Privacy & Data Policy

This Privacy Policy explains how PlugMind collects, uses, stores, and deletes information when you connect advertising accounts, including Meta Ads and Google Ads, and use those accounts through the PlugMind dashboard or Model Context Protocol (MCP) tools.

1. Information We Store

When you connect Meta, PlugMind stores an encrypted OAuth access token, your Meta user identifier, the permissions Meta granted, identifiers and basic metadata for accessible ad accounts, and the ad account selected for each PlugMind workspace. For Facebook Page workflows, PlugMind reads Page identifiers, names, categories, public engagement counts, and Page tasks only when needed to list authorized Pages or use a Page as an advertising identity. Agency features may also read Business portfolio and asset relationships, product-catalog metadata and products, connected Instagram professional-profile metadata and aggregate insights, and Facebook Page aggregate insights.

Advertising reports, campaign hierarchies, audience configuration, and creative metadata are requested from the relevant advertising API to answer an authenticated request. PlugMind does not store raw report results or creative media by default. We do not collect or store advertising-account payment-card details.

If you explicitly use a lead-form workflow, PlugMind may retrieve lead identifiers, timestamps, campaign attribution, and form answers from an authorized Facebook Page. Personal form answers are omitted by default and requested only when you explicitly choose to include them. You are responsible for using exported lead data for a lawful purpose and respecting applicable consent, privacy, and retention requirements.

2. How We Use Advertising Data

We use connected-account information to authenticate API requests, list the accounts and Facebook Pages available to you, show reporting and analytics, inspect campaign configuration, and carry out advertising actions you explicitly request. Meta write tools can prepare and validate paused campaigns, ad sets, creatives, and ads, and perform approved create, update, status, archive, and deletion operations. Business, catalog, Page, Instagram, and lead data is used only for the corresponding workspace feature requested by the authenticated user.

3. AI Clients, Training, and Sharing

Advertising data is returned only to your authenticated PlugMind session and the AI client you choose to connect, such as ChatGPT or Claude, in response to your request. PlugMind does not sell Meta or advertising data and does not use private campaign data to train public foundation models. We disclose data to Meta and other connected platforms only as needed to perform their API requests, and to service providers that process data on our behalf under confidentiality and security obligations.

4. Security and Human Approval

OAuth access tokens are encrypted at rest with AES-256-GCM and data is transmitted over HTTPS/TLS. PlugMind separates advertising connections by authenticated client workspace. Write operations require an exact proposal and explicit human confirmation. New Meta advertising objects are created paused, and enabling an object is a separate approval-gated action because it may begin spending.

5. Retention, Revocation, and Deletion

Connection credentials and integration metadata are retained while the integration is connected or as needed to provide the service. Disconnecting an integration deletes its stored OAuth credentials and stops future API access. You may also remove PlugMind through Meta Business Integrations. Operational records are retained only as needed for security, fraud prevention, legal obligations, and resolving service errors.

Lead-form results are returned live and are not persisted by PlugMind by default. If a future CRM export stores lead data, that destination's retention and deletion controls will be shown to the user before the export is enabled.

To request deletion of Meta-related information, follow our User Data Deletion instructions. Meta may also send PlugMind a signed data-deletion request through our configured callback, which returns a confirmation code and a deletion-status URL.

6. Contact

For privacy questions or requests, contact dev@plugmind.io. Never send us passwords or access tokens by email.