Privacy Policy

1. Who We Are

AdsCrafted ("we", "us", "our") operates the adscrafted.com website and the AdsCrafted MCP (Model Context Protocol) connector. This policy explains how we collect, use, store, and share information when you use our services, including through third-party integrations such as Claude by Anthropic.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address and an authentication credential (password or magic-link token). If you subscribe to a paid plan, we collect payment information through Stripe — we never store your full card number.

2.2 Amazon Account Data

When you connect your Amazon Seller or Advertising account, we receive OAuth tokens that grant access to your Amazon data. We use these tokens to:

• Retrieve campaign performance, keyword, and product data from the Amazon Ads API
• Retrieve sales, traffic, and inventory data from the Amazon SP-API
• Execute actions you explicitly request (bid changes, listing updates, campaign creation)

We only access the scopes you authorize and only perform actions you initiate through MCP tool calls.

2.3 MCP Interaction Data

When you use the AdsCrafted connector through Claude or another MCP client, we log:

• Tool names called and timestamps (for rate limiting and billing)
• Request duration and success/error status
• Your user ID and plan tier

We do not log the full contents of your queries or the AI-generated responses.

2.4 Knowledge Base Queries

Queries to our Amazon knowledge base are processed in real time via semantic search. We log query counts for rate limiting but do not store the query text beyond request processing.

3. How We Use Your Information

• Service delivery: Authenticate you, execute MCP tool calls, enforce plan limits
• Billing: Track usage for credit-based features (image generation, video generation)
• Security: Detect abuse, enforce rate limits, protect against unauthorized access
• Improvement: Aggregate, anonymized usage statistics to improve our tools

We do not sell your personal data. We do not use your Amazon account data to train AI models.

4. Data Sharing

We share data only in these circumstances:

• Amazon APIs: Your OAuth tokens are sent to Amazon to fulfill your requested actions. Amazon's privacy policy governs their handling.
• Stripe: Payment processing. See Stripe's privacy policy.
• Supabase: Database hosting and authentication. Data stored in US-region Supabase infrastructure.
• Anthropic (Claude): When you use the AdsCrafted connector through Claude, Anthropic's servers send MCP requests to our server. We return structured data (not personal data) that Claude formats into responses. See Anthropic's privacy policy.
• Legal requirements: If required by law, subpoena, or court order.

5. Data Storage and Security

• All data is stored in Supabase (PostgreSQL) with encryption at rest and in transit
• OAuth tokens are stored encrypted and scoped to specific API permissions
• MCP authentication uses OAuth 2.1 with PKCE S256 and token rotation
• All API keys and OAuth tokens are hashed (SHA-256) before storage — plaintext is never persisted in the database
• Access tokens expire after 1 hour; refresh tokens after 30 days

6. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
• Amazon tokens: Revoked and deleted when you disconnect your Amazon account or delete your AdsCrafted account.
• MCP request logs: Retained for 90 days for debugging and billing, then purged.
• Activity logs: Retained for 90 days.

7. Your Rights

You may:

• Access your data by contacting us
• Delete your account and all associated data
• Disconnect your Amazon accounts at any time through the AdsCrafted dashboard
• Revoke MCP connector access by disconnecting AdsCrafted in your Claude settings
• Export your data by requesting a copy from us

For EU/UK users (GDPR): You additionally have the right to data portability, rectification, and to lodge a complaint with your supervisory authority.

For California users (CCPA): We do not sell personal information. You have the right to know, delete, and opt-out.

8. Cookies

We use essential cookies for authentication session management. We do not use advertising or tracking cookies.

9. Children

AdsCrafted is not intended for users under 18. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notice. Continued use after changes constitutes acceptance.

11. Contact

For privacy questions or data requests, contact us at:

privacy@adscrafted.com