Effective Date:

Privacy Policy

How AdCrunch collects, uses, and protects your information.

AdCrunch Inc. (“AdCrunch,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use AdCrunch (“Service”), our website, and related services.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect the following categories of information:

Account & Contact Information

  • Name, email address, company name, and billing details when you create an account or subscribe.

Ad Account Connection Data

  • OAuth authorization tokens and permissions from Meta, TikTok, X (Twitter), Snapchat, and other supported ad platforms.
  • We use read-only scopes whenever possible.
  • We do not store your ad platform usernames or passwords.

Ad Campaign Data

  • Campaign setup details (creatives, targeting, bidding strategies)
  • Performance metrics (impressions, clicks, spend, ROAS, CTR, CPL, conversions, audiences)
  • This data is accessed only through official platform APIs via your authorized OAuth connections.

Usage & Technical Data

  • MCP queries and interactions with AI agents
  • IP address, browser type, device information, and product analytics events (see “Product Analytics” below)
  • Session recordings of our website and of the AdCrunch console (see “Session Recordings” below)
  • Logs of MCP endpoint calls for security and service improvement

Product Analytics

  • We use PostHog for product analytics. PostHog receives analytics events from our website, from the AdCrunch console, and from the MCP server.
  • We do not anonymize these events. When you sign in, we link your analytics events to your account by your user id. The console also sends your email address to PostHog.

Session Recordings

  • PostHog records sessions on our website and in the AdCrunch console.
  • A recording shows the pages that you visit and what you do on them: your mouse movements, your clicks, and your scrolls. It can contain the text on the page, such as the names and the metrics of your campaigns in the console.
  • A recording also contains the log messages that the page writes in your browser, and the address and the timing of each network request that the page makes.
  • We mask the text that you type in form fields.
  • When you sign in, we link your session recordings to your account, as we do for your analytics events.

Support Widget

The Support widget lets you write to the AdCrunch team from our website and from the AdCrunch console. PostHog supplies the widget. One thread in the widget is a ticket. When you write to us in the Support widget, PostHog receives:

  • The email address that you type. The widget does not ask for your name. In the AdCrunch console, the widget does not ask for an email address, because PostHog already has the email address of your account.
  • The text of each message
  • The page where you wrote

Each ticket links to your analytics events and to your session recording. The AdCrunch team reads the tickets and replies to you in the widget or by email.

MCP Usage Data

When an AI agent that connects to AdCrunch calls a tool, we send one analytics event to PostHog. We send the same event when the Adgent, the chat agent of the AdCrunch console, calls a tool. A tool call event contains:

  • The name of the tool
  • The names of the arguments
  • The duration of the call
  • Whether the call failed, and the error code of a failed call

An AI agent that starts a session with a handshake sends the name and the version of its agent application. We send them to PostHog in one event.

Each MCP usage event also contains:

  • Your user id and your organization id
  • The OAuth client id of an external agent application
  • The user agent and the client type that the agent application sends in its request headers
  • Whether the agent is the Adgent or an external agent
  • The MCP protocol version
  • The AdCrunch environment and software version that handled the event

We never send argument values, tool results, or error messages to PostHog.

Capability Requests

  • A capability request is a task that an AI agent asked for and that no AdCrunch tool can do.
  • When an AI agent calls the request_capability tool, the text that the agent writes goes to PostHog. The text describes the task. The event also contains the data that each MCP usage event contains (see above).
  • The tool tells the agent not to include names, email addresses, or account ids in the text.
  • We do not store the text in our own database.

AI Agent Interaction Data

  • Natural-language queries sent through the Service and the resulting responses (stored only as needed to deliver the Service)

We do not collect sensitive personal data (such as health, racial, or religious information) through the Service.

2. How We Use Your Information

We use the collected information to:

  • Provide and maintain the Service (including the MCP server that lets AI agents query your ad data)
  • Enable secure OAuth connections and normalized cross-platform reporting
  • Process your subscription and billing
  • Improve the Service through product analytics and product development
  • Communicate with you about account, updates, or support
  • Detect and prevent fraud, abuse, or security issues
  • Comply with legal obligations

We do not use your ad data or queries to train any large language models or for any purpose unrelated to providing the Service.

3. How We Share Your Information

We share information only in the following limited cases:

  • With Ad Platforms: To fulfill your OAuth connections and retrieve campaign data (strictly as authorized by you).
  • Service Providers: With trusted subprocessors (e.g., cloud hosting, payment processors, analytics tools) who are contractually obligated to protect your data.
  • Product Analytics and Support: PostHog is our subprocessor for product analytics, for session recordings, and for the Support widget. It receives the analytics events, the session recordings, the tickets, the MCP usage data, and the capability requests that this policy describes. We use PostHog Cloud EU, which stores this data in the European Union.
  • Legal Requirements: If required by law, subpoena, or government request.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets (with notice where required).

We never sell your personal information or ad campaign data to third parties for marketing or advertising purposes.

4. Data Security

We implement industry-standard security measures, including:

  • Encryption of data in transit (TLS) and at rest
  • Secure storage of OAuth tokens
  • Strict access controls and regular security audits
  • Anonymization where possible

However, no system is 100% secure. You are responsible for maintaining the security of your own ad platform accounts and credentials.

5. Data Retention

  • We retain your account information for as long as your account is active.
  • Ad campaign data is retained only as long as necessary to provide the Service (typically while your subscription is active).
  • You may request deletion of your data at any time (see “Your Rights” below).
  • PostHog keeps analytics events, MCP usage data, capability requests, and tickets for the retention period of our PostHog plan.
  • PostHog keeps session recordings for 30 days.

6. Your Rights and Choices

Depending on your location, you may have the following rights:

  • Access, correction, or deletion of your personal information
  • Opt-out of certain processing (including any automated decision-making)
  • Data portability
  • Withdrawal of consent (where applicable)

To exercise these rights, contact us at privacy@adcrunch.dev. We will respond within 30 days (or sooner where required by law).

California Residents (CCPA/CPRA): You have additional rights regarding the sale of personal information (we do not sell data) and can submit a verifiable consumer request.

EU/UK Residents (GDPR): We act as a data processor for your ad data. Our lawful basis for processing is performance of contract and legitimate interests.

7. Cookies and Tracking Technologies

We use essential cookies to operate the Service. We also use limited analytics cookies from PostHog to understand usage patterns. When you sign in, we link the analytics events to your account. The Support widget keeps an identifier in the local storage of your browser. This identifier gives your browser access to its tickets. You can manage preferences via your browser settings.

8. International Data Transfers

If you are outside the United States, your data may be transferred to and processed in the United States or other countries. We use appropriate safeguards (such as Standard Contractual Clauses) to protect your information.

9. Children’s Privacy

The Service is not intended for anyone under the age of 18. We do not knowingly collect data from children.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice in the Service. Your continued use after changes constitutes acceptance of the updated policy.

11. Contact Us

For any questions about this Privacy Policy, please contact us at: