Privacy policy✳

1. Information we access and store

• Your AMCP account: your name, email address, verification status, linked sign-in provider identifiers, workspace memberships, and a password hash if you use password sign-in.
• Connected services: OAuth access and refresh tokens, granted permissions, the user identifier and display name a platform states for each login (used to name logins and tell them apart), selected account/property identifiers, and synchronized asset names and metadata. These credentials let AMCP perform the connected features you request.
• Reporting data: campaign identifiers and names, objectives, dates, account currency/timezone, and requested performance metrics. Google Ads reports may include spend, impressions, clicks, conversions, and conversion value. Google Analytics 4 reports may include sessions, users, key events, revenue, engagement, and purchase metrics, grouped by campaign.
• Customer lists and offline conversions: where the workspace owner turns this on for an ad account, email addresses and phone numbers you upload for a customer list or an offline conversion are normalized and hashed with SHA-256 in memory, then sent to that platform. AMCP does not store them, raw or hashed: it keeps only counts, one digest of the hashed batch, and the consent and law confirmations you give.
• Saved work: report snapshots, custom metric formulas, saved report settings, export destinations, schedules, campaign plans, and assets you submit for connected workflows.
• Security and operation records: session information, connection and access changes, request outcomes, and diagnostic/audit records. Request IP information may be processed for abuse prevention and rate limiting.

2. Google permissions and property selection

Google services are connected individually. AMCP requests the permissions for a service when you choose to connect it. Signing in to AMCP does not itself connect your Google Ads or Analytics accounts.

Google Analytics: analytics.readonly lets AMCP list the accounts and properties your Google login can access, read selected property metadata such as currency and timezone, and retrieve reporting data. You select the properties to make available in AMCP. This connection does not request Analytics editing permission or change or delete your Analytics properties, settings, or source data.

This is the narrowest permission that authorizes the Analytics Data API properties.runReport method AMCP relies on. The only alternative Google offers for that method is the broader analytics permission, which additionally grants editing access that AMCP neither needs nor requests. Sign-in permissions and the Google Ads adwords permission do not authorize reading GA4 property reports.

Google Ads: adwords enables Google Ads account discovery and reporting. Google supplies this scope for Ads access, including reporting. Where you separately enable advertising writes in AMCP, account grants and explicit review/confirmation controls govern changes.

Google Customer Match and offline conversions: where advertising writes are enabled, the Google Ads connection also requests datamanager. It lets AMCP send hashed customer lists and offline conversions you upload to your Google Ads account through Google's Data Manager API, and read the status of those requests. Each upload carries the consent you state for the people in it.

Google Business Profile: where you connect it, business.manage lets AMCP list the Business Profile accounts and locations your Google login manages and read the ones you select. AMCP changes a location or account only through its reviewed-change flow, after you confirm each change.

Optional Google services: Google Sheets exports, Drive media imports, Search Console, and Tag Manager have separate connection flows and permissions. An Analytics permission does not authorize writing to Sheets or reading Drive files. For Sheets exports, AMCP writes report data only to the destination bound for that feature.

3. How AMCP uses the data

We use the data to authenticate you, display your selected accounts, retrieve requested reports, calculate custom metrics, retain saved reports, and provide performance recommendations. Currency, timezone, attribution, date range, and source limitations provide context for those results. Reporting recommendations do not automatically change advertising campaigns.

When you enable a schedule, AMCP retrieves the configured report and sends it to the selected destination at the configured times while authorization remains valid. CSV downloads and Google Sheets exports contain the report data you request. Separately authorized platform operations use the relevant account data to complete your reviewed instructions.

4. How we protect sensitive data

• Encryption in transit: the public service uses HTTPS/TLS. AMCP sends Google API and OAuth requests over HTTPS.
• Credential encryption: OAuth credentials, including Google access and refresh tokens, are encrypted in server-side storage using AES-256-GCM. Encryption is bound to the connection and workspace so a credential cannot be decrypted under a different connection. The encryption key is supplied through server configuration and is not included in browser code.
• Password and session protection: AMCP stores salted scrypt password hashes instead of plaintext account passwords. Production session cookies use Secure, HttpOnly, and SameSite protections. Sessions expire and can be revoked; two-step verification is available for member accounts.
• Access controls: protected workspace data requires authentication. Membership roles and selected account/property grants restrict access. Browser changes require origin and cross-site request forgery checks. Google account linking is protected by single-use OAuth state bound to the initiating browser, a nonce, an S256 PKCE code challenge, and verification of the returned identity token's signature, issuer, audience, and expiry.
• Reduced secret exposure: platform tokens are kept on the server and excluded from normal browser connection responses. Sensitive credential fields are redacted from application error and audit output.
• Abuse limits: repeated failed sign-in attempts are counted per account and per source address and are locked out temporarily once a threshold is reached. Password verification is additionally bounded so it cannot be used to exhaust server resources. Connection and access changes are recorded so misuse can be investigated.

Report snapshots, account identifiers, and audit records are stored in the server database and protected by application access controls and restrictions on server access. The credential encryption described above does not mean that every report field is individually encrypted at rest. No system can guarantee absolute security.

5. Sharing, service providers, and Google Limited Use

Data is available to authorized members of your workspace according to their access. Hosting and network providers process data needed to operate and protect the service; on amcp.shop these include Railway and Cloudflare. The configured transactional email provider processes account verification, invitation, and recovery messages.

Google and other platforms receive the requests necessary for the service you connect. When you choose a Google Sheets destination, exported data is subject to that spreadsheet's sharing settings. When you authorize an MCP client or another connected tool, it can receive results within its granted access. That tool's processing is also governed by its own terms and privacy policy. AMCP does not send Google user data to an external tool simply because you connect a Google account.

AMCP does not sell Google user data, use it to serve targeted advertisements or build advertising audiences, or use it to train or improve generalized artificial intelligence or machine-learning models. This includes data obtained through Google Workspace APIs and data derived from Google API results.

AMCP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Transfers are limited to delivering user-requested features with consent, security needs, applicable legal obligations, or a business transfer with prior explicit consent. Human access to Google data is limited to your affirmative agreement for specific data, necessary security investigation, legal obligations, or permitted internal operations using aggregated data.

6. Retention and deletion

Files uploaded from your computer expire 30 minutes after the upload starts. Their previews and review copies share that deadline and cannot be retained in the media library. AMCP refuses access at expiry and removes active stored copies on its 15-second cleanup pass or at startup after downtime. New AMCP backups exclude temporary media and website-uploaded originals. An owner may separately retain a file imported from a public link or Google Drive until removal. Media already sent to an advertising provider follows that provider's retention policy; upload receipts can remain as metadata.

We retain connected credentials while the connection is maintained. Disconnecting a login removes its credentials, the platform user name recorded for it, synchronized asset inventory, account names and readiness checks read through it, and selections from AMCP's active database. You can also revoke AMCP's access in the platform's account settings.

Saved reports, settings, export destinations, schedules, and audit history can remain after a connection is disconnected. Finished report records (report snapshots with their files, analyses, resolved incidents, and delivery receipts) are deleted after the period your workspace owner sets, from 7 to 365 days, or after 365 days when no period is set. Account requests that are never approved are erased after 30 days, and an account whose access was removed is erased 90 days later, with its own workspace. Other records are retained to provide saved reporting, scheduled work, security, and audit history until they or the workspace are deleted, subject to applicable legal retention requirements.

You can delete your own account in Account, under Delete your account. This erases your account, your own workspace, and everything that workspace holds, ends your memberships in other workspaces, and shows an erasure receipt. If other members still use your workspace, remove them first, because a workspace cannot be handed to another owner. For other deletion requests, contact your workspace administrator or us. An erased workspace's audit records keep only a placeholder in the tamper-evident chain. Deleted records leave AMCP's active database at once. Older backups and storage snapshots keep a copy until they expire under the operator's backup retention, and a deletion is applied again to any copy that is restored. We do not promise immediate erasure from all backups.

Disconnecting or deleting AMCP data does not delete source data in Google Analytics or Google Ads, downloaded CSV files, or reports already written to your Google Sheets. You control those copies and their sharing or deletion separately.

7. Your choices

In Connections, review or change selected accounts/properties, or disconnect a login. In Reporting overview, manage saved reports and pause schedules you no longer need. In Account, manage your sign-in methods, two-step verification, and sessions, or delete your account. Revoke external tool access in MCP connectors and review third-party access in your Google account at Google connections.

For additional instructions, see Data deletion. Revoking a Google authorization prevents further authorized Google requests once the revocation takes effect; it does not itself remove data already saved in AMCP.

8. Contact and policy changes

For privacy questions, access requests, or deletion of retained workspace data, contact the administrator who manages your AMCP workspace, or write to privacy@amcp.shop. Identify your workspace and the records concerned; do not include passwords, access tokens, or client secrets.

We publish changes on this page and update the date above. If we introduce a materially different use of Google user data, we will explain that use and obtain any required consent before the new use begins.