and is renewed while you keep using AdPlug. We keep these only while Meta Ads is connected.

To delete this data, disconnect Meta Ads on your Connections page, or remove AdPlug in your Facebook settings under Apps and Websites. Either way we delete the token and the connection straight away. Step-by-step instructions are on our data deletion page.

7. MCP Client Access (OAuth 2.1)

AdPlug supports OAuth 2.1 authentication for MCP clients (such as Claude Desktop and ChatGPT). When you authorize an MCP client:

  • The client registers itself via Dynamic Client Registration (DCR)
  • You see a consent screen showing the client name and requested permissions
  • You can approve or deny the request
  • If approved, the client receives a time-limited access token (JWT)
  • You can revoke access at any time from your dashboard

We do not share your ad account data with MCP client developers. The MCP client acts as a conduit — it sends your requests to our server, and we return results directly to your AI conversation.

8. Data Retention

  • Account data — retained while your account is active. Deleted within 30 days of account deletion.
  • OAuth tokens — deleted immediately when you disconnect a platform or delete your account.
  • Usage logs — retained for the duration of your audit log period (7 days Free, 30 days Pro, 90 days Agency). Older logs are permanently deleted.

9. Security

  • All OAuth tokens are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256)
  • All connections use HTTPS (TLS 1.3)
  • MCP endpoint requires authentication on every request
  • OAuth 2.1 with PKCE for MCP client authentication
  • Row-Level Security (RLS) in the database — users can only access their own data
  • Rate limiting on every endpoint to prevent abuse

In the event of a data breach affecting your Google account data or other personal information, we will notify you by email within 72 hours of discovery, describe the nature of the breach, and outline the steps we are taking in response.

10. Your Rights

You can:

  • Access your data — view your profile, connections, and usage in the dashboard
  • Delete your data — disconnect platforms or delete your account from the dashboard settings
  • Revoke access — disconnect any ad platform at any time; we immediately delete the stored OAuth tokens
  • Change your cookie choices in Cookie settings, found in the footer of any page and in section 11 below
  • Export your data — contact us at privacy@adplug.app for a data export

If you are in the EU/EEA, you have additional rights under GDPR including the right to restrict processing and the right to data portability. Contact us to exercise these rights.

11. Cookies

AdPlug stores three kinds of information in your browser. The first is always on. The other two are always on inside your account, and on our public pages unless you turn them off.

Necessary

  • Your sign-in session, kept in your browser's local storage by Supabase until you sign out
  • Your cookie choice (adplug_consent, 180 days)
  • A security cookie set by Paddle on its own domain when the dashboard loads the checkout
  • Small local storage entries that remember notices you have dismissed

Analytics

PostHog keeps one cookie and one local storage entry (both named ph_phc_..._posthog, up to 1 year) so it can tell one visit from another.

Advertising

  • Google Ads: _gcl_au (90 days) and _gcl_ls on adplug.app, plus cookies on google.com and doubleclick.net
  • LinkedIn: cookies on linkedin.com, including li_sugr, bcookie, lidc and UserMatchHistory (up to 1 year)
  • OpenAI: __oppref (30 days) and __obref (1 year) on adplug.app

When they are used

Analytics and advertising cookies are on from your first visit, wherever you visit from. On our public pages they stay on until you turn them off, in the cookie banner or in Cookie settings. Once you turn one off it stays off there, and we remember that for 180 days.

Inside your AdPlug account, in the dashboard and during onboarding, analytics and advertising are always on, whatever you chose on our public pages.

We do not sell personal data. Sending hashed contact details to measure our own ads can count as "sharing" under some US state laws. Turning Advertising off stops it.

Changing your choice

You can change your choice at any time in , which is also in the footer of every public page. When you turn a category off, its tags stop and we delete the cookies they set on adplug.app. A tab you already had open follows from the next page you open in it. Cookies that Google, LinkedIn or OpenAI keep on their own domains can be cleared in your browser.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Continued use of AdPlug after changes constitutes acceptance of the updated policy.

13. Contact

For privacy-related questions or requests, contact us at: privacy@adplug.app

MEANDATA IT S.R.L.
Chișinău, Moldova